Measured event size · Windows workstation

Windows 10 log size: 700 bytes per event

The average Windows 10 event is 700 bytes, measured from samples of its logs. A Windows workstation source typically produces 5 events per second per device, bursting to 50: assumes Sysmon; raw EDR telemetry is 10x. The rate is an informed estimate; the size is measured.

What that comes to

One device, raw bytes, at the typical rate for a Windows workstation source.

A day of Windows 10 logs from one device at the category's typical rate, 302 MB, is about 4 times an hour of Spotify.

Size your own

Raw bytes, before compression, indexing overhead and replication.

Measure a sample of your own

The figure above is an average; yours will differ, and for Windows 10 what moves it most is this: assumes Sysmon; raw EDR telemetry is 10x. The profiler reads a sample from Windows 10 in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.

The Windows workstation category: its typical rate and every source in it →