Measured event size · Windows servers
Windows Server 2016 log size: 800 bytes per event
The average Windows Server 2016 event is 800 bytes, measured from samples of its logs. A Windows server source typically produces 50 events per second per device, bursting to 300: assumes 4688 plus Sysmon. The rate is an informed estimate; the size is measured.
What that comes to
One device, raw bytes, at the typical rate for a Windows server source.
| Period | At 50 events/s | At the 300 events/s burst |
|---|---|---|
| An hour | 144 MB | 864 MB |
| A day | 3.5 GB | 20.7 GB |
| 90 days | 311 GB | 1.9 TB |
| A year | 1.3 TB | 7.6 TB |
A day of Windows Server 2016 logs from one device at the category's typical rate, 3.5 GB, is about the size of an hour of Netflix in HD.
Size your own
Raw bytes, before compression, indexing overhead and replication.
Measure a sample of your own
The figure above is an average; yours will differ, and for Windows Server 2016 what moves it most is this: assumes 4688 plus Sysmon. The profiler reads a sample from Windows Server 2016 in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.
Other Windows server sources
- Windows Event Log2,413 B
- Windows DNS1,066 B
The Windows server category: its typical rate and every source in it →
Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.