Measured event size · IDS/IPS

Zeek IDS log size: 150 bytes per event

The average Zeek IDS event is 150 bytes, measured from samples of its logs. An IDS/IPS source typically produces 200 events per second per device, bursting to 2,000: alert-only sensors far lower, Zeek/Suricata far higher. The rate is an informed estimate; the size is measured.

What that comes to

One device, raw bytes, at the typical rate for an IDS/IPS source.

A day of Zeek IDS logs from one device at the category's typical rate, 2.6 GB, is about the size of an hour of Netflix in HD.

Size your own

Raw bytes, before compression, indexing overhead and replication.

Measure a sample of your own

The figure above is an average; yours will differ, and for Zeek IDS what moves it most is this: alert-only sensors far lower, Zeek/Suricata far higher. The profiler reads a sample from Zeek IDS in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.

Other IDS/IPS sources

• Snort200 B

The IDS/IPS category: its typical rate and every source in it →