EPS & Syslog Volume Calculator

Size log ingestion for a SIEM or managed detection service. Enter device counts by class — each class carries a defensible default event rate and event size you can override — then set retention tiers and cost assumptions to get EPS, daily volume, storage, and cost.

Your work stays in this browser.

Report details

Name (for report)

Company (for report)

Email (for report)

Customer name (for report)

Choose the concise customer report or the detailed engineering assessment.

Device worksheet

Leave EPS or bytes blank to use the default rate shown.

Device class	Count	EPS / device	Bytes / event	Peak ×
Network security
Next-generation firewall Traffic, threat and URL logging enabled at a branch/edge boundary				3×
IDS / IPS sensor Signature alerts only, not full packet metadata				4×
Web proxy / secure web gateway One record per HTTP transaction, business-hours weighted				3×
VPN / ZTNA gateway Session establishment, posture and teardown events				5×
Email security gateway Message disposition and threat verdict records				3×
Network infrastructure
Switch / router Link, config and authentication events; no flow export				4×
Wireless controller / access point Association, roaming and authentication events				4×
DNS / DHCP server Query logging enabled; the largest single volume driver in most estates				3×
Identity
Domain controller Windows security event log with audit policy enabled				4×
Identity provider / MFA service Authentication, MFA challenge and admin events per tenant				5×
Privileged access management Credential checkout and session events				4×
Compute
Windows server Security, system and application channels at standard audit level				3×
Linux / Unix server auth, syslog and audit facility				3×
Hypervisor host Host, VM lifecycle and storage events				3×
Endpoint
Endpoint (EDR / antivirus telemetry) Detection and selected telemetry forwarded to the log platform				4×
Managed mobile device Enrolment, compliance and policy events				4×
Application
Database instance Login and privileged statement auditing, not full statement audit				4×
Web / application server Access log plus application error log				4×
Cloud & SaaS
Cloud audit trail (per sub) Control-plane audit events; JSON records are large				4×
SaaS audit trail (per tenant) Admin and user activity API export				4×
Voice
VoIP / UCaaS platform Call detail, registration and quality events				4×
VoIP handset / endpoint Registration and provisioning events				4×

Volume assumptions

Global peak multiplier

Compression ratio (8 = 8:1)

Index overhead (%)

Annual growth (%)

Planning horizon (months)

Physical sites with logging equipment

Retention tiers

Hot — searchable (days)

Warm — occasional search (days)

Cold / archive (days)

Monthly read-back (% of stored)

Cost assumptions

Storage rate preset

Average of the three major providers' US list rates. Use for early budgetary figures.

Licence cost per GB/day, monthly ($)

Collection layer, monthly ($)

Hot $/GB

Warm $/GB

Cold $/GB

Results

Enter at least one device count in the worksheet to see results.

Saved reports

Every report you download is filed here automatically. Revision numbers are assigned for you.