Free Tool

Log Storage & EPS Calculator

Estimate log volume and required storage from events per second (EPS), retention and average event size. The result is an indicative capacity-planning estimate.

Estimate mode

Environment

Employees

Used to estimate workstation and identity-related events.

Servers

Application, database, file and infrastructure servers.

Network & security devices

Firewalls, switches, routers, VPN gateways, IDS/IPS and similar devices.

Retention

days

Data sources

Group / system	Avg EPS	# of sources
Windows
Windows Server	30 EPS
Windows Active Directory	100 EPS
Windows Desktop	2 EPS
UNIX / Linux
UNIX / Linux Servers	10 EPS
Security
Firewall zones – internal	200 EPS
Firewall zones – external	400 EPS
IPS	5 EPS
Vulnerability scanners	1 EPS
VPN	5 EPS
Antivirus	30 EPS
Infrastructure
Routers	2 EPS
Switch / SCCM	1 EPS
Proxy server	300 EPS
Wi-Fi AP	5 EPS
Load balancer	5 EPS
Servers
Database servers	5 EPS
Web servers	5 EPS
Mail servers	40 EPS
Other
Other sources (total EPS)

Calculation settings

Average event size

bytes

700 bytes is a commonly used planning assumption.

Retention

days

Total storage equals estimated daily volume multiplied by retention.