Syslog Storage Calculator

Planning rate {{ resultsReady ? `${formatNumber(computation.values.planning_eps, 1)} EPS` : '—' }} Raw ingest {{ resultsReady ? `${formatBytes(computation.values.raw_bytes_per_day)}/day` : '—' }} Retention {{ resultsReady ? `${computation.normalizedInputs.retention_days} days` : '—' }}

Ingest input:

Choose the sustained rate source used for the storage plan.

Log sources:

Whole active sources from 1 to 1,000,000.

Average EPS per source:

Events per second averaged across the sizing window.

EPS/source

Aggregate EPS:

Measured total events per second for this searchable store.

EPS

Average event size:

Measure representative messages when possible; the sample default is 700 bytes.

bytes/event

Searchable retention:

Whole days from 1 to 3,650.

days

Compression ratio:

Replace the 2:1 planning default with measured stored-to-raw behavior.

Index overhead:

Add platform-specific index and metadata storage after compression.

Stored copies:

Use 1 for a single searchable copy or 2 for primary plus one replica.

Planning reserve:

Reserve above searchable copies; keep OS and unrelated backup storage separate.

Plan label:

Optional label only; it does not change the calculation.

Peak multiplier:

The neutral 1.0 default leaves measured average EPS unchanged.

× EPS

Usable disk budget:

Set 0 to keep this optional comparison neutral.

Disk budget unit:

GiB, TiB, and PiB use powers of 1024.

Budget target:

Used only when a nonzero disk budget is set.

Storage plan

{{ row.label }}{{ row.display }}

Calculation method:

Binary storage units use powers of 1024; calculations retain full precision until display.

required = EPS × bytes/event × 86,400 × days ÷ compression × (1 + index%) × copies × (1 + reserve%)

{{ row.label }}: {{ row.value }} — {{ row.note }}

The chart renderer is unavailable. The same values remain available in the storage plan and sizing ledger.

Signal	Value	Meaning	Copy
{{ row.label }}	{{ row.display }}	{{ row.detail }}

A searchable log store must absorb a stream of events every second and keep enough history for queries, alerts, and investigations. The storage request is rarely just event rate multiplied by retention. Message size varies by source, indexes add data, replicas multiply it, and a nearly full disk may stop accepting or reallocating work before every byte is consumed.

Events per second (EPS) describes throughput. Early plans often estimate aggregate EPS from source count and average EPS per source; mature environments can measure the combined rate at a collector or search platform. Average event size should come from representative stored messages because short device notices, structured application events, audit records, and multiline payloads can differ greatly.

Syslog storage stages and their planning meaning
Stage	What it represents	Evidence to improve it
Raw ingest	Planning EPS multiplied by average event bytes and time.	Collector counters and sampled message sizes.
Compressed retention	Raw retained bytes divided by the measured stored-to-raw ratio.	A representative index or data-tier sample.
Searchable primary	Compressed events plus indexes and metadata.	Platform storage metrics after parsing and field extraction.
Required usable storage	Searchable copies plus planning reserve.	Replica policy, disk thresholds, rollover behavior, and growth tests.

Searchable retention is the period immediately available for analysis. It may be shorter than archive retention, where older logs are kept in cheaper storage and restored when needed. Mixing those tiers into one number can overstate fast-storage needs or leave investigators waiting for data that was assumed to be searchable.

Syslog defines a message format and roles for originators, relays, and collectors, but it does not define one stored event size or compression result. A defensible capacity plan records every assumption and repeats the calculation after logging policies, parsing, replicas, or retention change.

How to Use This Tool:

Size one searchable tier or retention class at a time so one noisy source does not disappear inside an unrelated average.

Choose Ingest input. Use source count and average EPS for an early estimate, or Aggregate EPS when the combined rate has been measured.
Enter Average event size and Searchable retention. Use a sample taken after the same parsing and logging settings planned for service.
Set Compression ratio, Index overhead, Stored copies, and Planning reserve. Replace the defaults with platform evidence when available.
Use Peak multiplier only when a sustained busy period must be included. Add a Usable disk budget and Budget target to compare the estimate with available capacity.
Read Storage plan for the capacity decision, Storage stages for the growth from raw ingest to reserve, and Sizing ledger for each assumption and derived value.

Interpreting Results:

Required storage is usable capacity for the modeled searchable data, copies, and reserve. It does not include operating-system space, snapshots, unrelated backups, temporary migration copies, or another data tier. Raw bytes per day is the best first check because a wrong EPS or event-size assumption flows through every later stage.

Disk budget status boundaries
Status	Exact condition	Meaning
Not set	Disk budget equals 0	No capacity comparison is made.
Within target	Required storage ≤ target bytes	The estimate stays within the chosen operating target.
Target exceeded	Target bytes < required storage ≤ disk budget	The data fits the disk but uses reserved headroom.
Disk exceeded	Required storage > disk budget	The modeled requirement is larger than the entered usable disk.

Budget retention days estimates how long the target capacity lasts under the same daily requirement. It is not a forecast when event rate, message mix, compression, or index design is changing.

Technical Details:

The model is dimensional and deterministic. It resolves a sustained planning EPS, converts that rate to raw bytes per day, applies retention, compression, index overhead, copy count, and reserve in order, then compares the total with an optional binary disk budget in GiB, TiB, or PiB.

Formula Core:

Each multiplier or divisor has a separate operational meaning, which makes the total auditable:

\begin{array}{lcl} E_{base} & = & sources \times EPS per source \\ E_{plan} & = & E_{base} \times peak \\ B_{raw day} & = & E_{plan} \times bytes per event \times 86400 \\ B_{primary} & = & \frac{B_{raw day} \times days}{compression ratio} \times (1 + \frac{index percent}{100}) \\ B_{required} & = & B_{primary} \times copies \times (1 + \frac{reserve percent}{100}) \end{array}

In measured aggregate mode, the entered aggregate EPS replaces source count times per-source EPS. A 2:1 compression ratio divides raw retained bytes by two. Index overhead is added after compression, stored copies multiply the complete primary searchable footprint, and reserve is added after all searchable copies.

Disk budget units use binary factors: GiB is 2³⁰ bytes, TiB is 2⁴⁰, and PiB is 2⁵⁰. Target bytes equal disk budget times the selected target percentage. Headroom equals target bytes minus required bytes, and target retention equals target bytes divided by daily required bytes.

Verified substitution:

For 250 sources averaging 0.8 EPS, 700-byte events, 180 days, 2:1 compression, 35% index overhead, one stored copy, 20% reserve, and no peak multiplier, base and planning rate are 200 EPS. Raw ingest is 12,096,000,000 bytes per day and required searchable storage is 1,763,596,800,000 bytes, about 1.60 TiB. No capacity status is assigned until a nonzero disk budget is entered.

Accuracy Notes:

The arithmetic is exact for the entered assumptions, but those assumptions can change after collection, parsing, indexing, and retention policies are applied.

Measure EPS across a representative window that includes known busy periods and policy changes.
Sample stored event sizes after forwarding and parsing; truncation, structured fields, and multiline handling change the average.
Measure compression and index overhead on the target platform with a representative source mix.
Keep filesystem safety, platform watermarks, snapshots, restoration space, and migration overlap outside or explicitly inside the entered reserve, but do not count them twice.
Repeat the plan after adding sources, replicas, extracted fields, verbose logging, or a longer searchable window.

References:

RFC 5424: The Syslog Protocol, RFC Editor, March 2009.
SP 800-92: Guide to Computer Security Log Management, National Institute of Standards and Technology, September 2006.
Watermark errors, Elastic Docs.
How to receive remote syslog messages with rsyslog, Simplified Guide.
How to store remote syslog messages by hostname in rsyslog, Simplified Guide.