How much log data will your SIEM take in each hour, day, week and month? Start from typical numbers, or measure your own machines for an estimate you can defend. Then see peaks, storage, cost, and what filtering saves.
🔒 Everything stays in this browser. Summary files you add are read here and never uploaded.
🔒 Saved only in this browser.
1Measure your machines (optional, more accurate)
Run a small read-only script on a sample of machines. Each run writes one summary file of counts and sizes (no log messages, user names or IP addresses). Add the files below and your measured numbers replace the typical ones.
Windows
Workstations, servers and domain controllers.
Open PowerShell as administrator (right-click Start, then Terminal (Admin) or Windows PowerShell (Admin)).
Copy the script, paste it into the window, and press Enter.
SHA-256 of the file 9777cca9f6bf73b0eb21fdbf2aa03579080b9768590d4b8de026197f58204aee
Firewalls and network devices
These can't run a script, so LogSizer listens instead. On any Windows machine, it receives the device's syslog for a few busy hours.
Paste into PowerShell as administrator on the machine that will listen.
Point the device's syslog (or a second syslog destination) at that machine, UDP on the port above. Allow that port in Windows Firewall.
Leave it running. The summary file is saved on the Desktop when the time is up, or when you press Ctrl+C.
Which machines to measure
At least 2 domain controllers, ideally busy ones (for example, the ones most users sign in through).
3 to 5 typical workstations used by different kinds of staff.
2 or 3 of each kind of server (file, application, web, database).
A few Linux servers, and each firewall or VPN for a few busy hours.
You don't need every machine. The estimate averages each kind and multiplies by how many you have. Each script runs in under a minute, changes nothing, and makes no network connections. Pasting avoids downloading a script file, which some antivirus products block until a new script builds a reputation.
2Your environment
Enter how many of each you have. Leave the rest at 0. Events per second and event size start at typical values; change them if you know better.
3Estimated volume
How it works
Volume = sources × events per second (EPS) × average event size × time. GB here means 1,000,000,000 bytes.
Typical values are starting points from common sizing practice, shown as a low–high range. Real environments vary widely, mostly with audit settings and traffic, so measure where you can.
Measured values come from the LogSizer scripts. They read each log's event count and the time span it covers, so the rate is right even when a log rolls over quickly. Event size is measured from a recent sample, as the XML or text line a SIEM agent forwards.
Hourly shape and peaks: user-driven sources (workstations, firewalls, cloud apps) are busier in working hours; servers run flatter. The peak adds a burst factor on top of the busiest hour for logon storms, patching and incidents.
Your SIEM counts differently. Licensing and storage depend on how your SIEM parses, enriches, compresses and replicates data. The storage ratio is a rule of thumb; confirm it with your vendor.
Filtering savings use your measured event mix when you've added Windows summaries, and typical shares otherwise.
This is a planning estimate, not a quote. Re-measure after you change audit policy or add log sources.