Uniqcli

Security log ingest and retention planner

Translate EPS and event size into stored retention volume with separate indexing, compression, replication and free-space assumptions.

Security

Security log ingest and retention planner

Translate EPS and event size into stored retention volume with separate indexing, compression, replication and free-space assumptions.

Example inputs · Replace these with your measurements to build your plan.

Method, example and sources
  1. Multiply EPS × event bytes × 86,400 seconds for raw daily bytes.
  2. Apply indexing/metadata overhead and divide by the entered compression ratio.
  3. Multiply by retention days and total stored copies.
  4. Add working space and divide by the usable final storage fraction.

Worked example. 1,000 EPS × 500 bytes produces 43.2 GB/day raw. With 20% overhead, 2:1 compression, 30 days, two copies and 50 GB scratch, 20% reserve needs 2,006.5 GB.

Planning result · confirm model details

Log ingest and retention volume

Decimal GB and days are explicit. Compression, index overhead and replication are separate entered assumptions.

Raw event data per day
43.2GB
Stored daily data per copy
25.92GB
Replicated retention data
1,555.2GB
Required provisioned storage
2,006.5GB
  • RFC syslog structure does not define your stored/indexed size or compression ratio. Use measured representative events and the target platform's retention behavior.
  • Peak EPS, hot/cold tiers, query IOPS, merge work and recovery capacity can dominate an otherwise sufficient byte budget.

From the catalog

Servers

Explore related listings, then confirm the exact model requirements against your plan. These listings are not an automatic compatibility or capacity verdict.

Browse servers Browse hard drives/solid state drives Browse storage arrays & servers Get help with the specification

How to use this result

Event count alone does not determine storage. Average serialized event size, index overhead and retention behavior all matter, so the planner exposes each as a separate input. It uses decimal gigabytes consistently and counts the total number of stored copies rather than confusing an additional replica with the primary copy.

What to verify next

Compression is workload-specific, and indexes can expand rather than shrink raw data. Measure representative events in the target platform before committing storage. Average EPS also hides bursts that determine ingest and queue requirements. Query concurrency, hot and cold tiers, merge activity, recovery time and retention policy enforcement can require a different disk layout even when the byte total fits.

Worked example

1,000 EPS × 500 bytes produces 43.2 GB/day raw. With 20% overhead, 2:1 compression, 30 days, two copies and 50 GB scratch, 20% reserve needs 2,006.5 GB.

Security log ingest and retention planner — Uniqcli