Log Retention Calculator

Security teams have to retain logs for years to satisfy compliance frameworks, but sizing that storage wrong either wastes budget on unused capacity or leaves a SIEM silently dropping events it can't afford to keep. This calculator multiplies log sources by average events-per-second per source to get total EPS, then scales that up to a full day of events and multiplies by average event size in bytes to get raw daily volume. From there it applies two realistic adjustments: a 7:1 compression ratio (a reasonable average for typical text-based log formats once compressed) to shrink the raw volume, and a 20% index overhead on top of that compressed size, since search indexes for fast querying always cost extra space beyond the compressed log bytes themselves. Multiplying the resulting daily footprint by your retention period (in days) gives total storage required.

The calculator then splits that retention window into three tiers that mirror how real log-management platforms are architected: a 30-day "hot" tier that keeps the index overhead for fast search, a following 90-day "warm" tier that drops the index but keeps standard compression, and a "cold" archive tier for everything beyond 120 days at a slightly better 10% compression bonus, typical of object storage or tape. Each tier gets its own approximate cost-per-GB (SSD-based hot storage, HDD-based warm, and cheap archival cold), which roll up into monthly and annual cost estimates. Treat the compression ratio, index overhead, and per-tier costs as reasonable industry-average assumptions, not your vendor's actual pricing or your logs' actual compressibility — verify against your SIEM's real ingestion metrics and your storage provider's quoted rates before budgeting.