Skip to main content
Calcimator

Log Retention Calculator

Calculate security log storage requirements from log sources, event rates, retention policy, and tiered storage costs. Supports PCI DSS, HIPAA, and SOX compliance planning.

Inputs

Results

Total EPS

250

Total storage needed (TB)

0.61

Events per day (millions)21.6
Raw daily volume (GB)10.1
Hot tier (GB)52
Warm tier (GB)129
Cold tier (GB)317
Monthly storage cost ($)$11.00
Annual storage cost ($)$128.00
How to Use This Calculator
  1. Enter log sources and average events/sec per source and average event size (bytes).
  2. Enter retention period (days) -- PCI-DSS: 365, HIPAA: 2190, SOX: 2555.
  3. Review total EPS, events per day (millions), raw daily ingestion (GB), and total storage (TB).
  4. Apply compression (5-10:1 for logs) and deduplication to reduce actual storage needs.

How the result changes with Log sources

Log sourcesTotal EPSTotal storage needed (TB)
1,0015,00512.3
3,50117,50543.04
6,50032,50079.9
9,00045,000110.63

What each input means

Log sources
Total log-generating devices: servers, firewalls, switches, applications, endpoints.
Avg events/sec per source
Average events per second per source. Firewalls: 10-100 EPS, servers: 1-10 EPS, apps: 0.5-5 EPS.
Avg event size (bytes)
Average log event size. Syslog: 200-400 bytes, Windows events: 500-1000 bytes, JSON logs: 500-2000 bytes.
Retention period (days)
Days to retain logs. PCI DSS: 365 days, HIPAA: 2190 days (6 yr), SOX: 2555 days (7 yr).

What each result means

Total EPS
Total events per second across all log sources — key metric for SIEM sizing.
Events per day (millions)
Total events generated daily in millions.
Raw daily volume (GB)
Uncompressed log data generated per day.
Total storage needed (TB)
Total storage across all tiers for the full retention period.
Hot tier (GB)
Fast-search storage for the last 30 days (indexed, SSD).
Warm tier (GB)
Compressed storage for 31-120 day range (HDD-based search).
Cold tier (GB)
Archive storage for 120+ days (object storage or tape).
Monthly storage cost ($)
Estimated monthly cost across hot ($0.10/GB), warm ($0.03/GB), and cold ($0.005/GB) tiers.
Annual storage cost ($)
Estimated annual storage cost.

How this is calculated

Worked example, using the default values

  1. Identify Input Parameters
    4 parameters
    Log sources = 50, Avg events/sec per source = 5, Avg event size (bytes) = 500, Retention period (days) = 365 = 4 input(s) provided
  2. Calculate Total EPS
    Total EPS = logSources * avgEPS
    250 = 250
  3. Calculate Total storage needed
    Total storage needed = totalStorageGB / 1024
    0.61 = 0.61
  4. Calculate Events per day
    Events per day = eventsPerDay / 1000000
    21.6 = 21.6
  5. Calculate Raw daily volume
    Raw daily volume = rawDailyBytes / (1024 * 1024 * 1024)
    10.1 = 10.1

Engine last updated .

Related Calculators

The questions that sit next to this one — chosen by subject, including calculators filed under a different category.

Security Tools

SIEM Sizing Calculator

Size your SIEM deployment: calculate EPS capacity, storage, infrastructure nodes, and license costs by pricing model (Splunk, QRadar, Sentinel).

Security Tools

Backup Storage Calculator

Calculate backup storage requirements from source data volume, daily change rate, retention policy, and compression ratio using a GFS backup model.

Security Tools

Encryption Strength Calculator

Estimate brute-force time from key length and attacker computing power. Covers symmetric (AES) and asymmetric (RSA) algorithms with quantum threat modeling.

More in Technology & Computing.