SIEM Security Log Storage, EPS & Audit Retention Calculator

Capacity planning for security log ingestion and retention in Security Information and Event Management (SIEM) platforms—such as Wazuh, Elastic Security (ELK), Graylog, and centralized rsyslog collectors—is a foundational requirement for regulatory compliance (ISO/IEC 27001 Annex A.12.4, NIST SP 800-92, and PCI-DSS Requirement 10). Every network appliance (FortiGate firewalls, MikroTik routers, managed switches) and server workload (Linux auditd/journald, Windows Event Log, and container runtimes) continuously emits telemetry measured in Events Per Second (EPS). Daily raw log volume is governed by the product of aggregate EPS across all monitored endpoints, the number of seconds in a day (86,400 seconds), and the average byte footprint per log event. Standard RFC 5424 syslog lines generated by routers or Nginx access logs typically average 250 to 400 bytes, whereas structured JSON telemetry from EDR/XDR agents or verbose Windows Security Event IDs ranges from 600 to 1,200 bytes per event. When ingested into a real-time search index such as Elasticsearch or OpenSearch (Hot Tier), Lucene inverted indices and document metadata add roughly 10% storage overhead above raw volume. To balance query performance with multi-month audit retention costs, enterprise SIEM architectures implement tiered storage: a high-IOPS NVMe SSD Hot Tier for active 30–90 day investigation, paired with a Cold Archive Tier utilizing Zstandard (zstd) or Gzip block compression (achieving 5:1 to 8:1 reduction ratios), plus a mandatory 20% filesystem watermark safety buffer. Beyond raw terabyte capacity, Security Operations Center (SOC) architects must size disk write IOPS and ingestion queue buffers to survive burst telemetry during active security incidents. During a brute-force wave, port scan, or DDoS event, firewall and IDS/IPS (Suricata/Zeek) log generation frequently spikes to 3x–5x baseline EPS. Provisioning NVMe storage for active shard indexing and maintaining at least 20% free disk headroom prevents Elasticsearch or Wazuh Indexer from triggering its 95% flood-stage read-only circuit breaker during critical forensic investigations.