Re: Calculating events per sec

Brian Byrne wrote:
>I am working on putting together a SIMs package and one bit of info. I need
>is to calculate the events per second we expect to get.  I don't know if
>there is well known formula for this but I didn't find one in my research.

There isn't one. The rate at which a machine logs has more to do with
the stimulus it's getting than the O/S or anything else. I.e.: a firewall or
load-balancer looks a whole lot different from a file server - even if they
are both running the same version of BSD.

Take a representative machine and look at the number
of log-lines per day it generates, then do some basic math from there.
You can use 300 bytes as a good guesstimate of a typical log-line
length for UNIX machines and "larger" for Windows.

Another decent way of getting log scope estimates is to just use
tcpdump to count log quantities from representative machines.
Bear in mind that logs may be quite "bursty" depending on what
is happening and if something happens that affects a large number
of machines, the "burstiness" can cause the dam to burst, too. :)

mjr.