# NIST 800-171 Audit Log Storage Sizing Calculator

> Source: https://netray.co/tools/nist-800-171-audit-log-storage-sizing-calculator
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Estimate gigabytes per day, online searchable storage and compressed archive storage for the audit logs your CUI environment must produce and keep.

## Category

aerospace-defense

## Industry

Defense

## Region

United States

## Audience

- IT manager
- Security engineer
- Defense supplier

## Tool

**Kind:** calculator

**Currency:** $

**Inputs:**

#### Log sources

**Key:** sources

**Type:** number

**Default:** 60

**Min:** 1

**Step:** 1

**Unit:** sources

**Help:** Servers, firewalls, endpoints, identity systems, SaaS tenants and ERP servers in scope.

#### Average events per second per source

**Key:** eps

**Type:** number

**Default:** 2

**Min:** 0

**Step:** 0.5

**Unit:** EPS

#### Average event size

**Key:** bytes

**Type:** number

**Default:** 500

**Min:** 50

**Step:** 50

**Unit:** bytes

**Help:** Windows security events and JSON logs are often 500 to 1,500 bytes; syslog lines are smaller.

#### Online (searchable) retention

**Key:** online_days

**Type:** slider

**Default:** 90

**Min:** 30

**Max:** 365

**Step:** 15

**Unit:** days

#### Total retention including archive

**Key:** archive_days

**Type:** number

**Default:** 365

**Min:** 30

**Step:** 30

**Unit:** days

**Help:** Set by your policy and contract. SP 800-171 does not fix a number of days.

#### Index overhead multiplier

**Key:** index_factor

**Type:** select

**Default:** 1.5

**Options:**

##### 1.2 (light index)

**Value:** 1.2

##### 1.5 (typical)

**Value:** 1.5

##### 2.0 (full-text heavy)

**Value:** 2

#### Archive compression ratio

**Key:** compression

**Type:** select

**Default:** 8

**Options:**

##### 4:1

**Value:** 4

##### 8:1

**Value:** 8

##### 12:1

**Value:** 12

#### Storage cost per GB per month

**Key:** cost_gb

**Type:** number

**Default:** 0.04

**Min:** 0

**Step:** 0.01

**Unit:** $/GB

**Help:** Blended cost of your storage tier.

**Outputs:**

#### Events per day

**Key:** events_day

**Expr:** sources * eps * 86400

**Format:** integer

#### Raw log volume per day

**Key:** gb_day

**Expr:** events_day * bytes / 1000000000

**Format:** decimal

**Description:** Decimal gigabytes per day.

#### Online storage needed

**Key:** online_gb

**Expr:** gb_day * online_days * index_factor

**Format:** number

**Primary:** true

**Description:** GB held in searchable storage including index overhead.

#### Archive storage needed

**Key:** archive_gb

**Expr:** gb_day * max(archive_days - online_days, 0) / compression

**Format:** number

**Primary:** true

**Description:** GB of compressed archive beyond the online window.

#### Total storage

**Key:** total_gb

**Expr:** online_gb + archive_gb

**Format:** number

#### Monthly storage cost

**Key:** monthly_cost

**Expr:** total_gb * cost_gb

**Format:** currency

**Chart:**

#### Total storage vs online retention days

**Type:** line

**X:** online_days

**From:** 30

**To:** 365

**Steps:** 24

**Series:**

- total_gb

**Disclaimer:** Sizing estimate only. Measure real event rates for two weeks before buying storage, and confirm retention with your contract and counsel.

## Content

**Intro:** Audit and accountability practices expect you to create, protect and retain system logs. The hard part is knowing how much storage that means. This calculator converts events per second into daily volume and retained storage.

**Sections:**

#### How to use it

**Body:** Count the sources that must log inside your CUI boundary, then estimate the average events per second per source from a sample week. Enter average event size, the period you keep logs searchable and your total retention period. The calculator splits storage into an online tier with index overhead and a compressed archive tier, then prices both at your blended per-GB rate.

**Bullets:**

- Use averages, then add headroom for peaks and incident spikes.
- Include identity, firewall, VPN and the ERP application servers.
- Add forwarders and collectors to your source count if they log too.

#### The formulas

**Body:** Events per day equals sources times EPS times 86,400. Raw gigabytes per day equals events times bytes divided by one billion. Online storage equals daily volume times online days times the index factor. Archive storage equals daily volume times the days beyond the online window, divided by the compression ratio. Retention is a policy decision: SP 800-171 requires audit records but does not state a day count, while DFARS 252.204-7012 requires preserving relevant images and monitoring data for at least 90 days after a cyber incident report.

#### Common mistakes

**Body:** Teams often size for steady state and forget that a noisy event such as a failed logon storm or verbose debug setting can multiply volume tenfold. Another mistake is storing logs on the systems being logged, which weakens protection of audit information. Log timestamps also need a synchronized time source, otherwise correlation after an incident is unreliable.

**Bullets:**

- Protect log storage with separate access control from the logged systems.
- Test restore from archive at least once a year.

**Cta:** If you want to search logs and ERP audit trails in plain language without sending them to a public cloud, we build private retrieval over your own data. Talk to us about an on-prem pilot.

**Faq:**

#### How long must I keep audit logs for CMMC Level 2?

**Answer:** NIST SP 800-171 requires audit records to be created and retained for monitoring and investigation but sets no fixed number of days. Your policy, contract clauses and any incident preservation duty decide the period.

#### What is the index factor?

**Answer:** Search platforms store extra index data beside raw events. A multiplier of about 1.2 to 2.0 covers that overhead depending on how much of the text is indexed. Check your platform vendor sizing guide.

#### Is one EPS per source realistic?

**Answer:** It varies widely. A quiet file server may emit a fraction of an event per second while a domain controller or firewall can emit hundreds. Sample real counts per source class and sum them.

#### Does this cover packet capture?

**Answer:** No. Full packet capture is far larger than event logs. If you retain it for incident response, size it separately from throughput and retention.

## Search terms

log storage calculator, siem storage sizing, nist 800-171 audit logging, cmmc audit and accountability, log retention calculator, events per second to gb per day, syslog storage estimate, dfars 7012 log retention

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json