NIST 800-171 Audit Log Storage Sizing Calculator
Audit and accountability practices expect you to create, protect and retain system logs. The hard part is knowing how much storage that means. This calculator converts events per second into daily volume and retained storage.
Your numbers
Servers, firewalls, endpoints, identity systems, SaaS tenants and ERP servers in scope.
Windows security events and JSON logs are often 500 to 1,500 bytes; syslog lines are smaller.
Set by your policy and contract. SP 800-171 does not fix a number of days.
Blended cost of your storage tier.
Your results
Sizing estimate only. Measure real event rates for two weeks before buying storage, and confirm retention with your contract and counsel.
Total storage vs online retention days
Sweeps Online (searchable) retention from 30 to 365, holding your other inputs fixed.
Optional logging design review
We can review your log sources, retention and protection design for a CUI environment.
Optional. The tool and every export work without this. No spam.
How to use it
Count the sources that must log inside your CUI boundary, then estimate the average events per second per source from a sample week. Enter average event size, the period you keep logs searchable and your total retention period. The calculator splits storage into an online tier with index overhead and a compressed archive tier, then prices both at your blended per-GB rate.
- Use averages, then add headroom for peaks and incident spikes.
- Include identity, firewall, VPN and the ERP application servers.
- Add forwarders and collectors to your source count if they log too.
The formulas
Events per day equals sources times EPS times 86,400. Raw gigabytes per day equals events times bytes divided by one billion. Online storage equals daily volume times online days times the index factor. Archive storage equals daily volume times the days beyond the online window, divided by the compression ratio. Retention is a policy decision: SP 800-171 requires audit records but does not state a day count, while DFARS 252.204-7012 requires preserving relevant images and monitoring data for at least 90 days after a cyber incident report.
Common mistakes
Teams often size for steady state and forget that a noisy event such as a failed logon storm or verbose debug setting can multiply volume tenfold. Another mistake is storing logs on the systems being logged, which weakens protection of audit information. Log timestamps also need a synchronized time source, otherwise correlation after an incident is unreliable.
- Protect log storage with separate access control from the logged systems.
- Test restore from archive at least once a year.
Frequently Asked Questions
How long must I keep audit logs for CMMC Level 2?
NIST SP 800-171 requires audit records to be created and retained for monitoring and investigation but sets no fixed number of days. Your policy, contract clauses and any incident preservation duty decide the period.
What is the index factor?
Search platforms store extra index data beside raw events. A multiplier of about 1.2 to 2.0 covers that overhead depending on how much of the text is indexed. Check your platform vendor sizing guide.
Is one EPS per source realistic?
It varies widely. A quiet file server may emit a fraction of an event per second while a domain controller or firewall can emit hundreds. Sample real counts per source class and sum them.
Does this cover packet capture?
No. Full packet capture is far larger than event logs. If you retain it for incident response, size it separately from throughput and retention.
If you want to search logs and ERP audit trails in plain language without sending them to a public cloud, we build private retrieval over your own data. Talk to us about an on-prem pilot.
Related Tools
CMMC Level 2 Remediation Budget Calculator
Turn a gap count and CUI headcount into a first-year CMMC Level 2 budget, with a sweep showing how cost scales with the number of CUI users.
Aerospace & DefenseCUI Enclave vs Enterprise Scope Cost Calculator
Model whether a dedicated CUI enclave is cheaper than bringing every user into scope, with a break-even CUI headcount and a what-if chart.
Compliance & ContractsPlan of Action and Milestones (POA&M) Template
Fill in a security requirement gap and get a formatted POA&M document with weakness, risk, resources, milestones and sign-off lines.
Aerospace & DefenseDFARS Flowdown Subcontractor Risk Tracker
An editable worksheet that records CUI exposure, flowdown status and cyber maturity per subcontractor and scores risk so you know whom to chase first.
More Aerospace & Defense tools
See all- DPAS Rated Order Acceptance Deadline Calculator
- Export License Delay Schedule Risk Calculator
- CMMC 2.0 Level 2 Readiness Assessment
- ITAR Compliance Checklist for Manufacturers
- DFARS 252.204-7012 Compliance Self-Assessment
- AS9100 Audit Readiness Checklist
- Export Control Screening Checklist
- Defense Contractor AI Readiness Assessment
- Counterfeit Parts Risk Assessment (AS5553)