EPS Calculator & Disk Planning



This article will explain the calculation of eps and disk usage area before installation.



Events per second is a term used in IT management to describe the number of events or transactions that occur on any IT device at a given time.

- EPS amounts help to determine the hardware capacity of Logsign Unified Security Operations Platform servers.
- EPS shows the number of events from a certain source, an increase in EPS is observed when there is a problem or anomaly movement on this source.



EPS Calculation

EPS values can never be calculated with 100% accuracy, only average values can be considered.

For example, while the traffic log of users with internet access is usually "x", traffic may drop to "y" in a given period.

Factors affecting EPS values;

- organization users,

- security products,

- total assets.

An organization that manages 50 users and an organization that manages 5000+ users cannot expect EPS to be the same. According to these values, an average amount of EPS and the average area occupied by the disc can be determined according to the finding obtained from this value.

The line lengths in the incoming log are proportional to the disk size of a log, so the space the log will occupy on the disk differs according to security and system products.

The excel document at the bottom of the page can be used to calculate an average EPS.


Calculating Disk Size

Based on the information provided above, we use a simple formula to calculate the average disk size.

In Logsign, you can store logs in 2 or optionally 3 different ways.

- Index for analysis, reporting and dashboard,
- Compressed and parsed archive json cold data for retrospective log analysis
- Optional; For data integrity compliance, the compressed raw log is stored as signed cold raw data.


To calculate the minimum disk space, you need to consider the amount of data to be stored in Index and the amount of data to be stored as Archive,Signed.

Because fifteen days of data is critical to security, we recommend keeping logs in Index for at least fifteen days.

Archive Json Cold Data is the section where parsed logs are compressed. The compression ratio varies with the compression type. There is a ratio between 1/10 and 1/20 in these calculations.

The excel document at the bottom of the page can be used to calculate disk space usage with an average EPS.

Calculation Formula

You can use the formula below to calculate the disk with your daily index and cold data sizes kept in the system.

Disk calculation in Logsign Unified Security Operations Platform

with Signed + Archive + Index;

(Daily signed size * Number of days) + (Daily Archive Size * Number of Days) + (Daily Index Size * Number of Days)


2 GB Archive * 365 = 730 GB

1GB Signed * 730 = 730GB

12GB Index * 15 = 180GB

Total                     = 1,640 GB


Disk calculation in Logsign Unified Security Operations Platform

with Archive + Index;

(Daily Index size * Number of Days) + (Daily Archive Size * Number of Days)


2 GB Archive * 365 = 730 GB

12GB Index * 15 = 180GB

Total                       = 910 GB

We recommend that you have an extra 500GB of space in case of a possible increase in peaks.


We recommend filtering your unnecessary stored data using DPM, this way you will save disk space and performance.

Was this article helpful?
1 out of 2 found this helpful

Articles in this section

Become a Certified Logsign User/Administrator
Sign-up for Logsign Academy and take the courses to learn about Logsign USO Platform in detail. Enjoy the courses, and get your badges and certificates. In these courses, you'll learn how to use Logsign in your work and add value to your career.
Visit Our Blog
Our Logsign USO Platform illustrate our expertise. So do the blog. Through our blog posts, deepen your knowledge on various SecOps topics or get updated about important news & modern approaches for cybersecurity. Get into the habit of reading valuable information provided by Logsign. Be a step ahead.