traffic vs log size

Zeek
1

Hi All,

I know these questions have lots of variables and ‘it depends’ but modulo that, I’m looking for anecdotal information on the ‘data reduction’ that happens with bro logs.

Example:

  • The tap/span sees 2TBytes of traffic per day.
  • All the bro logs files for that day are approx 4GBytes on disk.

So in this case the log files are giving about a 500x reduction in data. Again I know there are lots of factors… just looking for a few data points from folks running Bro on a daily basis. In particular I’d like to get numbers for uncompressed log sizes.

Thanks in advance,
-Bri

2

My bro sensors are sent about 56TB/day and log around 600GB/day uncompressed.

Jon

3

Sample size of one day… 138.5 GB of traffic, 12.6 GB of logs.

4

Thanks for the info guys…