How much disk space will EventSentry utilize for on my network with X servers and Y workstations?

This is a common question that is asked frequently but unfortunately also somewhat difficult to answer since there are many factors that impact the disk usage of EventSentry. Every line item below can significantly impact the disk usage of the EventSentry database.

• Number of monitored Windows hosts
• Audit Settings of Servers
• OS Type (Domain Controller, Server, Workstation)
• Number of domain users (especially when monitoring domain controllers with heavy auditing)
• Operating System (system32.eventsentry.com under “Operating Systems” illustrates the gap between the number of events that can be logged between the different Windows operating systems)
• Log retention period (how long are events kept)
• Features utilized in EventSentry

One could install EventSentry on two identical networks but depending on the audit settings, retention period and EventSentry configuration utilize 25Gb of space in one network and 750Gb in the other. As such, the most accurate way to estimate the database usage is to temporarily install EventSentry (e.g. using the evaluation version) and measure the database usage over a short time period (e.g. 72 hours). The Default Dashboard includes the Database Summary tile (shown below) which calculates the average daily disk usage.

• Install EventSentry on a (test) server
• Deploy it to a small number of machines that are similar to an average server
• Configure EventSentry & Auditing to your needs and deploy the agent to those machines
• Collect data for at least 24 hours, longer sampling periods will likely yield a more accurate estimate
• Review the Database Summary tile (present on the top left in the "Default" dashboard) which shows how much data EventSentry has been collecting since it was installed, along with a daily average
• Extrapolate the daily data to estimate the anticipated database usage

For example, if the daily database usage for 10 hosts is 2Gb, and you are monitoring 65 servers and need to store data for 180 days, then the expected database usage would be 2,340 Gb, roughly 2.5 Tb. Considering that this number is only an estimate, 3Tb of disk space would be recommended in this case.