Overview
You would like to know more about storage size - more specifically, you would like to understand how much database space is taken up as GFI EventsManager processes the collected raw logs (about events and syslogs) and then stores them in the database. You may be looking for this information in order to forecast space and network usage.
Information
Every event saved to the EventsManager database will cause the database to grow. You can read the article Installation Requirements for GFI EventsManager for information about storage requirements.
| Environment | Growth rate (on average) |
| EventsManager 2012 and 2013 | About 535 bytes |
| EventsManager 2011 | About 1024 bytes |
For EventsManager 2012 and 2013, the approximate storage requirements are as below, based on the average size of an event log being 535 bytes per event:
| Hard Disk Space | Number of events |
| Event stored per 1 GB of storage space | 2,006,994 |
| Event stored in 500 GB of storage space | 1,003,497,032 |
For instance:
- Windows event takes up about 500 bytes within each log (Event Log), so the approximate size of the EventsManager database to save 100MB of Windows events would be about 100MB.
- For the Syslog events, each event is about 200 bytes, so to store 100 MB of Syslog events you need about 250 MB of the EventsManager database.
If you wish to save space on your drive and increase performance by decreasing the size of your database, please refer to this article on how to Avoid Archiving Unnecessary Events.
Notes:
- It is possible to control which events are created on each monitored machine using Audit Policies. It is recommended to enable only the audit policies which are required to prevent unnecessary use of network bandwidth.
- It is possible to control which events are stored in the database used by GFI EventsManager. This can be done using the Event Processing Rules from the GFI EventsManager configuration.