Nobody's log server failed because the trial was too small. They fail in month four, when the disk quietly fills at 2 AM and collection stops. Fifteen minutes of arithmetic before the install prevents that night completely.
EventLog Analyzer is easy to install on almost anything, and that is the trap. The installer asks nothing about your future disk usage, but your sources start writing thousands of events a day from the first minute. Sizing is not about what the software needs today; it is about what your own network will pour into it for a year. This page does that math honestly, using example figures you can replace with your own.
Disk usage follows event volume, not device count. Ten quiet servers can produce fewer logs than one busy domain controller authenticating a whole office. Before sizing anything, list your planned sources and mark which are chatty: domain controllers, firewalls on a busy internet line, and terminal or file servers are the usual heavyweights.
If you already run Event Viewer on those machines, the Security log's size and overwrite period give you a rough feel: a log that wraps every two days is telling you its daily volume for free.
You do not need a perfect formula. Take your expected events per day, assume each event costs you roughly a kilobyte or two once indexed and stored, and multiply by your retention days. A modest network producing a few hundred thousand events a day lands in the range of tens of gigabytes per month of searchable data, before archives.
Then double it. Estimates are always optimistic because audit policies get widened later, a firewall starts logging denied traffic, and nobody remembers the test server added in March. A plan with headroom survives reality; a plan at 95 percent does not.
Install the product so its database and log store live on a dedicated data drive, not the system drive. When (not if) log growth surprises you, a full data drive stops collection; a full system drive can take the whole server down with it, including the evidence of what happened.
Fast storage matters too. Search speed across months of indexed logs is mostly a disk story. An SSD for the live index is the single hardware choice users actually feel every day in this product.
After the install, check the console's data growth daily for the first week. One real week of your network beats any sizing guide, including this one. If day three already eats what you budgeted for a month, your audit policies are too loud or a source is misconfigured and looping, and both are cheaper to fix now than after a purchase.
Set a calendar reminder for day 30 as well. Trial month growth is the number you take into the licensing and retention conversation, not a guess.
Old logs do not have to stay in the fast index forever. EventLog Analyzer archives older data into compressed files that can be loaded back when an investigation or an auditor asks for last year's records. Decide during setup which share or drive archives will live on, and make sure that location is backed up like any other evidence.
The retention guide in this series goes deeper on how long to keep what. The sizing point stands alone: archives are smaller than live data, but they are not zero, and pretending otherwise is how month four happens.
Watch the video for the install itself, then come back to this page with your own first-week numbers before you finalise storage.
▶️ Watch Full VideoThere is no single number, because it depends on your event volume and retention. Estimate from events per day, keep the live index on fast storage with generous headroom, and measure real growth during the 30-day trial. Most small networks land in tens of gigabytes per month of indexed data; busy domain controllers and firewalls push it much higher.
Yes, data locations can be changed, but it is a planned maintenance job, not a casual drag and drop, and collection pauses while you do it. Choosing the right drive at install time is ten minutes of thought that saves an outage later.
Yes. Archives are compressed and much smaller than live indexed data, but they keep growing for as long as you keep them. Put them on storage that is sized for your full retention promise and included in your normal backups.