FortiAnalyzer Log Retention Calculation - Sizing Guide

[Stuart_Robertson]

Hi All,

I came up with this calculation which will assist in sizing the FortiAnalyzer model or VM Licence.  Example below:

Calculation 1 FAZ400E (6TB with Raid1) or FAZ-VM-Base+ 3*FAZ-VM-5GB (9TB Storage/16GB logs per day) Calculation 2 FAZ1000E (12TB with Raid10) or FAZ-VM-Base+FAZ-VM-25GB (10TB Storage/25GB logs per day)

1. Storage Calculation - 6 Months Analytics/18 Months Archive

Analytic Size = Log Rate * Analytic Log Size * 86400 * Analytic Period = Storage                    = (330 * 512* 86400 * (6 * 30)) = 2.63TB Archive Size  = Log Rate * Archive Log Size * 86400 * Archive Period = Storage                    = (330 * 125 * 86400 * (18*30)) = 1.93TB Total Storage Requirement - 4.55TB 2. Storage Calculation - 12 Months Analytics/24 Months Archive Analytic Size = Log Rate * Analytic Log Size * 86400 * Analytic Period = Storage                    = (330 * 512* 86400 * (12 * 30)) = 5.26TB Archive Size  = Log Rate * Archive Log Size * 86400 * Archive Period = Storage                    = (330 * 125 * 86400 * (24*30)) = 2.57TB Total Storage Requirement - 7.82TB

Notes:

Log Rate = 330 Logs/second

Log Size = 512 Mb

86400 = 24 Hours or 1 Day