It is recommended that adequate disk space be reserved to accommodate the volume of events dictated by the compliance and retention policies. Testing shows that events take approximately 8,000 bytes per event.
Example 1: 1,000 events = 8MB estimated disk size required
Example 2: 30,000 events = 240MB estimated disk size required
In addition to the volume of events, the type of events and the volume of alerting can also affect disk consumption. To accurately predict disk consumption for the intended retention period, configure Change Auditor as it is intend to be used in the environment for a period of time sufficient to project long term space requirements.