{"id":28159605,"url":"https://github.com/architektapx/measure-eventlogvolume","last_synced_at":"2026-04-18T01:37:15.578Z","repository":{"id":293308470,"uuid":"983599318","full_name":"ArchitektApx/Measure-EventLogVolume","owner":"ArchitektApx","description":"Estimate the Volume of Event Logs on a Windows Machine for example to plan for Microsoft Sentinel ingestion.","archived":false,"fork":false,"pushed_at":"2025-05-14T17:45:44.000Z","size":12,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-05-14T18:25:26.965Z","etag":null,"topics":["eventlog","powershell","powershell-script","sentinel","sysadmin","windows"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ArchitektApx.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-05-14T16:11:53.000Z","updated_at":"2025-05-14T17:45:48.000Z","dependencies_parsed_at":"2025-05-14T18:36:10.299Z","dependency_job_id":null,"html_url":"https://github.com/ArchitektApx/Measure-EventLogVolume","commit_stats":null,"previous_names":["architektapx/measure-eventlogvolume"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/ArchitektApx/Measure-EventLogVolume","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ArchitektApx%2FMeasure-EventLogVolume","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ArchitektApx%2FMeasure-EventLogVolume/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ArchitektApx%2FMeasure-EventLogVolume/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ArchitektApx%2FMeasure-EventLogVolume/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ArchitektApx","download_url":"https://codeload.github.com/ArchitektApx/Measure-EventLogVolume/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ArchitektApx%2FMeasure-EventLogVolume/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278713360,"owners_count":26032867,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-07T02:00:06.786Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["eventlog","powershell","powershell-script","sentinel","sysadmin","windows"],"created_at":"2025-05-15T10:11:12.205Z","updated_at":"2025-10-07T03:16:16.586Z","avatar_url":"https://github.com/ArchitektApx.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Measure-EventLogVolume.ps1\n\n## Overview\n\n`Measure-EventLogVolume.ps1` is a PowerShell script designed to estimate the volume of event logs on a Windows machine. This can be particularly useful for capacity planning, such as estimating data ingestion for systems like Microsoft Sentinel or other SIEM solutions.\n\nThe script analyzes specified event logs, calculates the rate of log generation (logs per hour/day/week/month), and estimates the data volume in megabytes over the same periods.\n\n## Prerequisites\n\n* **PowerShell Version**: Requires PowerShell 5.1 or higher.\n* **Administrator Privileges**: The script must be run as an Administrator to access event log data.\n\n## Parameters\n\n* `LogName` (string[]):\n  * Specifies the name(s) of the Event Log(s) to measure.\n  * Default: `@('Application', 'Security')`\n* `KeepHistory` (switch):\n  * If set, the script saves results to a temporary file and re-uses this data on subsequent runs. This calculates a running average, which is useful for logs with high turnover like Security Logs on Domain Controllers in large environments.\n* `HistoryFilePath` (string):\n  * The path to the directory where the historical data file will be stored.\n  * Default: `[System.IO.Path]::GetTempPath()` (System's temporary folder)\n* `TempFileName` (string):\n  * The name of the JSON file that will store the historical data.\n  * Default: `'Measure-EventLogVolume_HistoryData.json'`\n* `PurgeHistory` (switch):\n  * If set, all previously stored historical data will be deleted before the script runs.\n* `WriteAveragesToOutput` (switch):\n  * If set, the script outputs the calculated averages as a JSON string to the output stream.\n\n## Usage Examples\n\n### Basic Usage (Default Logs: Application and Security)\n\n```powershell\n.\\Measure-EventLogVolume.ps1\n```\n\n**Output Example:**\n\n```\n=== Average Log Volume on MyServer ===\n\n🗂 Application Log\nOldest Record:  07/19/2022 09:58:14\nNewest Record:  05/14/2025 16:43:08\nLogs per Hour:  4.95\nLogs per Day:   118.78\nLogs per Week:  831.47\nLogs per Month: 3600.05\nMB per Hour:    0.01\nMB per Day:     0.24\nMB per Week:    1.68\nMB per Month:   7.27\n\n🔐 Security Log\nOldest Record:  05/06/2025 07:05:22\nNewest Record:  05/14/2025 16:49:26\nLogs per Hour:  1118.36\nLogs per Day:   26840.66\nLogs per Week:  187884.6\nLogs per Month: 116309.51\nMB per Hour:    0.74\nMB per Day:     17.84\nMB per Week:    124.9\nMB per Month:   536.32\n```\n\n### Measure Specific Log and Keep History\n\n```powershell\n.\\Measure-EventLogVolume.ps1 -LogName 'System' -KeepHistory\n```\n\n**Output Example (with history):**\n\n```\n=== Average Log Volume on MyServer ===\n\n💻 System Log\nOldest Record:  01/01/2023 10:00:00\nNewest Record:  05/15/2025 12:00:00\nHistorical Records:  5\nLogs per Hour:  10.50\nLogs per Day:   252.00\nLogs per Week:  1764.00\nLogs per Month: 7638.12\nMB per Hour:    0.02\nMB per Day:     0.48\nMB per Week:    3.36\nMB per Month:   14.54\n```\n\n### Use History with Custom Path and Filename\n\n```powershell\n.\\Measure-EventLogVolume.ps1 -KeepHistory -HistoryFilePath 'C:\\Temp\\LogAnalysis' -TempFileName 'MyEventLogHistory.json'\n```\n\n### Write Averages to Output Stream (JSON)\n\nUse the `-WriteAveragesToOutput` switch to get the calculated averages as a JSON string on the output stream. This is useful for piping the results to other cmdlets or for programmatic consumption.\n\n```powershell\n.\\Measure-EventLogVolume.ps1 -LogName 'Application' -WriteAveragesToOutput\n```\n\n**Example Output (JSON to output stream):**\n\n```json\n{\n    \"Application\": {\n        \"LogName\": \"Application\",\n        \"OldestRecord\": \"2022-07-19T09:58:14\",\n        \"NewestRecord\": \"2025-05-14T16:43:08\",\n        \"HistoricalRecords\": 1,\n        \"AverageLogsPerHour\": 4.95,\n        \"AverageMBPerHour\": 0.01,\n        \"AverageLogsPerDay\": 118.78,\n        \"AverageMBPerDay\": 0.24,\n        \"AverageLogsPerWeek\": 831.47,\n        \"AverageMBPerWeek\": 1.68,\n        \"AverageLogsPerMonth\": 3600.05,\n        \"AverageMBPerMonth\": 7.27\n    }\n}\n```\n\n### Purge Existing History\n\n```powershell\n.\\Measure-EventLogVolume.ps1 -PurgeHistory\n```\n\nThis will delete the history file and then run the measurements (for default logs, unless others are specified).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farchitektapx%2Fmeasure-eventlogvolume","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Farchitektapx%2Fmeasure-eventlogvolume","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farchitektapx%2Fmeasure-eventlogvolume/lists"}