Log Collection

Log Collection at Scale, on a Fraction of the Storage

CyberCyte log collection is built on Vector and ClickHouse and managed from the CyberCyte platform. Collected logs sit next to exposure, vulnerability, configuration and GRC data, so investigations and compliance evidence use the same console.

Book a Demo

Key findings

Storage is where log collection costs grow

Storage, memory and server count grow with events per second (EPS) and retention, and high availability doubles much of it. CyberCyte compared the infrastructure needed to keep 180 days of searchable logs, with high availability, on four platforms.

3.7xless storage than Splunk and IBM QRadar

8.9xless storage than Elastic with default settings

271 TBat 100,000 EPS, against 1,011 TB for Splunk and QRadar

44 vCPUat 10,000 EPS, against 308 vCPU for a clustered Splunk deployment

Planning estimates for comparison, not quotations. Every platform is sized on the same baseline: 500 bytes per event, 180 days online, two copies of data and 30% headroom, using each vendor’s published sizing guidance. Licence and subscription costs are out of scope.

Resources compared

Infrastructure at 100,000 EPS

Platform	Storage	Memory	CPU	Servers
Vector + ClickHouse (CyberCyte)	271 TB	648 GB	248 vCPU	22
Splunk Enterprise	1,011 TB	1,292 GB	936 vCPU	26
IBM QRadar SIEM (on-premises)	1,011 TB	896 GB	352 vCPU	8
Elastic (Elasticsearch)	2,426 TB	18,016 GB	2,724 vCPU	294

QRadar has the fewest servers because each appliance is large and does many jobs. The difference in storage comes from ClickHouse storing logs in compressed columns, so a 180-day high-availability dataset needs about a quarter of the disk of an index-based store. That saving also reduces backup, DR and hardware refresh costs.

How it works

From collection to investigation

Collect

CyberCyte agents and syslog sources send events through a redundant load balancer pair to a tier of Vector aggregators, which parse, enrich and buffer events on disk.

Store

Vector writes to a ClickHouse cluster with two replicas per shard, coordinated by three ClickHouse Keeper nodes. The Collector tier is the only component that writes to ClickHouse.

Investigate

Logs are searched from the CyberCyte platform, next to exposure, vulnerability, configuration and GRC data, so investigations and compliance evidence use the same console.

Deployment

How CyberCyte delivers log collection

Sizing, high availability and DR designs for 1,000 to 100,000 EPS, with independent Keeper quorums per site and quarterly DR testing.
Deployment on VMware (OVF) or on Ubuntu 24.x LTS and Red Hat Enterprise Linux 10.
Implementation in 20 to 45 man-days including the core CyberCyte platform, depending on the EPS tier.
Optional CyberCyte MDR services for continuous review and response.

See Your Log Collection Footprint

Talk to CyberCyte about sizing, high availability and DR for 1,000 to 100,000 EPS, managed from the same console as your exposure and GRC data.