PlaybookEstimate the cost: software, hosting and disk
safe intermediate #cost#aws#pricing#disk#budget
When to use this: A customer asks 'how much will it cost?' and you need a defensible estimate.
Before you start
Cost components
| Part | Self-hosted on-prem | AWS EC2 |
|---|---|---|
| Software | $0 for rsyslog, syslog-ng, Graylog Open, Wazuh. Licence for Kiwi, FortiAnalyzer, Splunk, SIEMs | Same |
| Compute | Existing VM host or a mini PC | Hourly price of the instance |
| Storage | Disks | EBS volume per GB-month, plus snapshots |
| Network | Usually nothing | Inbound data is free; outbound is charged; a public IPv4 address has an hourly charge |
| People | Patching, monitoring, backups | Same |
AWS reference prices (us-east-1, Linux, on-demand, gathered 2026-11-13)
| Item | Price | Approx. per month |
|---|---|---|
| t3.small (2 vCPU, 2 GiB) | about $0.0208 per hour | about $15 |
| t3.medium (2 vCPU, 4 GiB) | about $0.0416 per hour | about $30 |
| EBS gp3 storage | about $0.08 per GB-month | $8 per 100 GB |
| Public IPv4 address | about $0.005 per hour (verify) | about $3.65 |
Each step up in the T3 family roughly doubles the instance price. Search platforms such as Graylog or Wazuh need more memory than a plain rsyslog box, so budget at least a medium instance and check the product’s requirements.
Worked example
Plain rsyslog on t3.small, 200 GB gp3 for retention:
- Compute: about $15
- Storage: 200 x $0.08 = $16
- Public IP: about $3.65
- Roughly $35 per month, plus snapshots and your time.
Steps to build the estimate
- Measure or estimate events per second (EPS) and message size, and compute the disk for the retention period (see the sizing scenario).
- Choose the software tier from the comparison table. Get quotes for any licensed product.
- Add compute, storage and network from the table, using the AWS calculator for the final numbers.
- Add 15 to 20 percent headroom for growth, and state the assumptions in writing.
How to verify it worked
- Your estimate lists software, compute, storage, network and your own time separately.
Common errors and fixes
Quoting only the instance price Add storage, the public IPv4 address, backups or snapshots, data transfer out, and the cost of administering it.
Q&A
Is a free syslog server really free?
The software is. You still pay for the machine, the disk, electricity or cloud fees, and the time to patch and monitor it.
Which cost grows fastest?
Storage for long retention at high volume, and with commercial tools, the per-GB or per-capacity licence.