Quick answer: CERT-In's directions of 28 April 2022 ask covered organisations to enable logs on all ICT systems and keep them securely for a rolling 180 days. To size the server, use this formula: events per second × average event size × 86,400 × 180, then add RAID overhead and 20 to 30 percent headroom. At 500 events per second and an assumed 500 bytes per event, that is about 21.6 GB a day and about 3.9 TB for 180 days before compression.
This page is about the storage arithmetic. For the full rule set and a complete build, read Serverwale's CERT-In log server setup guide. This is general information, not legal advice.
The directions require service providers, intermediaries, data centres, body corporate and government organisations to "mandatorily enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days", and to provide them to CERT-In along with an incident report or when ordered. Incidents listed in Annexure I must be reported within 6 hours of noticing them. Clocks must sync to the NTP servers of NIC or NPL, or to servers traceable to them. CERT-In's FAQ defines body corporate as any company, including a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities.
Do not guess. Point your firewalls, servers and applications at a test collector for a week, and read the daily volume. A busy firewall can produce more events than all your servers together, and a new service or an attack can multiply the volume overnight. CERT-In's FAQ lists the log types to consider: firewall, intrusion prevention, SIEM, web, database, mail, FTP and proxy server logs, event logs of critical systems, application logs, SSH logs and VPN logs, and it says both successful and unsuccessful events should be recorded.
The table is our own arithmetic. The 500-byte average event is an assumption for illustration. Compression will reduce the figures; how much depends on the log type.
| Events per second (example) | Per day | 180 days, uncompressed |
|---|---|---|
| 100 | 4.3 GB | about 0.78 TB |
| 500 | 21.6 GB | about 3.9 TB |
| 2,000 | 86.4 GB | about 15.6 TB |
Raw disk is not usable disk. As arithmetic, eight 4 TB drives give about 24 TB usable in RAID 6 (two drives of parity) and about 16 TB in RAID 10 (mirrored pairs), before formatting. RAID 6 gives more space and survives two failed drives. RAID 10 writes faster and rebuilds faster. Read our RAID levels explained guide, and remember that RAID is not a backup: keep a second copy of the log archive on a separate system, see Serverwale's backup and disaster recovery guide and the on-premise backup server guide.
Wazuh, a free and open source security platform, publishes a single-host quickstart table sized for 90 days of queryable alert data: 1 to 25 agents need 4 vCPU, 8 GiB RAM and 50 GB; 26 to 50 agents need 8 vCPU, 8 GiB and 100 GB; 51 to 100 agents need 8 vCPU, 8 GiB and 200 GB. Wazuh recommends a distributed deployment for larger environments. That table covers 90 days of indexed alerts, not 180 days of every raw event, and Wazuh's archives of all received events are disabled by default.
Plan power and cooling as well; read our rack UPS sizing guide and rack cooling guide. Harden the log server itself with the Linux server hardening checklist and the enterprise network security guide. Personal data in logs is covered by privacy law too; see the DPDP Act infrastructure guide.
How do I calculate storage for 180 days of logs? Multiply events per second by average event size by 86,400 seconds by 180 days, then add RAID overhead and 20 to 30 percent headroom. Measure your real event rate for a week first, because guessed rates are the main reason log servers fill early.
Is the 180 days a rolling period? Yes. CERT-In's directions say to maintain logs securely for a rolling period of 180 days. In steady state your storage holds about 180 days of data, and the oldest day drops off as a new day arrives, so the requirement stops growing once you reach 180 days.
Can logs be stored outside India? The directions text says logs are maintained within the Indian jurisdiction. CERT-In's FAQ (Q35) says logs may be stored outside India as long as they can be produced to CERT-In in a reasonable time. Keeping the log server in India avoids the question. Check with a legal adviser for your case.
Which NTP servers does CERT-In list? CERT-In's FAQ lists samay1.nic.in and samay2.nic.in for the National Informatics Centre and time.nplindia.org for the National Physical Laboratory. Configure them on your enterprise NTP server and sync other devices to it.
Is a refurbished server fine for a log server? The directions set rules about logging, retention, clock sync and reporting, and they do not set a new-hardware condition. What matters is reliable disks in RAID, a backup copy, correct clocks and monitoring. Ask for the warranty terms for your exact unit in writing.
Tell us your endpoint count, the systems that produce logs and the retention you need, and we will suggest a server and storage layout. Serverwale · Phone +91-87962-44410 · WhatsApp https://wa.me/918796244410 · Burari, Delhi 110084, India. See our refurbished servers, enterprise solutions, live stock or contact us.
Sources: CERT-In, Directions of 28 April 2022 and FAQs (May 2022); Wazuh Quickstart and Event logging. The sizing table and RAID figures are Serverwale's own arithmetic. Read on 29 October 2026.