Log Shipping Bandwidth Calculator

July 31, 2026

WAL, binlog, SIEM, audit, and archive links

Log Shipping Bandwidth Calculator

Estimate average Mbps, peak batch Mbps, retry catch-up time, and WAN headroom for database log shipping, event forwarding, security logs, and multi-destination archives.

⚙Named log shipping presets
📊Bandwidth inputs
Raw log output before compression, encryption, retries, or destination fan-out.
Percent saved by gzip, zstd, WAL compression, binlog compression, or collector batching.
How often the sender cuts and pushes a log segment or forwarding batch.
Burst factor for busy hours, failover windows, deploy storms, scans, or audit spikes.
Usable WAN, VPN, inter-site, or cloud egress capacity reserved for log movement.
TLS, VPN, tunnel, framing, and packet expansion overhead added to the wire rate.
How many hours of queued logs might accumulate after an outage or receiver throttle.
Local sender space or retention time available before old segments are at risk.
Replicas, collectors, regions, archive buckets, or independent downstream receivers.
Stronger confirmation adds control traffic and shortens the useful transfer window.
Average bandwidth
3.60
Mbps continuous
Includes compression, destinations, ack mode, and encryption overhead.
Peak batch bandwidth
14.13
Mbps during send window
Peak log rate divided into the modeled active transfer window.
Catch-up time
0.08
hours to drain backlog
Uses spare average link capacity after current log flow.
Link headroom
85.87
Mbps after peak
Positive headroom means the batch can clear inside the interval.

Full log shipping breakdown

Raw logs produced80.0 GB/day
After compression36.0 GB/day
Destination fan-out36.0 GB/day
Wire volume with overhead38.9 GB/day
Single interval payload0.135 GB
Peak interval payload0.324 GB
Modeled active send window2.8 min
Peak link utilization14%
Average link utilization4%
Retry backlog volume3.2 GB
Retention buffer volume38.9 GB
Ack mode adjustmentReceiver ack before delete
This link has comfortable headroom for the selected log shipping profile.
📐Bandwidth formula cards

Average Mbps

Average Mbps = daily wire GB x 8000 megabits per GB divided by 86,400 seconds.

Peak Mbps

Peak Mbps applies the peak log multiplier, then assumes the batch clears during the active send window.

Catch-up time

Catch-up hours = retry backlog megabits divided by spare average Mbps after live log traffic.

Headroom

Link headroom = available Mbps minus peak Mbps. Negative headroom means intervals can stack up.

🛠Log transport spec grid

Planning target

70%
Keep peak log shipping below this link utilization when the link also carries user traffic.

Compression range

20-85%
Text logs and JSON compress well; encrypted, binary, or already compressed logs save less.

Control overhead

0-25%
Ack mode adds protocol chatter, receiver checks, retries, and extra wait time per batch.

Retention guard

2x
A practical sender buffer is at least twice the modeled catch-up time for busy links.
🔄Log pipeline comparison grid

Database WAL shipping

Segments arrive in bursts and must clear before replica lag breaches recovery point goals.

5-16 MB fileslow latencyack sensitive

Binlog replication

Transaction logs often compress well, but schema changes and bulk loads can reshape bursts quickly.

ordered streamburst loadsreplica lag

SIEM forwarding

Collectors fan out to multiple destinations and can see sharp spikes during scans or incident response.

many sourceshigh fan-outretry queues

Kubernetes audit flow

Control-plane events are small but spiky, especially during deploys, autoscaling, or policy changes.

JSON heavyburstycompressible

Edge site archive

Small links may batch logs longer, so peak send windows matter more than the daily average.

slow WANlong bufferscheduled send

Multi-region archive

Each destination multiplies bandwidth needs unless replication happens after the first landing zone.

fan-outquorum ackegress limits
📋Reference tables
Log workloadTypical shapeCompression expectationBandwidth concern
PostgreSQL WAL shippingSegmented database changesModerate unless WAL compression is already enabledReplica lag during checkpoints, bulk loads, and vacuum-heavy periods
MySQL binlog replicaOrdered transaction streamModerate to high for statement-heavy logsLarge transactions can create long catch-up windows
SIEM log forwarderMany sources through one collectorHigh for text logs, lower for packet metadataDestination fan-out and retry queues during receiver throttling
Kubernetes audit logsSmall JSON events with burstsHigh when batched before sendDeploys and autoscaling can multiply short-term log rate
Web access logsPredictable daily peaksVery high for repeated fields and pathsTraffic spikes and bot activity can dominate peak Mbps
Ack / replication modeWire overhead modelActive window modelBest fit
Async send, best-effort ack0% control overhead70% of interval can be used for transferLow-value debug logs, buffered archives, and tolerant forwarding
Receiver ack before delete5% control overhead56% of interval can be used for transferMost collectors, file shippers, and database archive commands
Synchronous replica confirm12% control overhead45% of interval can be used for transferReplica lag sensitive databases and recovery point objectives
Quorum multi-destination confirm25% control overhead38% of interval can be used for transferMulti-region compliance archives and durable security trails
Peak utilizationInterpretationActionMetric to watch
Below 50%Comfortable headroomKeep interval and retention settingsReplica lag, queue depth, send latency
50-70%Healthy planning rangeValidate with real compression samplesp95 batch transfer duration
70-90%Tight during burstsIncrease compression, shorten payloads, or reserve more linkRetry count and link saturation time
Above 90%High backlog riskReduce fan-out, increase capacity, or lengthen retention bufferOldest unsent log age
Shipping intervalOperational effectGood use casePractical note
1-2 minutesSmall batches, frequent control trafficLow-lag replicas and audit streamsConfirm receiver can handle frequent file opens or API calls
5-10 minutesBalanced batch size and lagGeneral home lab and small office log shippingGood default when link quality is stable
15-30 minutesLarger bursts, fewer transfersEdge sites and scheduled archive pushesPeak Mbps matters more than daily average Mbps
60 minutes or moreLarge backlog chunksCold archive and off-hours transfer windowsRetention must survive a failed batch plus retry delay
💡Log shipping sizing tips
Measure compression with real samples. JSON, access logs, and event logs may compress heavily, while encrypted or binary logs may not. A one-day sample gives a better input than guessing from storage growth.
Keep retention longer than catch-up math. A sender buffer should cover the modeled catch-up time plus receiver maintenance, DNS issues, VPN reconnects, and one missed transfer interval.

Log shipping can also fail, but usualy without fanfare or screaming red alarms. You just wake up to discover that your replica database hasn’t been refreshed in the last four hours, due to WAN link being jammed by unexpected backup traffic. Or maybe your SIEM collector drop events while running a security scan, thinking that the pipe was going to remain open. Log shipping bandwidth planning is an abstract concept until the pipe chokes.

So plan for worst-case scenario, the peak burst rate, to see if your link will survive in real world. To get a number, most admins begin by figuring out how many megabits per second they needs on average to transport their day’s worth of log volume. That provides a reassuring baseline. But it fails to take into account that log traffic doesn’t behave as if it’s water in a pipe flowing steady.

Plan for Peak Burst Traffic, Not Just Average Use

It comes in chunks. Your database writes out a chunk, compresses it, then ships it off all at once when it hits its shipping interval. You’re pushing PostgreSQL WAL files every five minutes? The network see a 5-minute spike every five minutes, then nothing. The calculator above will crunch the numbers and tell you how those spikes is different than your available link capacity.

Compression: Don’t count on any maximum theoretical value; text-heavy application logs and JSON audit trails can often shrink by 80 percent or more. Binary logs or encrypted traffic get little or no compression. This is one you should of tweaked the tool with after seeing how much it actualy compresses in your own environment. Under-estimating compression is better than over-estimating it.

Little or no compression for binary logs or encrypted traffic. This is one you can tweak the tool with after seeing how much it actualy compresses in your own environment. Under-estimating compression is better then over-estimating it. Protocol acknowledgements and encryption overhead add a few percent to each packet with TLS wrapping. Handshakes from synchronous replication modes consumes part of your transfer window. These little things add up fast when you’re trying to get a big batch through a small time slice.

Most designs breaks at peak. Your peak burst is ninety percent of your link’s capacity. Any small amount of background traffic or jitter will push you over the edge and time out with a retry. The table in the reference on the page make it clear: You want to stay under seventy percent peak to have some headroom for unexpected surges.

And if you’re increasing number of destinations (for example, replicating to several region for compliance), then you’re multiplying the required bandwidth. Fan-out is handled automatically by the tool, but understand that every destination receiver require a slice of pipe.

This is sometimes called catch up / retrieval time, but nobody ever thinks about that until it’s broken. The calculator looks at your spare capacity (beyond your normal traffic) and calculates how quickly it will empty out the backlog if your sender gets behind. That tells you whether you have a short catchup time; in which case you’ll be able to survive some small hiccup of your network without violating your recovery point objectives or losing any data correctness. Or does it indicate you should increase your retention buffer on the sender side because otherwise too much will get deleted from older logs before they make it to their destination?

Don’t guess if your link is big enough, design for those moments that actualy matter. Know the difference between average flow and burst pressure. Run real samples through your compression ratios. Compare your peak multipliers against past busy hour. Make sure your intervals gives you time for batches to clear out before the next comes in. Don’t let log shipping use whatever leftover capacity is available after your users’ queries are done. Treat it as critical application traffic that deserves its own capacity reservation.

Log Shipping Bandwidth Calculator

Related posts

Leave a Comment