Installation & operation

Storage, retention and cleanup

The daemon keeps everything it needs on the local device, and it keeps that store in check itself: nothing grows without bound. A housekeeping pass runs every day to enforce retention, rotate logs and record the on-disk footprint. This page lists what is stored, how long it is kept, and how to tune or trigger the cleanup.

~6 min read · Installation & operation

What is stored

Everything the daemon keeps lives under its local data directory. Each store is cleaned automatically; none grows without bound.

Store	Content	Retention
Baselines	Trusted snapshots of the protected files	Orphan-collected: dropped once the file is gone
Verdicts	The per-change detection result	Orphan-collected alongside its baseline
Quarantine	Reversible blobs of reverted changes	Kept for the retention window (default 30 days), then expired and deleted
Audit log	The forensic record of every decision	Rotated to one backup at the size cap (default 50 MiB)
Timeline	The device event stream	Rotated to one backup by size
Logs	The daemon log, the stderr sink and the notify spool	Rotated or truncated at their size caps
Model assets	The on-device detection model artifacts	Replaced on update, not accumulated

Orphaned baselines and verdicts are garbage-collected by the continuous 5-minute sweep (not the daily run) once their file is gone, but a directory's adoption marker is never reaped: while it exists, a file that has no baseline is re-evaluated, never silently trusted.

The daily janitor run

One housekeeping pass runs shortly after the daemon starts and then every 24 hours. It is best effort: a failure in one step never blocks the others and never crashes the daemon.

Step	What it does
Quarantine retention	Deletes blobs past the retention window; writes a `quarantine_expired` audit entry and flips the case to `expired` before deleting the blob
Audit rotation	Rotates `audit.log` to one backup at the cap; in Cloud mode it waits while unreported entries remain, so nothing is lost to the console
Log rotation	Rotates the notify spool and truncates the stderr sink at their caps
Footprint	Measures each store read-only and writes it as a `janitor_footprint` audit entry

The footprint is measured after cleanup, so it reflects the freed space, and it is written into the audit log itself (janitor_footprint). The storage history is auditable like any other decision.

Setting retention

Two values are tunable. Each one defaults to the janitor's own value and, when set, is clamped into a fixed range.

Value	Default	Range	Cloud	Private
Quarantine retention (days)	30	1 to 3650	Console	Install flag or `thresholds.json`
Audit log cap (MiB)	50	1 to 1024	Console	Install flag or `thresholds.json`

A zero or negative retention is refused, not obeyed: the janitor skips the quarantine prune entirely rather than treat a stray 0 as a zero-day window that would wipe live quarantine. A field left unset simply keeps its default.

In Cloud mode a Pro or Enterprise owner sets both values per device in the console. A private daemon has no cloud config channel, so it is set at install time or by editing the local thresholds.json directly.

bashInstall with retention flags

curl -fsSL https://poisonzero.com/install.sh | sudo sh -s -- \
  --quarantine-retention-days 60 --audit-max-mb 100

# or as environment variables:
#   PZ_QUARANTINE_RETENTION_DAYS=60 PZ_AUDIT_MAX_MB=100

powershellInstall with retention flags

$env:PZ_QUARANTINE_RETENTION_DAYS='60'; $env:PZ_AUDIT_MAX_MB='100'
irm https://poisonzero.com/install.ps1 | iex

jsonthresholds.json (private)

{
  "quarantine_retention_days": 60,
  "audit_max_mb": 100
}

A set field overrides only itself; an unset field keeps its default. These are the same two snake_case fields the installer flags write.

Cleaning up now

You do not have to wait for the daily pass. A one-shot cleanup runs the exact same housekeeping pass on demand.

Where	How
Cloud (console)	The Clean up now button on the device page. The pass runs at the device's next check-in and its result appears in the audit history. Pro and Enterprise; the device lifecycle status is unchanged. The command is available only on an active, enrolled device and is refused while a pause or uninstall command is pending.
Private (device)	The `poisonzero cleanup` command, run with the same rights as `quarantine restore`.

bashForce a cleanup on a private device

sudo poisonzero cleanup

The command runs one janitor pass and prints the footprint. If the daemon's own janitor or a second cleanup is already running, it skips cleanly with cleanup already running, skipped rather than running a second pass.

A local store that cleans up after itself.

Retention enforced daily, orphans reaped, logs rotated, and the footprint on the record. Free for Linux, macOS and Windows.

Sign me up

Storage, retention and cleanup

What is stored

The daily janitor run

Setting retention

Cleaning up now

Read next

A local store that cleans up after itself.

Related articles