Skip to main content
The appliance stores data locally using two complementary systems, one for large unstructured files and one for structured, queryable data.

Object storage (MinIO)

Holds large, unstructured objects such as packet capture files and extracted files. This is the repository for the appliance’s raw data.

Structured storage (ClickHouse)

Holds indexed logs and telemetry and supports fast querying, allowing analysis tools to work through large datasets efficiently.

Retention and overwrite behavior

The appliance retains data only until its onboard storage reaches capacity. Once storage is full, the appliance automatically begins overwriting the oldest data to accommodate new data. This sustains continuous capture and logging, prioritizing ongoing collection over indefinite retention.
Because the oldest data is overwritten once storage is full, any data to be retained must be offloaded before it is overwritten. Data left on the appliance is not permanent. The data offloading page describes how data is moved off the appliance.
Storage usage should be monitored so that important data is offloaded before it is overwritten. System status, including storage usage, is covered in the administration section.