CustosCustosXI stores timeline events, decisions, DNS and traffic metadata locally. Choose the backend in Settings → Database.
SQLite size recommendation
We recommend SQLite for primary databases up to about 2 GB. Beyond that, queries, retention purge, and VACUUM can become noticeably slower and you may see lock or contention issues on busy PCs.
Database size can grow very quickly depending on your configuration: live packet capture, long or unlimited retention, detailed timeline storage, Suricata alert volume, DNS logging breadth, and add-ons that enrich or cache more data. Set retention and max size limits early and monitor Settings → Database regularly.
Planning for more than ~2 GB or long-term heavy use? Migrate to PostgreSQL before performance degrades.
SQLite (default)
Single portable database file (custosxi.db) under ProgramData\CustosXI\Data. No separate database server to install.
Best for: personal PCs, lab evaluation, quick setup, and deployments where the primary store stays under ~2 GB.
- Works out of the box on first run
- Retention from 1-90 days or keep forever (shorter retention helps control size)
- Optional max size cap (500 MB - 2 GB recommended for SQLite; up to 10 GB available in settings)
- Maintenance: purge old rows, VACUUM, integrity check
PostgreSQL (external)
Connect to a PostgreSQL server you install and operate (not bundled with CustosXI). Configure host, port, database, and credentials in Settings, then run Migrate data to PostgreSQL once.
Best for: large timelines, longer retention, heavier traffic volume, or when you already centralize data on PostgreSQL.
- Primary timeline and event tables move to PostgreSQL
- Some auxiliary caches remain SQLite:
tls_fingerprints.db,public_blacklist_v2.db,abuseipdb_cache.db - Same retention and purge policies apply to the primary store
- PostgreSQL server licensing and backups are your responsibility
Retention and maintenance settings
| Setting | What it controls |
|---|---|
| Timeline retention | Automatic purge of older events across timeline, decisions, packets, and related tables (1-90 days, or disabled with “Keep forever”) |
| Max primary DB size | Size cap with daily enforcement; for SQLite we recommend staying at or below ~2 GB - use PostgreSQL for heavier workloads |
| Purge batch size | Rows deleted per batch during purge (SQLite and PostgreSQL) |
| SQLite auto-VACUUM | Reclaim disk space after large purges when the primary store is SQLite |
| Database files list | Overview of .db files, WAL/SHM sidecars, table counts, and on-disk size |
Only the Npgsql client library is bundled; the PostgreSQL server is never included. See Third-party notices.