Cleanup Safestore and reduce maximum size

Question

Hello, 
 we ran into the problem that the safestore filled up our disk space. The default size limit is 200GB. Since our disk on that server and most other servers is 200GB or less I need an option to reduce that. I have found nothing in the policy settings for that so is there even an option to do that? 
 How can I cleanup the safestore now since it already filled up the disk? Can I just delete all the files from C:\ProgramData\Sophos\Safestore or will that cause issues with the endpoint?

Rutvik Chavda · Accepted Answer

Hello, Jens, 
 We appreciate your reaching out to the Sophos Community Forum. 
 Please refer to this information if that helps you. 
 
 The SafeStore quarantine size limit is designed to be 200GB, and currently, there&rsquo;s no supported method&mdash;via policy, registry, or configuration file&mdash;to reduce this limit. 
 Important : Do NOT manually delete or modify any files in C:\ProgramData\Sophos\Safestore. Doing so can compromise the quarantine integrity and affect endpoint protection. 
 
 SafeStore Space Management: 
 
 SafeStore automatically manages its storage by purging older quarantined items as new threats are detected and the size limit is reached. 
 If you notice that SafeStore isn&rsquo;t releasing space as expected, or if disk usage seems abnormal: 
 Review your threat logs. Releasing or excluding false positives may help reduce the number of quarantined items. 
 When reviewing locations such as C:\ProgramData\Sophos\Clean\Logs for large log files, we strongly recommend exercising caution. Only remove files if you&rsquo;re certain they&rsquo;re purely log files and no longer required for troubleshooting or compliance purposes. Please don&rsquo;t delete any files from this or other Sophos directories unless you have verified, via official documentation or support advice, that it&rsquo;s safe. 
 
 If you&rsquo;re unsure about the purpose of any file or whether it can be safely removed, please consider creating a Technical Support case so our team can review your environment and advise on the appropriate and safe action. This ensures the continued stability and protection of your Sophos installation. Also, please share the case number here so we can monitor. 
 We understand the challenges of the SafeStore size limit, particularly in environments with smaller disk capacities. Your feedback is invaluable as we continually review and improve our products. 
 Suppose you would like enhanced flexibility in managing SafeStore disk usage. In that case, we encourage you to submit a feature request through your Sophos Account Manager or partner to share your feedback directly. This helps ensure customer needs are considered in future product development. 
 Please refer to this article for reference: Server Threat Protection Policy 
 I appreciate your understanding. Please let us know if you need further assistance.

Rutvik Chavda · Answer

Hello Jens, 
 Thank you for your update and for sharing the details of your recent exclusion attempt. 
 You&rsquo;re correct that when there&rsquo;s insufficient disk space, attempts to restore or release quarantined files from SafeStore will fail because the system can't allocate space to restore those files to their original locations. As a result, the files remain in quarantine, continuing to occupy disk space. 
 Currently, there&rsquo;s no supported command-line tool or official method to force a manual cleanup or purge of the SafeStore quarantine when the file or size limits haven&rsquo;t been reached. 
 Regarding your suggestion about uninstalling and reinstalling Sophos Endpoint Protection as a way to clear the quarantine:

Uninstalling Sophos Endpoint Protection generally removes product components, including the SafeStore quarantine folder, which can help reclaim disk space.

However, please ensure sufficient free disk space is available to perform a clean uninstall and reinstall, as low disk space might cause the uninstall process to fail or leave residual files.

Remember that uninstalling the product will remove all quarantine history and restore points, so after reinstall, your protection will start fresh with no previous quarantine items.

Before proceeding, we recommend backing up any important data and planning for the temporary downtime or impact on security protection during the uninstall/reinstall process.

We understand the challenges of the SafeStore size limit, particularly in environments with smaller disk capacities. Your feedback is invaluable as we continually review and improve our products. 
 We fully understand the importance of having a manual safe-cleanup option and how valuable this capability would be for managing SafeStore. We highly encourage submitting a feature request via your Sophos Account Manager or partner to help prioritise improvements in SafeStore management capabilities. 
 Please let us know if you need any further assistance.

Jens · Answer

If anyone is interested in the features for configuration options and for a manual cleanup option, here are the feature request id's for reference. 
 CEPM-I-775 - Configuration option for Safestore size limits on Endpoints CEPM-I-776 - Option to manually clean up Safestore on Endpoint (Either via Sophos Central or locally via GUI or command)

Cleanup Safestore and reduce maximum size

Top Replies