Run lifecycle

Know exactly what is written, retained, and reported.

Aralez resolves its working directory, creates a local evidence archive, records acquisition activity, finalizes the writer, and only then performs optional destination dispatch.

Working directory and result naming

-w, --workdir <PATH>

The directory is created if needed and becomes the process working directory before archive and log paths are initialized. Relative output destinations therefore resolve from this directory.

output_filename

Base filename template. Only {{hostname}} and {{datetime}} are substituted; the timestamp format is local time YYYY-MM-DD_HH-MM-SS.

compression

Adds .zip or .tar.zst. The CLI --compression overrides the profile.

{{root_output_path}}

Expands to the run’s intermediate collection root in folder mode and is used to build logical entry paths in stream mode.

!

Same-second collisions

The default name has one-second precision. Two runs using the same hostname, directory, base name, and second can target the same files; archive creation may truncate an existing result. Use isolated work directories or a case-specific output_filename when concurrent/retried runs are possible.

Files created during a run

Item	Folder mode	Stream mode	Final state
Collected artifacts	Written below the intermediate result folder	Written as archive entries	Inside final archive
`config.yml`	Written to result folder before compression	Added to archive when the writer is initialized	Inside final archive
Run log	Written on disk and added during compression	Written on disk, then added during finalization	Inside archive; temporary disk copy is cleaned after successful finalization
System/external stdout	Written to configured tool-output file	Captured in memory and added as an entry	Inside archive
Internal-tool output	Written below tool output folder	Created temporarily, copied into archive, then removed	Inside archive
Intermediate result folder	Exists for acquisition and compression	Not used as the main evidence store	Removed after successful archive creation

Console and log controls

-v, --verbosEnables verbose logging. The public flag is spelled verbos in this release.

--silentSuppresses the normal progress presentation for automation. A few low-level upload paths still use direct console printing, so it is not a contractual “zero stdout/stderr” mode.

Ctrl+CThe first interrupt requests a graceful stop between tasks and continues to writer finalization. A second interrupt forces process termination and can leave a partial archive.

The log is evidence metadata: preserve it with the archive. It records task activity and operational failures, but it is not a complete transcript of child processes because their standard error is discarded.

Completion, error propagation, and local retention

Condition	Run result	Local archive
Collection and finalization succeed; no destination	Normal completion	Kept in work directory
CLI `--output` succeeds	Normal completion	Removed for remote/different-folder destinations; kept if destination is its current directory
CLI `--output` fails	Error propagates; process reports failure	Kept for retry/recovery
One or more YAML destinations fail	Failure is logged; remaining destinations are attempted; collection can still complete normally	Always kept
Archive initialization/finalization fails	Fatal error	May be missing or partial; retain the log and inspect before retry
First Ctrl+C	Graceful early stop when control returns between tasks	Finalized archive containing work acquired so far
Second Ctrl+C, crash, or power loss	Forced/incomplete	Potentially partial; TAR.ZST is the more recovery-friendly format

Verify and register evidence

PowerShell

Get-FileHash Aralez_HOST_2026-08-14_16-22-09.zip -Algorithm SHA256
Get-Item Aralez_HOST_2026-08-14_16-22-09.zip |
  Select-Object Name, Length, CreationTimeUtc, LastWriteTimeUtc

shell

sha256sum Aralez_HOST_2026-08-14_16-22-09.tar.zst
stat Aralez_HOST_2026-08-14_16-22-09.tar.zst

Confirm the finalizer completed. Check the process result and end of the embedded log; do not treat file presence alone as success.
Hash the received copy. If dispatched, compare the source/receiver SHA-256 before source deletion whenever your orchestration permits.
Record identity and scope. Target, operator, UTC start/end, binary hash/version/features, archive hash/size, profile, destination, and any errors.
Inspect structure safely. Validate archive listing and expected config.yml/log entries in an analysis environment before ingesting untrusted files.

i

No automatic checksum manifest

Aralez does not currently create a cryptographic manifest for individual entries or the final archive. Add hashing and receipt registration to the calling deployment/orchestration workflow.

NextOutput lifecycle→