Deleting Emails from Ironport Message Tracking

[Don Fitzgerald]

Is there a way to delete emails from message tracking in web-gui on ironport?

Thanks,

Don Fitzgerald
 

[Robert Sherwin · Accepted solution]

Single/individual messages?  No.

The entire tracking database?  Yes.  CLI only:

> diagnostic

Choose the operation you want to perform:

- RAID - Disk Verify Utility.

- DISK_USAGE - Check Disk Usage.

- NETWORK - Network Utilities.

- REPORTING - Reporting Utilities.

- TRACKING - Tracking Utilities.

- RELOAD - Reset configuration to the initial manufacturer values.

[]> tracking

Choose the operation you want to perform:

- DELETEDB - Reinitialize the tracking database.

- DEBUG - Gather debug information.

[]> deletedb

This command will delete all tracking data and cannot be aborted. In some instances it may take several minutes to complete. Please do not attempt a system restart until the command has returned. Are you sure you want to continue?[N]> y

Deleting all tracking data.

Shutting down the Splunk daemon (this may take a few minutes)...

Splunk daemon shut down

Removing Splunk database...

Splunk database removed

Removing 'missing data' database...

Removing unparsed log files...

Unparsed log files removed

Rebuilding log file directory...

rebuilt log file directory

Restarting the Splunk daemon (this may take a few minutes)...

Splunk daemon started

After - revisit the GUI (Monitor > Message Tracking) and you'll see no results.  Clean, slate - waiting for new emails to process through and store into the tracking DB.

-Robert

[Don Fitzgerald]

Robert,

Thanks again for help,

So if it was an individual message and not in spam quarantine then the only way is to delete entire tracking database?

[Don Fitzgerald]

Robert,

Thanks again for help,

So if it was an individual message and not in spam quarantine then the only way is to delete entire tracking database?

[Robert Sherwin]

Well - message tracking vs. messages in spam quarantine would be two different things.  Message tracking would be the data that is taken from the mail_logs and associated processing of the message through the appliance --- that data is taken and written into the tracking database, and thus provides the message tracking details.  

Individual messages to spam quarantine would be just that - actual live message that is in quarantine.  The message is then also taken and written out to the spam digest/notification that is sent out to end-user informing them that their mail is in the spam quarantine... take action, etc.  That message itself can then either be addressed from the end-user themselves, or the admin on the ESA can also choose to take action - as needed.

-Robert