cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
257
Views
0
Helpful
2
Replies

CSPM Queued Email Notifications

ronald.change
Level 1
Level 1

I have a 4000 signature that was generating a ton of email messages. I added a filter to stop this from happening and it worked. However, there must still be a queue of these messages somewhere in the CSPM because messages generated from the last couple days are still being emailed to me.

How do I delete the queue of old messages?

2 Replies 2

gfullage
Cisco Employee
Cisco Employee

I've had a cust run into this before, took me ages to resolve it, so you're lucky.

First off though, check that these messages aren't queued up on your SMTP server somewhere. Also check the full headers of a new email that comes in, and see when the alert was seen, compare that to when it was sent out by CSPM, and to when it was forwarded on by your SMTP server. If it sat on your SMTP server for a long time then it's probably your SMTP server that's at fault. If the alert is an old one and CSPM only just sent it out, then CSPM is probably at fault.

If CSPM seems to indeed be the problem, then in general CSPM will send out

email alerts as they come in, but if it gets enough of them at a fast enough rate, it will store

them in its database to be sent out later as it can get some process time. So, we can reset your

CSPM database and that should clear them out.

Open up CSPM, and do a File - Export and export your configuration to a .cpm file. Close down CSPM.

Go to Start - Programs - CSPM - Troubleshooting Toolkit, and then under the Restore Policy

Database, click on the restore button. Wait for the 4 check-boxes to check off, then go back into

CSPM. You'll have a blank database now, so do a File - Import and import your topology back in. Delete the imported username from the bottom menu on the left hand side.

Do a Save/Update and Approve Now.

This worked great with one exception:

I had to delete the thousands of event messages from the database prior to running the Restore Policy Database process in the toolkit. When I tried to do that step without deleting those entries, the PC would freeze just a few seconds after stopping the CSPM service.

Thanks for your help.