Hello SDA team,
For issues with workqueue (you can confirm if it's work queue for delivery queue) you will need to find out what types of emails are currently impacting the workqueue.
Generally engaging Cisco TAC with a support case is the suggested action, else you can check the workqueue status with
status detail
The system status, if it's paused on workqueue: (service name)
Initial troubleshooting step is updatenow force
After which monitor.
If you looked at the queue numbers and see it's stuck in Active Recipients queue, then this is a delivery queue problem where you can clear the queues with a combination of showrecipients and deleterecipients command.
If it's indeed the workqueue, you need to find out what types of emails are being injected in or has been injected from what sender and subject.
I would suggest the use of two commands
grep -i "ready" mail_logs
Look for a common sender that can see is problematic, grep out that MID in question and put in a message filter to remove these emails
else use the grep -i "MID.*subject" mail_logs and look at the subject lines and check if there is a common subject, and again use a message filter to remove them
resetqueue should be a last option as it will clear out all emails in the queues and quarantines.
Attached is a detailed article on correcting this as well and highly suggested to review:
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/200030-Troubleshoot-unwanted-outbound-emails-on.html
Regards,
Matthew
