disk quota getting full

[Vishal6]

Hi All,

Disk quota for Policy, Virus and Outbreak Quarantines getting 99% on my Cisco Cloud Email Solution. As per below document it applies default action to make space for more logs and as per my configuration my default action is delete. Taking consideration of this would i need to worry that my disk quota would get full and there be any production impact or Ces manages itself.

https://www.cisco.com/c/en/us/td/docs/security/ces/user_guide/esa_user_guide_13-0/b_ESA_Admin_Guide_ces_13-0/b_ESA_Admin_Guide_ces_12_0_chapter_011111.html

[Vishal6]

One more question. Do you get any intimation/notification if old mails are getting deleted to make room for new mails.

[UdupiKrishna]

Our recommendation is not allow it go to 99% because it can have unforeseen negative impact to certain services like quarantine. SMA is possibly receiving more emails to quarantine compared to how many emails are eligible to be deleted.

Review your configuration again and see if its worth decreasing the retention period, fine tune the filters that are sending emails to quarantine regularly etc. SMA generates logs locally (mail_logs) when emails are being deleted during retention period expiry. There are no notifications generated

[Vishal6]

Does it apply on sma hosted on Cisco provided cloud where it auto delete the mails as per action configure 

[saliyev]

10K messages utilizing all quota looks suspicious. it might be due to:
 - disk quota size is small
 - POV quarantined message sizes are big
 - issue in POV DB

check 1st and 2nd. if 3rd, you can request for TAC and they can check DB inconsistency.

[Vishal6]

How would i come to know  if there's a issue in POV DB. Pls suggest.

[saliyev]

well, you can check for number of messages and sizes on Quarantine folders page. if you see abnormal data, such as '-' numbers on messages, huge size numbers - it could be symptom.
2nd way is - check alerts on SMA via 'displayalerts' CLI command.

have you checked pint #1 and #2 I mentioned before?
can you share screenshot of POV quarantine settings and POV quarantines folders pages ?

[Vishal6]

Hi,

Can i verify alerts via gui as i dont have access to gui.

PFA quarantine settings and folder pages.

[saliyev]

yes. you can check by clicking on 'View Top Alerts' button in 'Administration -> Alerts' page.

by message numbers and sizes, it means each message in average is ~2 MB.

all in all, the rate, size of quarantined messages needs to be checked and verified to confirm normal operation and also calculate sizing for quarantine. if all good, you can increase quarantine size.
regarding to verify default delete of quarantined messages, it can be checked on SMA mail logs, also some specific messages you can check via Message Tracking.

[Vishal6]

I'm not able to find 'View Top Alerts' button in 'Administration -> Alerts' page on gui. PFA and guide me.

[saliyev]

oh. I see this is Cloud-based Host. seems you don't have permission for 'Alerts' tab. However, you should receive alert notifications via email.

can you please share URL of SMA ?

If you can confirm that messages quarantined are normal in terms of size and rates, so 10 GB might not be enough for your environment.
I can recommend you to increase disk quota for PVO quarantine on SMA.