disk quota getting full

[Vishal6]

Hi All,

Disk quota for Policy, Virus and Outbreak Quarantines getting 99% on my Cisco Cloud Email Solution. As per below document it applies default action to make space for more logs and as per my configuration my default action is delete. Taking consideration of this would i need to worry that my disk quota would get full and there be any production impact or Ces manages itself.

https://www.cisco.com/c/en/us/td/docs/security/ces/user_guide/esa_user_guide_13-0/b_ESA_Admin_Guide_ces_13-0/b_ESA_Admin_Guide_ces_12_0_chapter_011111.html

[Vishal6]

One more question. Do you get any intimation/notification if old mails are getting deleted to make room for new mails.

[UdupiKrishna]

Our recommendation is not allow it go to 99% because it can have unforeseen negative impact to certain services like quarantine. SMA is possibly receiving more emails to quarantine compared to how many emails are eligible to be deleted.

Review your configuration again and see if its worth decreasing the retention period, fine tune the filters that are sending emails to quarantine regularly etc. SMA generates logs locally (mail_logs) when emails are being deleted during retention period expiry. There are no notifications generated

[Vishal6]

Does it apply on sma hosted on Cisco provided cloud where it auto delete the mails as per action configure 

[saliyev]

10K messages utilizing all quota looks suspicious. it might be due to:
 - disk quota size is small
 - POV quarantined message sizes are big
 - issue in POV DB

check 1st and 2nd. if 3rd, you can request for TAC and they can check DB inconsistency.

[Vishal6]

How would i come to know  if there's a issue in POV DB. Pls suggest.

[saliyev]

well, you can check for number of messages and sizes on Quarantine folders page. if you see abnormal data, such as '-' numbers on messages, huge size numbers - it could be symptom.
2nd way is - check alerts on SMA via 'displayalerts' CLI command.

have you checked pint #1 and #2 I mentioned before?
can you share screenshot of POV quarantine settings and POV quarantines folders pages ?