How to release ESA Local Quarantine Mails? and how to push certain/specific sys_logs to the new ESA?

[bsrinu001]

Hi Team, 

Please suggets on how to realse locally quarentained mails on ESA?

Also,we are migrating to C670 to C690 physical severs we can takeback up of configuration file with out masking password and load it too, here how to take other Scp, Sys-logs back up (apart from these, which logs needs to take back up ) and how to load/push the same. 

Also, during this migration how SMA will store the tracting results? 

Please let us know in breif. Many Thanks 

[bsrinu001]

In addition to it, how to take back up of listed blacklist/white list data on ESA and also configured at Spam Quarantine end at the user side too.

[Libin Varghese]

You can backup the SLBL for the ESA from System Administraion -> Configuration File.

Scroll to the End-User Safelist/Blocklist Database (Spam Quarantine) section.

The appliance saves a .csv file to the /configuration directory of the appliance using the following naming convention:
slbl<serial number><timestamp>.csv

You can FTP to the appliance to retrieve the file and then send it to the replacement appliance over ftp as described in the beloew article.

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117922-technote-esa-00.html

Regards,

Libin Varghese

[Libin Varghese]

Hi,

The logs local to the ESA can be pushed using syslog, scp to third party servers in your network.

Importing them back to the ESA is not supported, so once pushed you would need to review them on the server the logs are being pushed to.

To release and deliver emails to the intended recipients you would need to navigate to the local quarantine under the Monitor tab and select and release the emails.

Migrating the ESA's would not have any impact on existing data on the SMA. If you use the same IP and configuration for the new ESA the SMA should continue data transfer as usual without any changes required. If there are any errors seen after the migration then that would need to be checked accordingly.

Regards,

Libin Varghese