ISQ: database is full - C170 Ironport

[Colin Ward]

Afternoon,

We have a C170 ESA which is having some problems with capacity.

We are now having an alert to say the ISQ database is full. From what I can see the ISQ is the Ironport Spam Quarantine but this service is disabled. Additionally, the logging disk is at 90+ % capacity.

Is there a way to find where this database is and where there logging disk is based to clear out some data?

Thanks in advance

[Robert Sherwin]

What version of AsyncOS is running?  What does 'diskquotaconfig' show?  If you are running 9.x or newer, you could be able to alleviate some ISQ growth by allocating more space via the same command.

Are you treating the spam quarantine more like a spam retention bucket, or can you alleviate some of the size concern by reducing the quarantine time?

The only method you would have to clear space from the ISQ is to log-in and delete directly from the ISQ, or release messages.  I would suggest to assure that you have 'schedule delete' for an appropriate amount of time.

-Robert

[Colin Ward]

Hi Robert,

Apologies for the delay.

The AsyncOS version is 7.6.2 014. We are a bit far behind in the upgrading stakes.

The spam quarantine is disabled which makes the error message a little confusing.

As an additional to this, the error has exploded somewhat into a "/data: write failed, filesystem is full".

When using winscp to SSH to the box it only shows the logging disk directories. Is there a way to access this /data directory to remove files? We restarted the device and on startup received some "ISQ: db.init() failed" and references to python scripts.

This could be connected to the data directory but it seems there isn't a way to access this section of the file system.

Thanks.