On our SEA, (V18.104.22.168) that is part of a cluster of 2, the dashboard shows that there are messages in quarantine, and that quarantine is "~32%" full, and that the age of quarantine is 27 days
However, when I search for messages in quarantine, going back in time to before the SEA was purchased, no messages appear.
It seems suspect that there are messages somewhere that I can't find to remove. Does anybody have any suggestions?
Thanks for reaching out, and welcome to the Sophos Community!
The Quarantine Capacity will be reduced and counted based on files in persist directory on the appliance; it's not only quarantined emails accounted for Quarantined Capacity.
So are those files that are needed for operation? can they be removed? (if so. how?)
The persist directory includes important files besides quarantined emails. However, the appliance is up for 289 days. A restart would be needed to reset the counters and clear out any stuck process. Since the appliance is up for 289 days, it might take some time to restart as it'll be doing a hardware check. Please schedule a proper maintenance window to restart the appliance and let us know how it turns out for you.