Sophos AP/APX users may experience issues registering to Sophos Central. More info available here: Central Wireless

Bulk delete from SMTP quarantine

Recently an email account on my mail server got compromised (no fault of the XG or firewall). Because it was compromised I currently have 59,233 emails in my quarantine that are from a single user and my system reports total utilization of the SMTP Quarantine is 306.98%.

 

Is there any way I can do a bulk delete for any messages from a specific email account in the quarantine? I know I can filter and delete messages from the web interface, but it only shows me 20 messages at a time so trying to get rid of all the messages would take a long time.

 

    • Sophos Staff
    • Staff Moderator
    FloSupport

    Hey  

    Unfortunately, this suggestion is currently a feature request that has been raised on our Sophos Ideas page. I will reach out to my team on your behalf to discuss if any other options are available for your situation.

    Best,

  • CharlesEapen

    Hi All,

    Recently I had same issue. I got it fixed after long Trial & Error, luckily my devices were in HA.

    Note:

    • Mailspool would not get cleared even if you factory reset the device
    • If you have HA in Active Passive, passive device will not have mail spool, only primary device

    What I did:

    1. Made Auxiliary device to primary (just reboot primary)
    2. Rolledback the device to previous firmware, this will remove all settings and the mail spool
    3. Change to new firmware ( no mail spool yet)
    4. Added the device to HA
    5. Now everything is fine

     

    If the device is not in HA, things would be difficult. Support says device backup includes mail spool too, am not sure of it. if it does not, you are lucky.
    Just revert to previous firmware > new firmware or install the latest firmware ISO image. Then restore the backup.
    Other option is to manually export each configurations and do the device firmware reset
    I had contacted Sophos support they couldn't do anything. 

    • Sophos Staff
    • Staff Moderator
    FloSupport

    In reply to CharlesEapen:

    Hi  

    Thanks for following up and providing your workaround to our community.

    My apologies for your negative experience with our support, would it be possible to please PM me with your case ID so I can review the activities?

    Thanks,

Sophos Footer