IMF Tune v6.1 - Forefront Protection 2010 for Exchange Support
Emptying the IMF Tune Quarantine
With today's spam loads, the IMF Tune Quarantine may sometimes end up filled with thousands of spam emails. IMF Tune does not provide a "Delete All" button and deleting these through the Quarantine interface may be too time-consuming.
Quarantine Maintenance provides a very handy workaround in this case. Through it, we can automatically delete all emails older than x days. This gives us more control on the delete operation. Rather than restarting from zero, we can delete enough items for the spam count to go down to a manageable level.
Today we take a look at the Quarantine Maintenance functionality. We see how to perform a one-off wipe and also how Maintenance helps us avoid quarantine overload problems altogether.
Before We Begin - Configuration Backup
In this article we will discuss some configuration changes to force a Quarantine cleanup. The changes will only be required until the cleanup is completed. Following that we may revert to the old configuration settings.
The easiest method to revert the settings is that to perform a Configuration Backup before starting and a restore once the cleanup is ready. This can be done using the Configuration Backup/Restore wizard available under the IMF Tune program group. Otherwise, we would have to revert the settings manually.
Quarantine Maintenance is configurable from the IMF Tune server configuration interface. So to begin with, open the configuration Disk Maintenance | Archive/Quarantine category.
Under this category we have settings that are relevant to both Email Disk archiving and to the MS SQL Quarantine system. Explaining all the Disk Maintenance functionality is beyond the scope here. We will only discuss the settings relevant to our Quarantine cleanup task.
The most important setting in our discussion is:
This setting controls the number of days an email is to be retained within the Disk Archive before it is moved to backup. The same setting also controls the number of days items are retained within the Quarantine system. This is clear from the warning shown right above this configuration field reading:
Thus we can conclude that
So if we wanted to empty the Quarantine of all emails older than 5 days, we simply set the
The lowest value we can give to this configuration field is 1, so the best we can do is to wipe everything except for the items added within the last 24 hours.
The Disk Maintenance operation is run once a day at most. The
In general this operation should be scheduled to run after hours. However if we wanted to see this done immediately, we could set the schedule to something like 5 minutes from the current time. Under Disk Maintenance | Archive/Quarantine | Schedule do the following:
Is Something Wrong with the Configuration?
Disk Maintenance is specifically meant to control the growth of the Disk Archive and the Quarantine Database. So in general we should not need to perform this type of cleanup too often. Thus it is worth understanding why we needed to perform this cleanup in the first place.
If quarantine items accumulated because of something unusual, the one-off cleanup is fine. For example there might have been an unusually large spam wave, or maybe the users tasked with moderating the Quarantine were on vacation for a long time. These one-off events may justify the need for a cleanup. On the other hand if we end up cleaning up very often, the solution is to permanently lower the value for