Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 1280 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Mail Disk Space

Marco Suhr

Hi,

I have a bit of trouble with an Sophos XG 115 regarding the internal disk space in the mail-section.
Currently running: SFOS 18.0.6 MR-6-Build655 (update to 18.5.2 MR2-Build380 is planned for tonight).

Starting from yesterday I don't get any mails in or out anymore. Yesterday a reboot helped, but that won't work anymore.

Log from Sophos UTM SMTP Spool (Testmail sent from an external, working system to the problematic XG):

2022-02-09 16:07:00 H=mail.corporate.de [x.x.x.x]:25: SMTP error from remote mail server after initial connection: 451 Not able to accept your email due to low disk space
2022-02-09 16:07:00 test@corporate.de R=dnslookup T=remote_smtp defer (0) H=mail.corporate.de [x.x.x.x]:25: SMTP error from remote mail server after initial connection: 451 Not able to accept your email due to low disk space

The Testmail doesn't appear in the XG web console (Mail logs, Mail spool, SMTP quarantine).

If I try to send a Mail, I get - after some time - a Mail from the Exchange 2016:

Server at 192.168.160.2 (192.168.160.2) returned '400 4.4.7 Message delayed'
09.02.2022 13:27:41 - Server at 192.168.160.2 (192.168.160.2) returned '451 4.4.395 Target host responded with error. -> 451 Not able to accept your email due to low disk space'

192.168.160.2 is the Sophos XG.

In 'Diagnostics' -> 'System graphs' the XG shows an average of 99.7% Disk usage on Reports, that doesn't seem to be good.
The entries from 'SMTP quarantine' and 'Mail logs' are going about 1.5 years in the past from when I configured the XG.
I tried to delete a good amount of Mails in the quarantine (there's still a lot, but Total utilization: 20.13% used doesn't seem to be too bad)
and purged all reports ('Reports' -> 'Show report settings' -> 'Manual purge') - but that didn't help.
I didn't find an option to purge the Mail logs, that's most likely the problem.

What can I do to solve the problem?
And also: where do I configure that the XG automatically deletes / purges old stuff? No one needs the Log from > 1 year ago, especially not blocked spam.

Greetings

Marco



This thread was automatically locked due to age.
  • 0

    Hi,

    please have  look at GUI -> Reports -> Show report settings -> Data management that is the area where you set the life of stored data.

    Ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Thanks for your answer.

    I already tried to decrease the values on that menu - hoping it would cut the data if I give it a couple minutes.
    But that not only not work, it wouldn't make sense either: the longest defined period was 6 month, not a single option there lets you define more then a year.
    But Mail logs and quarantine were stored back to 07/2020 when I configured the XG. So either none of the opions are responsible for that or it simply doesn't work.

    I more-or-less solved the problem a couple minutes ago:

    • Opened the console / web shell -> 3/Advanced Shell
      system diagnostics show disk -> report 99%
    • Re-Opened the web shell -> 4 Flush Device Reports

    Now my Disk usage is below 25% and mails are going in and out again.

    But normally, in a production environment, that shouldn't even be an option.
    The quarantine is fully cleared now, if there was a false-positive quarantine-mail that's not released it would mean data loss.
    I also lost all mail logs to that point.

    Luckily that's only a small office, I could make sure there are no false-positive quarantine-mails beforehand and I rarely need to check the mail log here. In a bigger environment this would be a big problem.

    So the time-critical problem is solved, but I still need to know where I can define to automatically cut off data for SMTP quarantine and Mail logs. It can't be the solution that I destroy all logs every 12-18 months and in worst-case - like today - have a non-working system.

    Greetings
    Marco

  • 0 in reply to Marco Suhr

    Hi Marco,

    sounds like have hit a bug. Decreasing the storage period usually takes either a restart or at least 24-48 hours before the resize is affected.

    Ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?