Cisco Cisco Email Security Appliance C160 Mode D'Emploi
31-9
User Guide for AsyncOS 10.0 for Cisco Email Security Appliances
Chapter 31 Policy, Virus, and Outbreak Quarantines
Managing Policy, Virus, and Outbreak Quarantines
Alerts About Quarantine Disk-Space Usage
An alert is sent whenever the total size of the policy, virus, and outbreak quarantine reaches or passes
75 percent, 85 percent, and 95 percent of its capacity. The check is performed when a message is placed
in the quarantine. For example, if adding a message to a quarantine increases the size to or past
75 percent of the total capacity, an alert is sent. See also
75 percent, 85 percent, and 95 percent of its capacity. The check is performed when a message is placed
in the quarantine. For example, if adding a message to a quarantine increases the size to or past
75 percent of the total capacity, an alert is sent. See also
For more information about Alerts, see
.
Policy Quarantines and Logging
AsyncOS individually logs all messages that are quarantined:
Info: MID 482 quarantined to "Policy" (message filter:policy_violation)
The message filter or Outbreak Filters feature rule that caused the message to be quarantined is placed
in parentheses. A separate log entry is generated for each quarantine in which the message is placed.
in parentheses. A separate log entry is generated for each quarantine in which the message is placed.
AsyncOS also individually logs messages that are removed from quarantine:
Info: MID 483 released from quarantine "Policy" (queue full)
Info: MID 484 deleted from quarantine "Anti-Virus" (expired)
The system individually logs messages after they are removed from all quarantines and either
permanently deleted or scheduled for delivery, for example
permanently deleted or scheduled for delivery, for example
Info: MID 483 released from all quarantines
Info: MID 484 deleted from all quarantines
When a message is re-injected, the system creates a new Message object with a new Message ID (MID).
This is logged using an existing log message with a new MID “byline”, for example:
This is logged using an existing log message with a new MID “byline”, for example:
Info: MID 483 rewritten to 513 by Policy Quarantine
About Distributing Message Processing Tasks to Other Users
You can distribute message review and processing tasks to other administrative users. For example:
•
The Human Resources team can review and manage the Policy Quarantine.
•
The Legal team can manage the Confidential Material Quarantine.
You assign access privileges to these users when you specify settings for a quarantine. In order to add
users to quarantines, the users must already exist.
users to quarantines, the users must already exist.
Each user may have access to all, some, or none of the quarantines. A user who is not authorized to view
a quarantine will not see any indication of its existence anywhere in the GUI or CLI listings of
quarantines.
a quarantine will not see any indication of its existence anywhere in the GUI or CLI listings of
quarantines.
Related Topics
•
•
•
•