Symantec Messaging Gateway (SMG) sends alerts indicating that available disk space is below configured thresholds or that operations like backups or diagnostic collection are failing with an error indicating that there is not enough free disk space to complete the operation.

Depending on configuration of reporting, logging and quarantine options, SMG may exhaust available disk space.

Messaging Gateway (SMG) is unlikely to exhaust available disk space under the default configuration but selecting some policy actions such as quarantining messages or maintaining audit logs for extended periods may require periodic administrator action to ensure that disk space is not exhausted.

General Recommendations

Checking free disk space on SMG

• The free disk space on the /data partition which is used for message queues, logs, and message quarantines is displayed in the Control Center UI under Status > Hosts under Disk Usage. This shows how much space has been used on the /data filesystem but not how much is free
• The monitor disk command line utility will show the used and free space for the data, opt, and root filesystems
  

  smg [10.7.4-13]> monitor disk
     disk:  data_used  data_free   opt_used   opt_free other_used other_free
              6247664   99429868     808492    1068940    1697076    5992992

Setting the expunger limits (Logs, Reports and Quarantines) and waiting for the expunger to clear them is the recommend method to reduce disk space usage.
The expunger frequency can be temporarily increased to speed up the process of cleaning up storage.

Control Center role

• Quarantined messages
  • Manually delete old messages from the quarantine in (Spam > Email Spam).
  • It is recommended that this be managed in (Spam > Quarantine settings).
    • Under the “Spam Quarantine Expunger” heading, set thresholds to ensure messages are expunged regularly and prevent the quarantine from growing too large.
• Compliance incidents
  • Delete old incidents from the incident folders in (Content > Incident Management).
    • You can keep a record of your incidents by exporting them with the “Export Incident History” button
  • Each incident folder should be configured with a size limit and number of days before a default action is taken in (Content > Content Incident Folders)
• Reporting data
  • You can manually delete reporting data in (Administration > Reports) and clicking on “Delete Data Now”.
  • Under (Administration > Reports) the report expunger is set to remove reporting data older than 7 days by default.
    • You can adjust this to your needs but use caution as this can consume large amounts of disk space.
• Logging
  • You can manually clear all scanner logs from the log database by going to (Status > Logs) and clicking on “Clear All Scanner Logs”
  • Under (Administration > Logs) the log expunger is configured to expunge logs in the database once logs are 7 days or older and have reached a maximum log size of 50MB (default).
• Database backups
  • You can download and delete old backups in (Administration > Version > Restore/Download).
  • Scheduled backups can specify how many backups will be stored locally on the system.

Scanner role

• Core files are useful when troubleshooting a crash, but take up a lot of space and should be deleted when not in use for troubleshooting by technical support.
  
  • Run “delete cores" to remove stored core files.
• Log files are separate from the log database on the control center.
  • Run “delete scannerlogs” to remove all scanner specific logs.
    • Note: Use the command, “help delete” for more information on clearing specific log files.
• Message Audit Logs can take up a large amount of space, depending on configuration.
  • Run "mallog" to backup or restore Message Audit Logs on a separate storage location 
    • Note: Use the command "help mallog" for usage information.
  • Run "delete mallogs" to manually remove all message audit logs from the scanner to clear space.

All appliance types

• Old software update cache
  • Run "delete sudata" to remove cached software update data
• Manual file deletion
  • List the largest files on the system available to be deleted (Warning: This can result in loss of data. Be aware of the function related to files that are deleted)
  • Run "list -t" to display files available to delete sorted by size.
  • Run "delete file <path and filename displayed in the list -t command>"

Make sure the level of gathering logs is set to Warning. In the Control Center Administration > Settings > Logs > Local Logging

In some cases, disk space can be depleted on the root partition due to large files being stored in the system tmp directories. The best way to remove these files is to reboot the SMG appliance.