2 Replies Latest reply on Mar 1, 2013 11:24 AM by packetmonkey

    Deleting local admin mail

      Hello,

       

      On McAfee Enterprise firewall 8.3 I have an admin account but the mail that has accumulated in this is account is now so large (900Mb) that I can't view or delete this from the command line with "mail"

       

      I get the following error:

       

      /tmp: write failed, filesystem is full

       

      I noticed that the /var/mail/admin is about (900Mb) and the /tmp is only 280Mb.

       

      How can I delete this backlog mail as I get stopped with the security of the OS in deleting or moving this file.

       

      Many thanks in advance,

        • 1. Re: Deleting local admin mail

          Local admin mail is stored in /var/mail in a file named after the account name. Each email is appended to the begining of the file, so the file size continues to increase with each email received. To remove all email delete the file. From CLI, cd /var/mail then delete the mail by removing the file:

           

          rm admin_account

           

          If you do not want to store admin mail locally, you have two options:

           

          1) Send admin mail off the firewall to an external account.

          2) Send admin mail to /dev/null.

           

          For either option, edit the /etc/mail/aliases file. In this file, locate the following lines:

           

          # Pretty much everything else in this file points to "root", so
          # you would do well in either reading root's mailbox or forwarding
          # root's email from here

          root: admin_account

           

          Edit the "root: admin_account" line and enter either an external email address, or enter "/dev/null" to not store mail locally. For example,

           

          root: email@domain.com (to send mail to an external account)

          root: /dev/null (will not store mail locally or send to an external address)

           

          Then run "newaliases" or "cf sendmail rebuild" from CLI.

           

          Storing mail locally will eventually cause the partition to fill and force the firewall into failure mode. It is recommended to deliver mail to an external account or to write mail to /dev/null.

          • 2. Re: Deleting local admin mail

            Hi,

             

            Many thanks for this very complete answer.

             

            I did try mv the file but the SecureOS filetype enforcement prevented me from doing this.

             

            I'll just delete the file and setup the alias as you advise.

             

            Thanks again.