System Admin and Configuration

Get Involved. Join the Conversation.

Topic

    Kim Dante
    Deleting email headers
    Topic posted October 11, 2019 by Kim DanteGold Medal: 3,500+ Points 
    38 Views, 5 Comments
    Title:
    Deleting email headers
    Content:

    I have purge_delete_stalemail set to 365.  Yet I still see email headers attached to 3yr old incidents.  Am I missing something?  I'm trying to reduce storage.

    Comment

     

    • Levi D

      Hi Kim,

      Did you happen to check the closed dates on the associated incidents?  Incidents need to be closed for more than X days (365 in your case) for the purge to work.

    • Kim Dante
      Yes they were closed 2-3 yrs ago. 
      
      
    • Sebastiaan Draaisma

      Hi Kim & Levi

      I created a test report (attached) that will show you the 100 oldest incidents that where closed more than 365 days ago and where the email header is NOT NULL
      This helped to identify the incidents.

      I can confirm that I have incidents with the same issue with one example below.

      180223-000071

      • PURGE_DELETE_STALEMAILHDRS set to 365 (audit log showed no change for this field so it has been this value since the beginning)
      • incidents.source_hierarchy = Techmail Service Mailbox
      • incidents.status_type = Solved
      • incidents.closed < -365 days
      • threads.mail_hdr IS NOT NULL

      The incident Audit log says:

      • 2018-02-23 08:49 - Created from Techmail
      • 2018-02-23 13:21 - Changed status to Solved
      • 2019-02-13 17:16 - Edit from Multiedit workspace (it doesn't mention which edit)

      It looks like this edit in the audit log is causing the delay and that the header will be removed on 2020-02-13 (not taking server location time zone and utility runtime into account)
      I have another one

      171201-000284

      • 2017-12-01 12:20 - Created from Techmail
      • 2017-12-04 09:25 - Changed status to Solved
      • 2018-10-29 10:06 - Edit from workspace (it doesn't mention which edit)

      So again, it seems like the unknown edit in the incident workspace is causing the delay and that the header will be purged 2019-10-29 (not taking server location time zone and utility runtime into account as this could add another day)

      My guess is that you will see a similar workspace edit in your incident audit log. I don't know what has been edited and are therefore unable to say if this could be a bug since the audit log does not mention a status change after 2017-12-04 09:25 but at least you know the cause and when your header will be purged.

    • Kim Dante

      Thanks Sebastiaan,  I have almost 400K  incidents that were closed prior to 365 days ago that still have the email header attached.  I sport checked and some were subsequently edited, but even those edit dates were < 365.  I opened an SR.

    • Sebastiaan Draaisma

      Keep us posted, will be interesting to know the answer.