Deleting Individual Messages from Message Store Using CLI

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
mcbenton71
Posts: 2
Joined: Thu Jun 13, 2019 1:11 pm

Deleting Individual Messages from Message Store Using CLI

Postby mcbenton71 » Thu Jun 13, 2019 1:21 pm

We run BitDefender on our Zimbra server. Recently, it detected some infected messages in the Zimbra message store that it could neither quarantine nor clean. Here is the partial output of the log file:

Code: Select all

VB:Trojan.Valyria.1997   /opt/zimbra/store/0/11/msg/10/42561-358926.msg=>[Subject: SPAM emails][Date: Mon, 16 Jul 2018 07:48:15 -0400]=>(message)=>[Subject: Please pull invoice 82189][Date: Thu, 12 Jul 2018 19:07:39 -0400]=>INV-82189.doc
VB:Trojan.Valyria.2154   /opt/zimbra/store/0/11/msg/10/43637-361490.msg=>[Subject: FW: Invoice FIN6514632951 from Gail L. Lewis][Date: Mon, 20 Aug 2018 08:17:17 -0400]=>FIN6514632951.doc
VB:Trojan.Valyria.2176   /opt/zimbra/store/0/11/msg/10/43651-361548.msg=>[Subject: FW: IRS Verification of Non-filing Letter from 08/15/2018][Date: Mon, 20 Aug 2018 08:28:03 -0400]=>IRS-Tax-Transcipts-051W_74.doc
VB:Trojan.Agent.DDMN   /opt/zimbra/store/0/11/msg/10/43829-362209.msg=>[Subject: FW: Order Confirmation 9734232][Date: Mon, 27 Aug 2018 07:38:19 -0400]=>OO_U_9734232_23_08_2018.doc
VB:Trojan.Valyria.2338   /opt/zimbra/store/0/11/msg/10/44539-363573.msg=>[Subject: FW: Invoice 382 from Waseem][Date: Mon, 10 Sep 2018 13:08:37 -0400]=>AI_VZG_382_09_10_2018.doc
VB.EmoDldr.11.Gen   /opt/zimbra/store/0/11/msg/10/44643-363918.msg=>[Subject: FW: Merchandise: invoice 76892][Date: Fri, 14 Sep 2018 11:48:18 -0400]=>UV_D_93_DTJUD868441537_09_14_2018.doc
VB:Trojan.Valyria.2417   /opt/zimbra/store/0/11/msg/10/44739-364243.msg=>[Subject: FW: 50397 - Proof of payment for Aug invoice][Date: Thu, 20 Sep 2018 15:09:28 -0400]=>GXU_PN_61_ECXFU3376481530_09_20_2018.doc
VB:Trojan.Valyria.2412   /opt/zimbra/store/0/124/msg/10/41177-85184.msg=>[Subject: Fwd: Acknowledgement CR-64-49539 ][Date: Fri, 21 Sep 2018 20:02:54 -0400]=>DOC-36131328204.doc
VB:Trojan.Valyria.2545   /opt/zimbra/store/0/124/msg/11/45519-93959.msg=>[Subject: FW: Sheduling Invoice][Date: Fri, 9 Nov 2018 10:31:44 -0500]=>DOC5923677.doc
VB:Trojan.Agent.DNJC   /opt/zimbra/store/0/124/msg/12/50613-103452.msg=>[Subject: FW: Invoice 624471][Date: Mon, 14 Jan 2019 10:03:11 -0500]=>DOC-624471.doc
VB:Trojan.Valyria.1990   /opt/zimbra/store/0/124/msg/9/36905-75978.msg=>[Subject: FW: Invoice 667173 from Gail L. Lewis][Date: Thu, 12 Jul 2018 14:30:07 -0400]=>INV-667173.doc
VB:Trojan.Valyria.2074   /opt/zimbra/store/0/124/msg/9/37780-77758.msg=>[Subject: FW: M8 2018 Payroll][Date: Thu, 26 Jul 2018 12:08:55 -0400]=>M8 2018 Payroll.doc
VB:Trojan.Valyria.2428   /opt/zimbra/store/0/146/msg/2/11748-30894.msg=>[Subject: FW: Copy Invoice][Date: Thu, 27 Sep 2018 08:10:42 -0400]=>Invoice_No_A39132.doc
VB:Trojan.Valyria.2373   /opt/zimbra/store/0/15/msg/52/213200-598195.msg=>[Subject: James Kirkpatrick Invoice][Date: Mon, 17 Sep 2018 15:53:08 +0100]=>Invoice_No_R152605.doc


Question: Can I delete these messages directly from the message store by using "rm," or is there a Zimbra way to do it? I just want them gone. Unfortunately, the log does not tell me whose mailboxes these are.


Klug
Elite member
Elite member
Posts: 2365
Joined: Mon Dec 16, 2013 11:35 am
Contact:

Re: Deleting Individual Messages from Message Store Using CLI

Postby Klug » Thu Jun 13, 2019 1:35 pm

Same answer than the one in this thread applies: viewtopic.php?f=15&t=66305

Don't "rm" the files, delete the email using ZCS' tools.
mcbenton71
Posts: 2
Joined: Thu Jun 13, 2019 1:11 pm

Re: Deleting Individual Messages from Message Store Using CLI

Postby mcbenton71 » Thu Jun 13, 2019 2:27 pm

Thanks for the guidance. Using

Code: Select all

zmprov gmi
, I was able to match users with infected mailboxes and delete the infected messages.

Return to “Administrators”

Who is online

Users browsing this forum: No registered users and 15 guests