Incidents Report Queue isn't purging

Question

Hi There,
Using Antigen 9.2.1097 SP2 for SMTP server on Win2003 and although the "Purge after 91 days" check box for the Incidents report queue is enabled right now there are incidents going clear back to April 2014.
The quarantine report queue is configured the same way yet it seems to be working with messages going back to only October 28, 2014.
I have removed the purge check mark and clicked 'apply'  Then I re-enabled it and also changed the time to 101 days.  Then I waited overnight since I know the purge routine doesn't take effect right away.  In fact I waited multiple evenings
with the same setting and no change.
I have clicked the "Clear Log" button at the top right which I'm assuming should wipe out ALL the incidents and it gave feedback indicating it worked however I still have every single incident in the log.
I'm only concerned with running out of disk space here.
Any ideas or advice welcome!
PS: As the Windows 2003 server is fully updated this issue has been surviving reboots as well since it had to be rebooted numerous times since October 28, anyway in order to apply security patches.
Thanks!
Sam

Answer 1

Hi Sam,
1) How can I monitor the database size in order that I might be able to decide if and when to uninstall / reinstall Antigen?  Where is this incidents database and can you confirm that it's true there's a 2GB limit oh and what will happen, exactly,
when that's reached?  Will the computer catch on fire, do you suppose?  I sure hope it won't break in half to reveal all the smoke and mirrors inside of it, anyway! ;)
Answer: You can monitor the size of your Incidents Database by looking at the size of the incident.mdb file located in your Antigen directory. There is a 2 GB limit for this file, once this limit is hit the file is corrupted and can no longer be purged by
the Antigen option to 'purge after.' Can you verify the size of this file now? It is possible it is past the 2GB limit already and this is why your incidents are not purging.
2) Can you point me to best practice method for that export and uninstall / reinstall you suggested so that I might have it handy in the event I determine, using your answers to point 1), that I'll need to buy myself a bit more time before we replace
Antigen with another system?  (probably in August when things are a bit quieter in the office).
Answer: You can export you incident list by choosing Export in Report -> Incidents --> Export. This will export your incidents to a .txt file to a location of your choice.
Antigen stores program settings as well as scanning activity information, including the Quarantine Area, on the file system. If you want, you can relocate these files at any time after installation.
To relocate data files :
1. Stop all Exchange services and any Antigen services that might still be running after Exchange is stopped.
2. Create a folder in the location where you want to move the files.
3. Move all the data files (files with the .adb extension) and the Quarantine and Engines folders.
4. Change the following registry key to reflect the new location: HKEY_LOCAL_MACHINE\SOFTWARE\Sybari Software\Antigen for Exchange\DatabasePath.
5. Set the security for the new location. Right-click the folder of the new location, and then select Properties. On the Security tab, add a user called “Network Service” with Full Control privileges. This is necessary so that logging is performed for the
SMTP Scan Job.
6. Restart the Exchange services.
If you have any questions you can reference the link below
https://technet.microsoft.com/en-us/library/bb914021.aspx
Best Regards,
Joyce
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected].