Removes alerts from the alerts database, the Dashboard, and the Riskware tab in the Email Security — Server Web UI. You can remove alerts from a specified time period, alerts matching a signature name or signature ID, or alerts that match both a time period and a signature.
The alerts riskware cleanup command can be used to delete duplicate alerts or false positive alerts.
Syntax
alerts cleanup riskware [from <start-time> to <end-time>][signame <signature-name> |sigid <signature-ID>]
Parameters
from <start-time>
The beginning of the time period, in the format <yyyy>/<mm>/<dd> <hh>:<mm>:<ss>.
to <end-time>
The end of the time period, in the format <yyyy>/<mm>/<dd> <hh>:<mm>:<ss>.
signame <signature-name>
Clean up alerts that match the specified signature name.
sigid <signature-name>
Examples
The following example removes alerts from the specified period.
hostname (config) # alerts cleanup riskware from 2020/01/05 12:12:12 to 2020/01/06 12:12:12 About 2 alerts to be impacted. Confirm cleanup? [yes] yes Operation initiated in the background. Run 'show alerts cleanup status' for status
hostname (config) #show alerts cleanup status Alert Cleanup Summary: Cleanup status : completed Cleanup started at : 2020-01-31 17:43:08 Cleanup ended at : 2020-01-31 17:43:10 Total Alerts to be cleaned up : 2 Number of alerts processed : 2 Number of emails processed : 2 Number of emails released : 0
The following example removes alerts that match a signature name.
hostname (config) # alerts cleanup riskware signame AZ_Adware_00fc8020ad243161
The following example removes alerts from the specified time period if they match a signature ID.
hostname (config) # alerts cleanup riskware from 2020/01/05 12:12:12 to 2020/01/06 12:12:12 sigid 86779999
User role
Admin
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Email Security — Server: Release 9.0