Hi all, Due to the new virus (sobig) slamming our OTRS system, we have archieved to have our queues filled up with mail containing virus (including attachments). The amount is so huge that it will take several hours to delete each mail manually by closing them down from OTRS. We tried to delete them directly from the database by first selecting and then deleting the entries from the following tables : article, article_plain, article_attachment and ticket_history. But even thou the messages seems to have been deleted, they still show up in the system, but when clicking on them, we get the error "Invalid ticket" or "Ticket does not exist". Does anyone know how we can get around this so we wont have to manually close down all the mails from otrs. Any information on this is most welcome. Best Regards Anders H
Hi Anders H, Anders Hinding wrote:
Hi all,
Due to the new virus (sobig) slamming our OTRS system, we have archieved to have our queues filled up with mail containing virus (including attachments).
The amount is so huge that it will take several hours to delete each mail manually by closing them down from OTRS.
We tried to delete them directly from the database by first selecting and then deleting the entries from the following tables : article, article_plain, article_attachment and ticket_history. But even thou the messages seems to have been deleted, they still show up in the system, but when clicking on them, we get the error "Invalid ticket" or "Ticket does not exist".
Does anyone know how we can get around this so we wont have to manually close down all the mails from otrs.
I guess they still show up because of the entry in table ticket. See this page as a reference: http://www.mail-archive.com/otrs@otrs.org/msg01122.html The problem might be that it's not easy to select and delete the entries in table ticket. Hope this helps, Yong Li
Any information on this is most welcome.
Best Regards Anders H
_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs
Hello there, I had the same problem and i wrote a small PHP-Script which
helped me out here:
basically, the idea is to selects the "bad" emails from the article table,
reads out the ticket_id and then removes
these in the "tickets" table. here's how i did it:
(of course, you have to select your db settings first)
==========================================
$abfrage = "SELECT ticket_id from article where
a_subject = 'Re: Re: My details'
OR a_subject = 'Re: Details'
OR a_subject = 'Re: Approved'
OR a_subject = 'Re: Wicked screensaver'
OR a_subject = 'Re: That movie'
OR a_body = 'See the attached file for details'
";
$ergebnis = mysql_query($abfrage);
if(!$ergebnis)
echo "Abfrage nicht korrekt: $abfrage<br>\n";
while
(
list
(
$db_id
)
= mysql_fetch_row($ergebnis)
)
{
$abfrage2 = "update ticket set ticket_state_id = '2' where id = '$db_id'";
$abfrage2 = mysql_query($abfrage2);
}
==========================================
I am aware of the fact that it is not very clean, but running it as a
cronjob started every 2 minutes
it is doin a fine work for me.
as the senders of the emails are all fake you will get a lot of
mailer-daemon errors, so
that's why i added
the line
OR a_subject = 'Returned mail: see transcript for details'
which might not be a good solution if you like to see mailer daemon errors
for you general non viral
support mails. any suggestions?
best regards,
Florian "bettmenn" Gattung
----- Original Message -----
From: "Yong Li"
Hi Anders H,
Anders Hinding wrote:
Hi all,
Due to the new virus (sobig) slamming our OTRS system, we have archieved
to
have our queues filled up with mail containing virus (including attachments).
The amount is so huge that it will take several hours to delete each mail manually by closing them down from OTRS.
We tried to delete them directly from the database by first selecting and then deleting the entries from the following tables : article, article_plain, article_attachment and ticket_history. But even thou the messages seems to have been deleted, they still show up in the system, but when clicking on them, we get the error "Invalid ticket" or "Ticket does not exist".
Does anyone know how we can get around this so we wont have to manually close down all the mails from otrs.
I guess they still show up because of the entry in table ticket. See this page as a reference: http://www.mail-archive.com/otrs@otrs.org/msg01122.html
The problem might be that it's not easy to select and delete the entries in table ticket.
Hope this helps, Yong Li
Any information on this is most welcome.
Best Regards Anders H
_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs
OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs
participants (3)
-
Anders Hinding -
Florian Gattung -
Yong Li