I recently experienced an unexpected power down of my IronPort Email Security Appliance which led to the appliance generating an hourly email containing the following:
The Critical message is: An application fault occurred: ('aggregator/master_aggregator.py _process_export_files|605', "<class 'reporting.aggregator.master_aggregator.ExportProcessError'>", '', '[aggregator/master_aggregator.py main|272] [aggregator/master_aggregator.py watch_incoming_queue|401] [aggregator/master_aggregator.py _process_export_files|605]')
- SSH to the IronPort appliance
- Enter diagnostic mode by typing “diagnostic”
- Then enter reporting mode by typing “reporting”
- Finally type “deletedb”
- You’ll be prompted to confirm that you do indeed wish to delete the reporting database
This process took a few minutes on my lab system and then reporting started working again.
Here’s what the process looked like:
ironport.intsystek.com> diagnostic Choose the operation you want to perform: - RAID - Disk Verify Utility. - DISK_USAGE - Check Disk Usage. - NETWORK - Network Utilities. - REPORTING - Reporting Utilities. - TRACKING - Tracking Utilities. - RELOAD - Reset configuration to the initial manufacturer values. - SERVICES - Service Utilities. > reporting The reporting system is currently enabled. Choose the operation you want to perform: - DELETEDB - Reinitialize the reporting database. - DISABLE - Disable the reporting system. > deletedb This command will delete all reporting data and cannot be aborted. In some instances it may take several minutes to complete. Please do not attempt a system restart until the command has returned. Are you sure you want to continue? [N]>Y Reseting reporting data...... The reporting system is currently enabled.