Cisco IronPort Email Security Appliance Reporting Data Corruption




I recently experienced an unexpected power down of my IronPort Email Security Appliance which led to the appliance generating an hourly email containing the following:


The Critical message is:

An application fault occurred: ('aggregator/master_aggregator.py _process_export_files|605', "<class 'reporting.aggregator.master_aggregator.ExportProcessError'>", '', '[aggregator/master_aggregator.py main|272] [aggregator/master_aggregator.py watch_incoming_queue|401] [aggregator/master_aggregator.py _process_export_files|605]')
After doing some investigating I noticed that I also wasn’t seeing any of the normal reporting data in the web interface on the appliance. The resolution ended up being quite simple in my case. Here are the steps to delete the reporting database (all your reporting data will be deleted, you’ve been warned).
  1. SSH to the IronPort appliance
  2. Enter diagnostic mode by typing “diagnostic”
  3. Then enter reporting mode by typing “reporting”
  4. Finally type “deletedb”
  5. You’ll be prompted to confirm that you do indeed wish to delete the reporting database

This process took a few minutes on my lab system and then reporting started working again.

Here’s what the process looked like:


ironport.intsystek.com> diagnostic

Choose the operation you want to perform:
- RAID - Disk Verify Utility.
- DISK_USAGE - Check Disk Usage.
- NETWORK - Network Utilities.
- REPORTING - Reporting Utilities.
- TRACKING - Tracking Utilities.
- RELOAD - Reset configuration to the initial manufacturer values.
- SERVICES - Service Utilities.
[]> reporting

The reporting system is currently enabled.

Choose the operation you want to perform:
- DELETEDB - Reinitialize the reporting database.
- DISABLE - Disable the reporting system.
[]> deletedb

This command will delete all reporting data and cannot be aborted. In some instances it may take several minutes to complete. Please do not attempt a system restart until the command has
returned. Are you sure you want to continue? [N]>Y

Reseting reporting data......
The reporting system is currently enabled.

Leave a Reply

Your email address will not be published. Required fields are marked *