14.3.2. Configuring quarantine cleanup

Quarantine cleanup on a host can be configured from the Quarantine tab of the given Host component in MC. This interface can be used to create rules that determine when are objects deleted from the quarantine.

Configuring quarantine cleanup rules

Figure 14.33. Configuring quarantine cleanup rules

The main section of the tab displays the currently effective rules (including disabled ones), and the control buttons for managing (creating, deleting, and editing) them. A rule consists of a filter that determines the scope (the effected objects) of the rule, and limitations on the storage of such objects. The available filtering expressions are the same as used in the Advanced filter optons of the Quarantine contents panel (see Section 14.3, Quarantine management in MC). The following options can be used to set limitations on the stored objects:

  • Size: Maximum hard disk space used to store the objects. Objects exceeding this limit are deleted (starting with the oldest object).

  • Number of objects: Maximum number of stored objects. Objects exceeding this limit are deleted (starting with the oldest object).

  • Maximum object age: Objects older than the specified value are deleted (starting with the oldest object).

Creating new cleanup rules

Figure 14.34. Creating new cleanup rules

The limitations only apply to the objects matching the set filter expression. For example, setting the filter expression to Result-Virus matches X and the Size limit to 256 MBytes means that a maximum of 256 MBytes of objects will be stored in the quarantine that are infected with the X virus.

Tip

The limitations are global if no filter is specified.

Rules are evaluated and executed sequentially; if contradicting rules are found, the strictest one will be effective.