Delete thousands of tickets

[robcar]

Hello,
while I was on vacation for just a week a very dumb environmental monitoring system (by a major brand ) one night sent thousands of mails, alerting about temperature in the data center. Unfortunately one of the recipient was also the mail that OTRS fetches to create tickets.
So tomorrow, when I go back to work, I have to fix things. I got two question.

1) How can I filter senders that can from senders that musn't generate tickets? We use an A.D. LDAP backend for customers, so it would be great if we could limit the permitted senders only to LDAP users.

2) How can I safely and completely delete the thousands (around 2800) of tickets that the dumb monitoring system generated? I don't want to mark them as 'closed' or to have them lying around somewhere in the OTRS system, because they would completely distort statistics and so on.

Thanks in advance.

--
rob

[wurzel]

Hi,

answer for 2
Use generic agent

Flo

[wurzel]

Hi,

Answer for 1

http://otrs.github.io/doc/manual/admin/ ... 6.2.15.3.1

Florian

[robcar]

Thanks,
I'll take a look at the links that you provided.
Now that I'm at work I can have a look at the problem in a clearer way. And the problem seems much worse than what I expected.
It seems that tickets (closed - opened ....) that were present before the thousands of fake tickets were generated are lost!
If I go back to the agent interface I can only see 50 pages of tickets and no sign of previous ones.
I'll take a look at the database and see if it's only a GUI issue.

[robcar]

I'll take a look at the database and see if it's only a GUI issue.

It's not a gui issue, damn.
I checked the MySql db:

Code: Select all

mysql> select title,create_time,queue_id from ticket ORDER BY create_time DESC;

The first ticket is "Welcome to OTRS!" and then I see the first warning of the environmental system; where have the other records gone??

[jojo]

it seems that someone migth changed the database or created a generic agent and deleted the wrong tickets.

[robcar]

In the syslog I see that the system started to fetched mails correctly; then I see these erros:

Code: Select all

....
Jun 22 01:22:47 otrsfaiv OTRS-otrs.Console.pl-Maint::PostMaster::MailAccountFetch-91[25168]: [Error][Kernel::System::CustomerUser::LDAP::CustomerSearch][Line:386]: Conn
essione interrotta dal corrispondente
Jun 22 01:22:47 otrsfaiv OTRS-otrs.Console.pl-Maint::PostMaster::MailAccountFetch-91[25168]: [Error][Kernel::System::CustomerUser::LDAP::CustomerUserDataGet][Line:771]: Pipe interrotta
Jun 22 01:22:47 otrsfaiv OTRS-otrs.Console.pl-Maint::PostMaster::MailAccountFetch-91[25168]: message repeated 2 times: [ [Error][Kernel::System::CustomerUser::LDAP::CustomerUserDataGet][Line:771]: Pipe interrotta]
Jun 22 01:22:47 otrsfaiv OTRS-otrs.Console.pl-Maint::PostMaster::MailAccountFetch-91[25168]: [Error][Kernel::System::CustomerUser::LDAP::CustomerName][Line:251]: Search failed! Pipe interrotta
Jun 22 01:22:47 otrsfaiv OTRS-otrs.Console.pl-Maint::PostMaster::MailAccountFetch-91[25168]: [Error][Kernel::System::CustomerUser::LDAP::CustomerUserDataGet][Line:771]: Pipe interrotta
...

It goes on like this for 40 minutes and then the system reboots, probably caused by a crash of the system.

After the reboot I see many errors like these:

Code: Select all

Jun 22 05:40:09 otrsfaiv OTRS-otrs.Console.pl-Maint::PostMaster::MailAccountFetch-91[3715]: [Error][Kernel::System::Daemon::DaemonModules::BaseTaskWorker::_HandleError][Line:51]: There was an error executing Execute() in Kernel::System::Console::Command::Maint::PostMaster::MailAccountFetch: Error: Unable to register the process in the database. Is another instance still running?#012You can use --force-pid to override this check.

[robcar]

it seems that someone migth changed the database or created a generic agent and deleted the wrong tickets.

I don't think so; I'm the only one in charge with OTRS here. What I fear is that the crash of the system destroyed somehow my db. Is it possible? How can I verify that?

I'd like to try a restore of the previous week; can I safely follow these instructions?
https://otrs.github.io/doc/manual/admin ... ml#restore

Or do I have to stop services, drop tables ....before? Thanks.

[robcar]

Eventually I did a restore of a previous backup.

In doing that I got problems, so I'll open a new thread.