Deleting one attachment

RT Users
1

Hi all,
A user at work added an attachment that violates corporate policy to a
ticket; the ticket itself is valid and must be kept. I need to delete the
attachment. A quick look at the rt-shredder tool does not make it apparent
to me how to do this with rt-shredder. I can readily do it editing the db
in mysql but I’d rather use rt-shredder if it will do the job.
any help?
thanks
Ram

2

Hi all,
A user at work added an attachment that violates corporate policy to a
ticket; the ticket itself is valid and must be kept. I need to delete the
attachment. A quick look at the rt-shredder tool does not make it apparent
to me how to do this with rt-shredder. I can readily do it editing the db in
mysql but I’d rather use rt-shredder if it will do the job.
any help?

Running 4.2.12 here…

/opt/rt4/sbin/rt-shredder --plugin list

Plugins list:
Objects
SQLDump
Summary
Tickets
Attachments
Users

So it looks like it can shred attachments.

/opt/rt4/sbin/rt-shredder --plugin help-Attachments
USAGE
masks
If any argument is marked with keyword `mask’ then it means that this
argument support two special characters:

1) `*' matches any non empty sequence of the characters. For example
`*@example.com' will match any email address in `example.com' domain.

2) `?' matches exactly one character. For example `????' will match any
string four characters long.

NAME
RT::Shredder::Plugin::Attachments - search plugin for wiping
attachments.

ARGUMENTS
files_only - boolean value
Search only file attachments.

file - mask
Search files with specific file name only.

Example: '*.xl?' or '*.gif'

longer - attachment content size
Search attachments which content is longer than specified. You can use
trailing ‘K’ or ‘M’ character to specify size in kilobytes or megabytes.

Then perhaps something like:

/opt/rt4/sbin/rt-shredder --plugin
Attachments=files_only,1;file,some_secret_document.pdf

I didn’t try the above and I would for sure try it on a test system
first - at least a test ticket with a test attachment.

-m

3

Inline…On Wed, Oct 19, 2016 at 9:39 AM, Matt Zagrabelny mzagrabe@d.umn.edu wrote:

On Wed, Oct 19, 2016 at 11:28 AM, Ram ram0502@gmail.com wrote:

Hi all,
A user at work added an attachment that violates corporate policy to a
ticket; the ticket itself is valid and must be kept. I need to delete the
attachment. A quick look at the rt-shredder tool does not make it
apparent
to me how to do this with rt-shredder. I can readily do it editing the
db in
mysql but I’d rather use rt-shredder if it will do the job.
any help?

Then perhaps something like:

/opt/rt4/sbin/rt-shredder --plugin
Attachments=files_only,1;file,some_secret_document.pdf

Thanks Matt. I did look at that - the problem is that DOC009.pdf is far
from unique in our system. What I really need is to specify the ticket id,
attachment id , or both. specifying a minimum size might work - I’d have
to check and see if that’s the only DOC009.pdf over 75kb but I wouldn’t be
surprised if there are others.

4

Inline…

A user at work added an attachment that violates corporate policy to a
ticket; the ticket itself is valid and must be kept. I need to delete the
attachment. A quick look at the rt-shredder tool does not make it apparent
to me how to do this with rt-shredder. I can readily do it editing the db
in
mysql but I’d rather use rt-shredder if it will do the job.
any help?

I’ll be going with a direct DB edit which I’m documenting here for the next
person. Since I just want to suppress the file and do not want to hide the
fact that it existed. Here is what I did, be very careful! If you don’t
know SQL or you don’t understand every step below then find someone else to
help you - this is the WRONG PATH for you:

1 Get the attachment id of the attachment to remove (as of RT 4.4.1 it’s
the second number in the URL that displays the attachment).

2 Add a comment to the ticket indicating that you are deleting the
offending attachment for policy violation (or whatever you motive).

3 Run this command to improve your odds of not messing up and deleting the
wrong transaction:

select id, Transactionid, MessageId, Subject, Filename, ContentType,
ContentEncoding, Headers, Creator, Created from Attachments where id=
ATTACHMENT_ID_FROM_STEP_1 \G

4 If that looks right to you then run this SQL against A TEST COPY OF YOUR
DB to ensure you are killing the right attachment

update Attachments set Content = NULL where id =
ATTACHMENT_ID_FROM_STEP_1 limit 1;

5 Go look at the ticket in RT and ensure that you did indeed eliminate the
offending attachment.

6 Repeat steps 3,4,5 in your production environment.

7 Do not call me if you shot yourself in the foot. No warranty expressed or
implied!

If this isn’t perfectly clear, hire Best Practical (
https://bestpractical.com/) to do it for you.

cheers,

Ram

5

?Hello,

Sorry for not seeing this sooner, but I’ll leave this for people wondering about the same in the future.

We have sucessfully deleted single attachments from a ticket using rt-shredder. Issue the command like this;

rt-shredder --plugin ‘Objects=Attachment,?’

We use RT 4.2.8.

Med vennlig hilsen,
Thomas Oddsund
SDS/USITFra: rt-users rt-users-bounces@lists.bestpractical.com på vegne av Ram ram0502@gmail.com
Sendt: 25. oktober 2016 01:45
Til: rt-users
Emne: Re: [rt-users] Deleting one attachment

Inline…

A user at work added an attachment that violates corporate policy to a
ticket; the ticket itself is valid and must be kept. I need to delete the
attachment. A quick look at the rt-shredder tool does not make it apparent
to me how to do this with rt-shredder. I can readily do it editing the db in
mysql but I’d rather use rt-shredder if it will do the job.
any help?

I’ll be going with a direct DB edit which I’m documenting here for the next person. Since I just want to suppress the file and do not want to hide the fact that it existed. Here is what I did, be very careful! If you don’t know SQL or you don’t understand every step below then find someone else to help you - this is the WRONG PATH for you:

1 Get the attachment id of the attachment to remove (as of RT 4.4.1 it’s the second number in the URL that displays the attachment).

2 Add a comment to the ticket indicating that you are deleting the offending attachment for policy violation (or whatever you motive).

3 Run this command to improve your odds of not messing up and deleting the wrong transaction:

select id, Transactionid, MessageId, Subject, Filename, ContentType, ContentEncoding, Headers, Creator, Created from Attachments where id= ATTACHMENT_ID_FROM_STEP_1 \G

4 If that looks right to you then run this SQL against A TEST COPY OF YOUR DB to ensure you are killing the right attachment

update Attachments set Content = NULL where id = ATTACHMENT_ID_FROM_STEP_1 limit 1;

5 Go look at the ticket in RT and ensure that you did indeed eliminate the offending attachment.

6 Repeat steps 3,4,5 in your production environment.

7 Do not call me if you shot yourself in the foot. No warranty expressed or implied!

If this isn’t perfectly clear, hire Best Practical (https://bestpractical.com/) to do it for you.

cheers,

Ram

6

Sorry for not seeing this sooner, but I’ll leave this for people wondering
about the same in the future.

We have sucessfully deleted single attachments from a ticket using
rt-shredder. Issue the command like this;

rt-shredder --plugin ‘Objects=Attachment,​’

This is what I expected to be able to do but it’s not on the web docs nor
the built-in USAGE. Guess I could’ve read through the code to confirm.
Thanks for follow up here Thomas!

Confirmed this works on rt 4.4.1.

br,
ram