How to delete the scan results in Imunify360’s database

Sometimes, you may need to delete all users’ scan results from the server. This should not be common practice, and we do not recommend doing it on a regular basis. But, if you do need to erase the results of all Imunify360 scans, you can find the instructions below.

1. First, you need to stop the agent:
   

   systemctl stop imunify360

   (on CentOS 7)
   

   service imunify360 stop

   (on CentOS 6, Ubuntu)
   
   
2. and connect to the Imunify360 database by running this command:
   

   sqlite3 /var/imunify360/imunify360.db

   
   
   
3. Next, execute the following SQL commands.
   IMPORTANT: This removes all scan results from Imunify360!
   
   

   DELETE FROM malware_history;
   DELETE FROM malware_hits;
   DELETE FROM malware_scans;
   DELETE FROM malware_user_infected;
   
   

4. Lastly, start the agent:
   

   systemctl start imunify360

   (on CentOS 7)
   

   service imunify360 start

   (on CentOS 6, Ubuntu)
   
   

We don’t recommend cleaning the scan results for specific users, as it may cause inconsistencies in the malware_scans table. But, in emergencies, you can do it with these SQL commands:

DELETE FROM malware_history WHERE file_onwer = <user>;
DELETE FROM malware_hits WHERE user = <user>;
DELETE FROM malware_user_infected WHERE user = <user>;

Unfortunately, there’s no easy way to delete records in the malware_scans table for a specific user, so the table should be either truncated with the other tables shown in step 2 above, or the records should just be ignored.

If you need any more information on this or anything else related to Imunify360 administration, please get in touch.