I was attempting to create a subscription to notify assigned to users that their incident has gone stale, and apparently botched my criteria. SM started sending out notifications on all Incidents older than 7 days regardless of their current status. I've disabled the SMTP notification channel, but how do I go about clearing the queued emails so I can turn it back on? 

Also, what did i do wrong with my subscription criteria? 
Incident- lastmodified is greater than [now-7d] AND Incident - Status 'does not equal' closed OR Incident - Status 'does not equal' resolved. 

I'm not sure how to clear the queued emails..Personally, I would just delete the subscription.

As for your criteria, change "Or" to "And". You'll probably need to change it in the management pack XML itself..I don't think you can change it in the console.

If you don't want to mess with the MP XML, change the criteria to:

...AND Incident.status = "in progress" OR incident.status = "on hold" OR ... for all status values except closed and resolved.

• Marked as answer by STL_ITdude Thursday, January 22, 2015 2:18 AM

Not sure why it would send out on incidents modified before 7 days ago, but you botched your status criteria. Let's say that status is closed. You do not want to send on that BUT the criteria Incident status does not equal resolved evaluates to true, because, well, it is NOT resolved. The other criteria is false, but false OR true = true.

Yeah, I see where its double qualifying since it only uses AND on the first and adds additional ORs. So the only way to get double ANDs is to custom edit the XML? Does someone have a link to an example on how to edit the MPs XML? 

The first thing I did was delete the subscription, but it just continued to spew out emails. I've deleted it and based on your guys suggestions will correct my subscription criteria, but I still have hundreds of emails queued up and the minute I turn the SMTP connector back on they continue.