Rspamd logging settings

Here is the description of Rspamd logging settings.

Introduction

Rspamd has a number of logging options. Firstly, there are three types of log output that are supported: console logging - just output log messages to console, file logging - output log messages to a file and logging via syslog daemon. It is also possible to restrict logging to a specific level:

It is possible to turn on debug messages for specific IP addresses. This can be useful for testing. For each logging type there are special mandatory parameters: log facility for syslog (read syslog(3) man page for details about facilities), log file for file logging. Also, file logging may be buffered for performance. To reduce logging noise, Rspamd detects sequential matching log messages and replaces them with a total number of repeats:

#81123(fuzzy): May 11 19:41:54 rspamd file_log_function: Last message repeated 155 times
#81123(fuzzy): May 11 19:41:54 rspamd process_write_command: fuzzy hash was successfully added

Unique ID

From version 1.0, Rspamd logs contain a unique ID for each logging message. This allows finding relevant messages quickly. Moreover, there is now a module definition: for example, task or cfg modules. Here is a quick example of how it works: imagine that we have an incoming task for some message. Then you’d see something like this in the logs:

2015-09-02 16:41:59 #45015(normal) <ed2abb>; task; accept_socket: accepted connection from ::1 port 52895
2015-09-02 16:41:59 #45015(normal) <ed2abb>; task; rspamd_message_parse: loaded message; id: <F66099EE-BCAB-4D4F-A4FC-7C15A6686397@FreeBSD.org>; queue-id: <undef>

So the tag is ed2abb in this case. All subsequent processing related to this task will have the same tag. It is enabled not only on the task module, but also others, such as the spf or lua modules. For other modules, such as cfg, the tag is generated statically using a specific characteristic, for example the configuration file checksum.

Configuration parameters

Here is the summary of logging parameters, each of those can be redefined or defined in local.d/logging.inc file:

Defined debug modules

Here is a list of C debug modules defined in Rspamd (this list is usually incomplete):

Any Lua module can also be added to debug_modules as they are using somehow a similar naming semantics. E.g. you can use dkim_signing or multimap or lua_tcp to debug the corresponding modules.

Log format

Rspamd supports a custom log format when writing information about a message to the log. (This feature is supported since version 1.1.) The format string looks as follows:

log_format =<<EOD
id: <$mid>,$if_qid{ qid: <$>,}$if_ip{ ip: $,}$if_user{ user: $,}$if_smtp_from{ from: <$>,}
(default: $is_spam ($action): [$scores] [$symbols]),
len: $len, time: $time_real real,
$time_virtual virtual, dns req: $dns_req
EOD

Newlines are replaced with spaces. Both text and variables are supported in the log format line. Each variable can have an optional if_ prefix, which will log only if it is triggered. Moreover, each variable can have an optional body value, where $ is replaced with the variable value (as many times as it is found in the body, e.g. $if_var{$$$$} will be replaced with the variable’s name repeated 4 times).

Log variables

Rspamd supports the following log variables:

Custom logging scripts could look like the following:

$lua{
  return function(task) 
    return 'text parts: ' .. tostring(#task:get_text_parts()) 
  end
}

this script will log number of text part in messages.