RSPAMD_STATS

NAME

rspamd_stats - analyze Rspamd rules by parsing log files

SYNOPSIS

rspamd_stats [options] [--symbol=SYM1 [--symbol=SYM2...]] [--log file]

DESCRIPTION

rspamd_stats will read the given log file (or standard input) and provide statistics for the specified symbols:

Symbol: BAYES_SPAM (weight 3.763) (381985 hits, 26.827%)
Ham hits: 184557 (48.315%), total ham: 1095487 (ham with BAYES_SPAM: 16.847%)
Spam hits: 15134 (3.962%), total spam: 16688 (spam with BAYES_SPAM: 90.688%)
Junk hits: 182294 (47.723%), total junk: 311699 (junk with BAYES_SPAM: 58.484%)
Spam changes (ham/junk -> spam): 7026 (1.839%), total percentage (changes / spam hits): 42.102%
Junk changes (ham -> junk): 95192 (24.920%), total percentage (changes / junk hits): 30.540%

Where there are the following attributes:

	•	Weight: average score for a symbols
	•	Total hits: total number of hits and percentage of symbol hits divided by total number of messages
	•	HAM hits: provides the following information about HAM messages with the specified symbol (from left to right):
	1.	total symbol hits: number of messages that has this symbol and are HAM
	2.	ham percentage: number of symbol hits divided by overall HAM messages count
	3.	total ham hits: overall number of HAM messages
	4.	ham with symbol percentage: percentage of number of hits with specified symbol in HAM messages divided by total number of HAM messages.
	•	SPAM hits: provides the following information about SPAM messages - same as previous but for SPAM class.
	•	Junk hits: provides the following information about Junk messages - same as previous but for JUNK class.
	•	Spam changes: displays data about how much messages switched their class because of the specific symbol weight.
	•	Junk changes: displays data about how much messages switched their class because of the specific symbol weight.

OPTIONS

--log

Specifies log file or directory to read data from. If a directory is specified rspamd_stats analyses files in the directory including known compressed file types. Number of log files can be limited using --num-logs and --exclude-logs options. This assumes that files in the log directory have newsyslog(8)- or logrotate(8)-like name format with numeric indexes. Files without indexes (generally it is merely one file) are considered the most recent and files with lower indexes are considered newer.

--reject-score

Specifies the reject (spam) threshold.

--junk-score

Specifies the junk (add header or rewrite subject) threshold.

--alpha-score

Specifies the minimum score for a symbol to be considered by this script.

--symbol

Add symbol or pattern (pcre format) to analyze.

--num-logs

If set, limits number of analyzed logfiles in the directory to the specified value.

--exclude-logs

Number of latest logs to exclude (0 by default).

--correlations

Additionally print correlation rate for each symbol displayed. This routine calculates merely paired correlations between symbols.

--search-pattern

Do not process input unless finding the specified regular expression. Useful to skip logs to a certain position.

--exclude

Exclude log lines if certain symbols are fired (e.g. GTUBE). You may specify this option multiple time to skip multiple symbols.

--start

Select log entries after this time. Format: "YYYY-MM-DD HH:MM:SS" (can be truncated to any desired accuracy). If used with --end select entries between --start and --end. The omitted date defaults to the current date if you supply the time.

--end

Select log entries before this time. Format: "YYYY-MM-DD HH:MM:SS" (can be truncated to any desired accuracy). If used with --start select entries between --start and --end. The omitted date defaults to the current date if you supply the time.

--help

Print a brief help message and exits.

--man

Prints the manual page and exits.

AUTHORS

Vsevolod Stakhov.