This short post describes how to remove data from Rspamd throughput RRD-graph, usually stored in the rspamd.rrd file. The location depends on the linux distribution, but it is located /var/lib/rspamd/rspamd.rrd on Ubuntu 18.04.

This procedure can most likely be used on all types of RRD-files and is not exclusive for Rspamd.

It is recommended to stop the Rspamd daemon and make a backup of your rspamd.rrd file before you continue.

Backup

$ sudo systemctl stop rspamd.service
$ sudo cp -ax /var/lib/rspamd/rspamd.rrd /var/lib/rspamd/rspamd.rrd-$(date -I)

We have now created a backup file of our RRD-file.

Dump RRD-file

Next we need to create a dump of the RRD-file to a XML-file before we can do any modifications on the data.

$ sudo rrdtool dump /var/lib/rspamd/rspamd.rrd /tmp/rspamd.rrd.xml

Structure of the RRD-file

The Rspamd file is the basis for the graphs and are ordered in archives based on the datasets By day, By week, By Month and By year and you will find the same structure in the rrd-file if you search for 60, 300 600 or 3600 seconds.

    <!-- Round Robin Archives -->
    <rra>
            <cf>AVERAGE</cf>
            <pdp_per_row>60</pdp_per_row> <!-- 60 seconds -->

            <cf>AVERAGE</cf>
            <pdp_per_row>300</pdp_per_row> <!-- 300 seconds -->

            <cf>AVERAGE</cf>
            <pdp_per_row>600</pdp_per_row> <!-- 600 seconds -->

            <cf>AVERAGE</cf>
            <pdp_per_row>3600</pdp_per_row> <!-- 3600 seconds -->

Editing

The XML-file of the RRD-file is now stored in /tmp/rspamd.rrd-xml and can be edited with your preferred editor.

I removed several months of empty data points by searching them up and deleting the lines I did not want.
The values I deleted were inside the <database> tags like this

            <database>
                    <!-- 2019-02-08 23:00:00 CET / 1549663200 --> <row><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v></row>
                    <!-- 2019-02-09 00:00:00 CET / 1549666800 --> <row><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v></row>
                    <!-- 2019-02-09 01:00:00 CET / 1549670400 --> <row><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v></row>
                    <!-- 2019-02-09 02:00:00 CET / 1549674000 --> <row><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v></row>
...

Restore RRD-file

Restore the modified RRD-file and start rspamd

$ sudo rm -f /var/lib/rspamd/rspamd.rrd && \
rrdtool restore -f /tmp/rspamd.rrd.xml /var/lib/rspamd/rspamd.rrd && \
chown _rspamd:_rspamd /var/lib/rspamd/rspamd.rrd
$ sudo systemctl start rspamd.service

Check if Rspamd complains

$ sudo tail -f /var/log/rspamd/rspamd.log 

You either have wrong file permission og done something wrong with the RRD-file uf you see the following error

...
2020-02-08 22:51:24 #15878(controller) ; csession; rspamd_controller_handle_graph: no rrd configured
...

Restore backup

This is the procedure if you made a mistanke and want to restore your backup (you did remember to create a backup before you started?).

Stop rspamd daemon and restore your RRD-backup. I assume you are doing this the same day you created a backup file.

$ sudo systemctl stop rspamd.service
$ sudo cp -ax /var/lib/rspamd/rspamd.rrd-$(date -I) /var/lib/rspamd/rspamd.rrd
$ sudo systemctl start rspamd

Check you rspamd.log and see if you have any error messages

$ sudo systemctl status rspamd.service
$ sudo tail -f /var/log/rspamd/rspamd.log

And thats all.