This short post describes how to remove data from Rspamd throughput RRD-graph, usually stored in the rspamd.rrd file. The location depends on the linux distribution, but it is located /var/lib/rspamd/rspamd.rrd on Ubuntu 18.04.
This procedure can most likely be used on all types of RRD-files and is not exclusive for Rspamd.
It is recommended to stop the Rspamd daemon and make a backup of your rspamd.rrd file before you continue.
$ sudo systemctl stop rspamd.service $ sudo cp -ax /var/lib/rspamd/rspamd.rrd /var/lib/rspamd/rspamd.rrd-$(date -I)
We have now created a backup file of our RRD-file.
Next we need to create a dump of the RRD-file to a XML-file before we can do any modifications on the data.
$ sudo rrdtool dump /var/lib/rspamd/rspamd.rrd /tmp/rspamd.rrd.xml
The XML-file of the RRD-file is now stored in /tmp/rspamd.rrd-xml and can be edited with your preferred editor.
I removed several months of empty data points by searching them up and deleting the lines I did not want.
The values I deleted were inside the <database> tags like this
<database> <!-- 2019-02-08 23:00:00 CET / 1549663200 --> <row><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v></row> <!-- 2019-02-09 00:00:00 CET / 1549666800 --> <row><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v></row> <!-- 2019-02-09 01:00:00 CET / 1549670400 --> <row><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v></row> <!-- 2019-02-09 02:00:00 CET / 1549674000 --> <row><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v></row> ...
One thing to note is that the structure of the RRD XML-file is not cronological, you cannot assume the oldest data is at the beginning or end of the file.
Restore the modified RRD-file and start rspamd
$ sudo rm -f /var/lib/rspamd/rspamd.rrd && \ rrdtool restore -f /tmp/rspamd.rrd.xml /var/rsamd/rspamd.rrd && \ chown _rspamd:_rspamd /var/rspamd/rspamd.rrd $ sudo systemctl start rspamd.service
Check if Rspamd complains
$ sudo tail -f /var/log/rspamd/rspamd.log
You either have wrong file permission og done something wrong with the RRD-file uf you see the following error
... 2020-02-08 22:51:24 #15878(controller) ; csession; rspamd_controller_handle_graph: no rrd configured ...
This is the procedure if you made a mistanke and want to restore your backup (you did remember to create a backup before you started?).
Stop rspamd daemon and restore your RRD-backup. I assume you are doing this the same day you created a backup file.
$ sudo systemctl stop rspamd.service $ sudo cp -ax /var/lib/rspamd/rspamd.rrd-$(date -I) /var/lib/rspamd/rspamd.rrd $ sudo systemctl start rspamd
Check you rspamd.log and see if you have any error messages
$ sudo systemctl status rspamd.service $ sudo tail -f /var/log/rspamd/rspamd.log
And thats all.
Tags: backup, dump, edit, restore, rrd, rrdtool, rspamd, xml
Posted by Hans-Henry Jakobsen