09 Feb 2020 Modify Rspamd throughput (RRD) graph

This short post describes how to remove data from Rspamd throughput RRD-graph, usually stored in the rspamd.rrd file. The location depends on the linux distribution, but it is located /var/lib/rspamd/rspamd.rrd on Ubuntu 18.04.

This procedure can most likely be used on all types of RRD-files and is not exclusive for Rspamd.

It is recommended to stop the Rspamd daemon and make a backup of your rspamd.rrd file before you continue.

Backup

$ sudo systemctl stop rspamd.service
$ sudo cp -ax /var/lib/rspamd/rspamd.rrd /var/lib/rspamd/rspamd.rrd-$(date -I)

We have now created a backup file of our RRD-file.

Dump RRD-file

Next we need to create a dump of the RRD-file to a XML-file before we can do any modifications on the data.

$ sudo rrdtool dump /var/lib/rspamd/rspamd.rrd /tmp/rspamd.rrd.xml

Editing

The XML-file of the RRD-file is now stored in /tmp/rspamd.rrd-xml and can be edited with your preferred editor.

I removed several months of empty data points by searching them up and deleting the lines I did not want.
The values I deleted were inside the <database> tags like this

            <database>
                    <!-- 2019-02-08 23:00:00 CET / 1549663200 --> <row><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v></row>
                    <!-- 2019-02-09 00:00:00 CET / 1549666800 --> <row><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v></row>
                    <!-- 2019-02-09 01:00:00 CET / 1549670400 --> <row><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v></row>
                    <!-- 2019-02-09 02:00:00 CET / 1549674000 --> <row><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v><v>NaN</v></row>
...

One thing to note is that the structure of the RRD XML-file is not cronological, you cannot assume the oldest data is at the beginning or end of the file.

Restore RRD-file

Restore the modified RRD-file and start rspamd

$ sudo rm -f /var/lib/rspamd/rspamd.rrd && \
rrdtool restore -f /tmp/rspamd.rrd.xml /var/rsamd/rspamd.rrd && \
chown _rspamd:_rspamd /var/rspamd/rspamd.rrd
$ sudo systemctl start rspamd.service

Check if Rspamd complains

$ sudo tail -f /var/log/rspamd/rspamd.log 

You either have wrong file permission og done something wrong with the RRD-file uf you see the following error

...
2020-02-08 22:51:24 #15878(controller) ; csession; rspamd_controller_handle_graph: no rrd configured
...

Restore backup

This is the procedure if you made a mistanke and want to restore your backup (you did remember to create a backup before you started?).

Stop rspamd daemon and restore your RRD-backup. I assume you are doing this the same day you created a backup file.

$ sudo systemctl stop rspamd.service
$ sudo cp -ax /var/lib/rspamd/rspamd.rrd-$(date -I) /var/lib/rspamd/rspamd.rrd
$ sudo systemctl start rspamd

Check you rspamd.log and see if you have any error messages

$ sudo systemctl status rspamd.service
$ sudo tail -f /var/log/rspamd/rspamd.log

And thats all.

Tags: backup, dump, edit, restore, rrd, rrdtool, rspamd, xml

Posted by Hans-Henry Jakobsen