[Rspamd-Users] Custom ratelimit: leak value

[Michael Kliewe]

Hi there,

I have a custom ratelimit configured which is working (it returns the
correct ratelimit string), but I don't understand the number of leaked
mails. See these log entries of 2 sent mails:


2018-10-30 12:54:52 #7153(rspamd_proxy) <8fxrhw>; lua;
custom_ratelimit.lua:25: Checking user f.lastname at domain.de ratelimit
2018-10-30 12:54:52 #7153(rspamd_proxy) <8fxrhw>; lua;
custom_ratelimit.lua:38: User f.lastname at domain.de is testinghigh,
returning custom ratelimit 15000 / 1d
2018-10-30 12:54:52 #7153(rspamd_proxy) <97eaaf>; ratelimit;
ratelimit.lua:613: check limit
mde_sending_volume:rs_mde_testinghigh_sending_volume_f.lastname at domain.de
-> RL6o66jndia93e1xx4z4xsszg1 (15000/0.000012)
2018-10-30 12:54:52 #7153(rspamd_proxy) <97eaaf>; ratelimit;
ratelimit.lua:568: got reply for limit
rs_mde_testinghigh_sending_volume_f.lastname at domain.de (15000 /
0.000012); 63.084257930684 burst, 5.0131:5.2671 dyn, 0.12668701326505 leaked
2018-10-30 12:54:52 #7153(rspamd_proxy) <97eaaf>; ratelimit;
ratelimit.lua:644: updated limit
mde_sending_volume:rs_mde_testinghigh_sending_volume_f.lastname at domain.de
-> RL6o66jndia93e1xx4z4xsszg1 (15000/0.000012), burst: 63.084257930684,
dyn_rate: 5.0131, dyn_burst: 5.372442

2018-10-30 12:56:11 #7153(rspamd_proxy) <8fxrhw>; lua;
custom_ratelimit.lua:25: Checking user f.lastname at domain.de ratelimit
2018-10-30 12:56:11 #7153(rspamd_proxy) <8fxrhw>; lua;
custom_ratelimit.lua:38: User f.lastname at domain.de is testinghigh,
returning custom ratelimit 15000 / 1d
2018-10-30 12:56:11 #7153(rspamd_proxy) <e207be>; ratelimit;
ratelimit.lua:613: check limit
mde_sending_volume:rs_mde_testinghigh_sending_volume_f.lastname at domain.de
-> RL6o66jndia93e1xx4z4xsszg1 (15000/0.000012)
2018-10-30 12:56:11 #7153(rspamd_proxy) <e207be>; ratelimit;
ratelimit.lua:568: got reply for limit
rs_mde_testinghigh_sending_volume_f.lastname at domain.de (15000 /
0.000012); 64.079641585057 burst, 5.0131:5.3724 dyn, 0.0046163456273148
leaked
2018-10-30 12:56:12 #7153(rspamd_proxy) <e207be>; ratelimit;
ratelimit.lua:644: updated limit
mde_sending_volume:rs_mde_testinghigh_sending_volume_f.lastname at domain.de
-> RL6o66jndia93e1xx4z4xsszg1 (15000/0.000012), burst: 64.079641585057,
dyn_rate: 5.0131, dyn_burst: 5.479848


The custom_ratelimit.lua returns "15000 / 1d" for that user. If I
understand the "new format" correctly, it means the bucket starts at
15000, and leaks 15000 per day. So you can send 15000 mails per day.

>From the documentation: https://rspamd.com/doc/modules/ratelimit.html
>From version 1.5 it is also possible to define limits in a simplified
form: bounce_to = "2 / 5m";
The line above defines a bucket with a size of 2 and a leak rate of 2
message in 5 minutes (so 2 messages will be allowed per 5 minute period).


My custom_ratelimit.lua looks like this (just adapted a bit from the
documentation page):

local crl = "15000 / 1d"
rspamd_logger.infox(rspamd_config, "User %s is testinghigh, returning
custom ratelimit %s", user, crl)
return "rs_mde_testinghigh_sending_volume_" .. user, crl


What I don't understand: Why has there been nearly no mail leaked? It
looks like only 0.0046 mails have leaked during these 79 seconds (see
second-last log entry above). I would have expected that 15000/86400*79
= 13.72 mails should have leaked during that time period.

In the logfiles there is "0.000012", which is the leak rate per second?
That would mean it's 1 mail per day (0.000012*86400 = 1). The leak rate
should be 15000/86400 = 0.17361111111 per second for "15000 / 1d". Or am
I wrong?

Maybe someone can explain me how this ratelimit works, and what I'm
doing wrong here.

Michael