[Rspamd-Users] Custom ratelimit: leak value

[neotok at protonmail.com]

Hi,

we have the exact same issue. We also interprete the ratelimit "A / B" as A the bucket size and B as the reciprocal rate after which A has been emptied. But we found after some debugging and logging that B is the reciprocal rate at which 1 (one!) mail has been freed from the bucket.

Either this is a bug or a massive misinterpretation >)



‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
Am Dienstag, 30. Oktober 2018 13:17 schrieb Michael Kliewe <m.kliewe at team.mail.de>:

> Hi there,
>
> I have a custom ratelimit configured which is working (it returns the
> correct ratelimit string), but I don't understand the number of leaked
> mails. See these log entries of 2 sent mails:
>
> 2018-10-30 12:54:52 #7153(rspamd_proxy) <8fxrhw>; lua;
> custom_ratelimit.lua:25: Checking user f.lastname at domain.de ratelimit
> 2018-10-30 12:54:52 #7153(rspamd_proxy) <8fxrhw>; lua;
> custom_ratelimit.lua:38: User f.lastname at domain.de is testinghigh,
> returning custom ratelimit 15000 / 1d
> 2018-10-30 12:54:52 #7153(rspamd_proxy) <97eaaf>; ratelimit;
> ratelimit.lua:613: check limit
> mde_sending_volume:rs_mde_testinghigh_sending_volume_f.lastname at domain.de
> -> RL6o66jndia93e1xx4z4xsszg1 (15000/0.000012)
> 2018-10-30 12:54:52 #7153(rspamd_proxy) <97eaaf>; ratelimit;
> ratelimit.lua:568: got reply for limit
> rs_mde_testinghigh_sending_volume_f.lastname at domain.de (15000 /
> 0.000012); 63.084257930684 burst, 5.0131:5.2671 dyn, 0.12668701326505 leaked
> 2018-10-30 12:54:52 #7153(rspamd_proxy) <97eaaf>; ratelimit;
> ratelimit.lua:644: updated limit
> mde_sending_volume:rs_mde_testinghigh_sending_volume_f.lastname at domain.de
> -> RL6o66jndia93e1xx4z4xsszg1 (15000/0.000012), burst: 63.084257930684,
> dyn_rate: 5.0131, dyn_burst: 5.372442
>
> 2018-10-30 12:56:11 #7153(rspamd_proxy) <8fxrhw>; lua;
> custom_ratelimit.lua:25: Checking user f.lastname at domain.de ratelimit
> 2018-10-30 12:56:11 #7153(rspamd_proxy) <8fxrhw>; lua;
> custom_ratelimit.lua:38: User f.lastname at domain.de is testinghigh,
> returning custom ratelimit 15000 / 1d
> 2018-10-30 12:56:11 #7153(rspamd_proxy) <e207be>; ratelimit;
> ratelimit.lua:613: check limit
> mde_sending_volume:rs_mde_testinghigh_sending_volume_f.lastname at domain.de
> -> RL6o66jndia93e1xx4z4xsszg1 (15000/0.000012)
> 2018-10-30 12:56:11 #7153(rspamd_proxy) <e207be>; ratelimit;
> ratelimit.lua:568: got reply for limit
> rs_mde_testinghigh_sending_volume_f.lastname at domain.de (15000 /
> 0.000012); 64.079641585057 burst, 5.0131:5.3724 dyn, 0.0046163456273148
> leaked
> 2018-10-30 12:56:12 #7153(rspamd_proxy) <e207be>; ratelimit;
> ratelimit.lua:644: updated limit
> mde_sending_volume:rs_mde_testinghigh_sending_volume_f.lastname at domain.de
> -> RL6o66jndia93e1xx4z4xsszg1 (15000/0.000012), burst: 64.079641585057,
>
> dyn_rate: 5.0131, dyn_burst: 5.479848
>
> The custom_ratelimit.lua returns "15000 / 1d" for that user. If I
> understand the "new format" correctly, it means the bucket starts at
> 15000, and leaks 15000 per day. So you can send 15000 mails per day.
>
> From the documentation: https://rspamd.com/doc/modules/ratelimit.html
> From version 1.5 it is also possible to define limits in a simplified
> form: bounce_to = "2 / 5m";
> The line above defines a bucket with a size of 2 and a leak rate of 2
> message in 5 minutes (so 2 messages will be allowed per 5 minute period).
>
> My custom_ratelimit.lua looks like this (just adapted a bit from the
> documentation page):
>
> local crl = "15000 / 1d"
> rspamd_logger.infox(rspamd_config, "User %s is testinghigh, returning
> custom ratelimit %s", user, crl)
> return "rs_mde_testinghigh_sending_volume_" .. user, crl
>
> What I don't understand: Why has there been nearly no mail leaked? It
> looks like only 0.0046 mails have leaked during these 79 seconds (see
> second-last log entry above). I would have expected that 15000/8640079
> = 13.72 mails should have leaked during that time period.
> In the logfiles there is "0.000012", which is the leak rate per second?
> That would mean it's 1 mail per day (0.00001286400 = 1). The leak rateshould be 15000/86400 = 0.17361111111 per second for "15000 / 1d". Or am
> I wrong?
>
> Maybe someone can explain me how this ratelimit works, and what I'm
> doing wrong here.
>
> Michael
>
> -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Users mailing list
> Users at lists.rspamd.com
> https://lists.rspamd.com/mailman/listinfo/users