[Rspamd-Users] setting log levels

[Sophie Loewenthal]

> On 1 May 2019, at 23:43, Tim Harman via Users <users at lists.rspamd.com> wrote:
> 
> On 02/05/2019 7:39 am, Sophie Loewenthal wrote:
> 
>> Hi and thanks.  I meant to write I’m using 1.9.2.  I’ll try and adapt
>> this to debug for everything.
> 
> Logging help is here: https://rspamd.com/doc/configuration/logging.html
> It has all the detail you should need.
> 
> By default you'll have this:
> 
> -!- ~ » rspamadm configdump logging
> *** Section logging ***
> filename = "/var/log/rspamd/rspamd.log";
> log_format = <<EOD
> id: <$mid>,$if_qid{ qid: <$>,}$if_ip{ ip: $,}$if_user{ user: $,}$if_smtp_from{ from: <$>,}
> (default: $is_spam ($action): [$scores] [$symbols_scores_params]),
> len: $len, time: $time_real real, $time_virtual virtual, dns req: $dns_req,
> digest: <$digest>$if_smtp_rcpts{, rcpts: <$>}$if_mime_rcpts{, mime_rcpts: <$>}$if_filename{, file: $}$if_forced_action{, forced: $}
> EOD;
> log_usec = false;
> color = false;
> type = "file";
> debug_modules [
> ]
> log_re_cache = true;
> level = "info";
> 
> To fully debug everything, you probably want to change level to debug.  Note the documentation says this will cause a large amount of logging.
> in /etc/rspamd/local.d/logging.inc put
> 
> level = "debug";
> 
> you might also want to put
> debug_modules = ["main"];
> 
> as well to debug any problems with the main module.
> 
> But! Because rspamd is getting a signal to die, are you sure you're not running out of memory on your box?  What does the output of dmesg say? What else is in the system logs (not rspamd)?
> To me this reads like a problem with your linux system running out of memory, or some rogue process killing rspamd, not so much rspamd itself.  Though of course I could be wrong, maybe it is hitting a memory/code bug and crashing.
> 
> Hope this helps.
> 

Hi Tim, 
Thanks for the logging config.,   I did not find any reference to OOM killing it or similar, but I could have missed it. Although I had left rspamd running but not actually processing any messages just to rule out postfix passing it something to crash it: It’s not something coming from the milter ;)  Currently generating 300Mb daily log files :-)