[Rspamd-Users] What is "temporarily rejected" on Throughput page?

[Alexander Moisseev]

On 01.09.2019 15:56, Kai Schaetzl wrote:
> 
> I notice that most greylisting is marked as "soft reject" on the History
> page, but as "greylisting" on the Status and Throughput pages. If I select
> "greylist" in the filter box I get "nothing" most of the time, because
> most greylisting is marked as soft reject. This makes for the weird
> situation that I may have 10, 20 or more % greylist on the Status or
> Throughput pages but the History doesn't show a single greylisted item. On
> the other hand the History will show lots of soft rejected messages, but
> Statistics will say there weren't any (Temporarily rejected), which is a
> sense correct, of course.
> 
> Shouldn't these figures be the same accross the various tabs? e.g. if it
> was greylisted it should have the greylist label in the History and not
> the soft reject label. All other soft reject actions should have soft
> reject.
> 
> It looks to me like the only messages that get marked with a greylist
> label are those scoring exactly 4.00 = the (default) score for
> greylisting. Any new message above that threshold gets a soft reject
> instead of a greylist. Or, more exactly, it might be those messages that
> score high enough that they would trigger another action (rewrite_subject
> or add_header) if not greylisted first. Is this the distinction between
> the two? It's confusing.
> 
Actually, messages that have passed greylisting get label "greylist" if the actual action is "no action". I agree it is confusing and should be changed.

> A related question:
> Which messages exactly get counted as "greylisted" on the Throughput page?
> Are it all messages regardless of the later action (= duplicate counting)?
> Or do you deduct all messages that trigger another action later?
> 
RRD (Throughput backend) counts each scanned message according to the action, that should exactly match action in the rspamd log ("rspamd_task_write_log:" line). It counts not unique messages, but message scans.

> Simple example:
> Greylisted: 100
> Clean: 100
> 
> Are these 100 messages that were greylisted but ultimately found to be
> clean? Or are these 100 greylisted messages where there was no second
> attempt of delivery? In other words: is the "Total messages" count a
> unique count or does it count messages twice (e.g. 1. grey list, 2.
> another action if it gets delivered a second time)?
>
Not exactly twice. In case of greylisting a new message counted as "soft reject", then as "soft reject" each time when(if) it comes again too early and as "no action (clean)" when(if) it finally passes greylisting.
  
"Total messages" is a sum of the actions counters. So it counts message scans too, i.e. every time Rspamd processed a message.