[Rspamd-Users] Multimap is not fully executed on replica system

[Max Grobecker]

Hi,

I have two Rspamd servers running.
They are "connected" with two replicated Redis instances (one for Fuzzy and Neural, one for Bayes),
also they got a standalone, not replicated local Redis instance.
On both servers I'm running on Rocky Linux 8, Rspamd 3.1 from Rspamd repository.

Also, I have some Multimap rules, which used to work on both servers but for some odd reason,
some of the Multimap rules are not applied any more on the second server.
My "multimap.conf" along with the map files are synced from Server 1 to Server 2 via Rsync,
so the files are 100% identical on both systems.
I'm not using Redis to store rules or maps.


With verbose logging turned on I can see, the rules are parsed correctly on startup.
But when checking mail, not all rules are even called - they are just seemingly skipped. At least,
they are not even mentioned in the logs.


For example, I have these two rules defined:

spammy_subject_blacklist {
    type = "header";
    header = "subject";
    map = "${CONFDIR}/local.d/maps.d/spammy_subjects.regexp";
    symbol = "SPAMMY_SUBJECT_BLACKLISTED";
    regexp = true;
}


hostname_blacklist {
    type = "header";
    header = "from";
    header = "reply-to";
    header = "sender";
    filter = "email:domain:tld";
    map = "${CONFDIR}/local.d/maps.d/blacklist_hostnames.map";
    symbol = "RECEIVED_HOSTNAME_BLACKLISTED";
}


Both of them are working totally fine on the first server.
On the second server, only the first rule is executed, the second one is simply skipped.
These two rules are just an extract. I have about 30 rules defined, but only 12-15 of them are executed on the second server.
And as said, the map worked seemingly fine for a couple of days and stopped working at some point. Presumably, but this is not for sure,
after I added some entries to the maps and synced the file over to the second server.

I can't see any error messages in the logs, also, "rspamadm configtest" says, it's all fine.
And since both servers are using the exact same configuration I can't see an obvious reason like bad syntax.


Does anyone have a tip for me on what to look deeper to find the root of the problem?



Thanks!

Max