Some emails got old score

[weifengding]

I lowered the scores for all maps a week ago on my Rspamd server. All the scores were showing correctly in Rspamd history except two maps gave old score instead of the new one.

For example:

On 01/11/2023, 13:33:23, this incoming email got SCAM_EN (10)
    On 02/11/2023, 15:45:38, another incoming email sent to same client got SCAM_EN (20)
    On 02/11/2023, 22:23:12, a new email got SCAM_EN (10) again

nothing was changed during those time, I run "rspamadm configdump" on the server and can confirm it's SCAM_EN (10).

-rw-r--r-- 1 root root 1.3K Oct 23 14:25 /etc/rspamd/local.d/_multimap_scam.conf
scam_en { type = "content"; filter = "oneline"; regexp = true; map = "https://raw.githubusercontent.com/martinschaible/rspamd-rules/main/maps.d/_scam_en.map"; score = 10.0; symbol = "SCAM_EN"; description = "Scam: Anything, english"; }

[martinschaible]

So you did change the scoring in the Web UI at "Symbols" and you updated the *Score" from 10 to your value? Right?

[weifengding]

I changed the default score from 20 to 10 in file /etc/rspamd/local.d/_multimap_scam.conf and all other files too, and restart rspamd. I didn't change it in Web UI at "Symbols".

[weifengding]

Another symbol is: BASE_BAD_TLD (20) [best]
I changed the score from 10 to 5 in the _multimap_base.conf file, not sure why this email got 20 for this symbol.

[martinschaible]

20? They are set to 10. Therefore two rules where fired. This can happen.

I'm not sure, if changing the default scoring in the file is a good idea.
From time to time, i add new maps, which needs an update of the config file(s).

[weifengding]

Yeah, have no idea why BASE_BAD_TLD had 20 for that email, other emails got 5 for this symbol. I searched the string BASE_BAD_TLD through /etc/rspamd/ and /var/lib/rspamd dirs but only found it in _multimap_base.conf file which is set to 5.

[weifengding]

Just give you an update of new found. I changed the SCAM_EN score from 20 to 10 two weeks ago, noticed one email got 20 today, then I changed it to 8. Now found another new email comes with SCAM_EN (16). It's not using old score, instead, it just doubled the score set in the config files. This looks like a Rspamd bug.

2023-11-08 15:13:06 #403989(controller) <7c3391>; csession; rspamd_task_write_log: id: <c3ae43d5b64222b2889bc96b01576903@xxx>, ip: 91.192.xxx, from: <sirokvasha@xxx>, (default: T (add header): [20.30/25.00] **[SCAM_EN(16.00)**{},MISSING_TO(2.00){},SUSPICIOUS_RECIPS(1.50){},EMPTY_SUBJECT(1.00){},R_DKIM_ALLOW(-0.20){xxx:s=2023;},MIME_GOOD(-0.10){multipart/alternative;text/plain;},RCVD_NO_TLS_LAST(0.10){},ARC_NA(0.00){},ASN(0.00){asn:15713, ipnet:91.192.xxxx.0/22, country:UA;},DKIM_TRACE(0.00){xxx:+;},FREEMAIL_CC(0.00){t-online.de;xxxx.com;yahoo.de;onebiz.com;web.de;live.de;hot-port.de;gmx.de;...;},FREEMAIL_ENVRCPT(0.00){t-online.de;yahoo.de;web.de;live.de;gmx.de;yahoo.com;gmail.com;},FREEMAIL_REPLYTO(0.00){gmail.com;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},HAS_REPLYTO(0.00){xxxx@gmail.com;},MID_RHS_MATCH_FROM(0.00){},MIME_TRACE(0.00){0:+;1:+;2:~;},RCPT_COUNT_TWELVE(0.00){14;},RCVD_COUNT_TWO(0.00){2;},RCVD_VIA_SMTP_AUTH(0.00){},REPLYTO_DOM_NEQ_FROM_DOM(0.00){},TAGGED_RCPT(0.00){},TO_DN_NONE(0.00){}]), len: 5096, time: 4980.091ms, dns req: 4, digest: <a720a766065a632185f1f27a80260c56>, mime_rcpts: <xxxx@xxx.com,...>

[martinschaible]

Please report this at the telegram channel of Rspamd