NAME

       rspamd_stats - analyze Rspamd rules by parsing log files

SYNOPSIS

       rspamd_stats [options] [--symbol=SYM1 [--symbol=SYM2...]] [--log file]

DESCRIPTION

       rspamd_stats  will  read the given log file (or standard input) and provide statistics for
       the specified symbols:

              Symbol: BAYES_SPAM (weight 3.763) (381985 hits, 26.827%)
              Ham hits: 184557 (48.315%), total ham: 1095487 (ham with BAYES_SPAM: 16.847%)
              Spam hits: 15134 (3.962%), total spam: 16688 (spam with BAYES_SPAM: 90.688%)
              Junk hits: 182294 (47.723%), total junk: 311699 (junk with BAYES_SPAM: 58.484%)
              Spam changes (ham/junk -> spam): 7026 (1.839%), total percentage (changes / spam hits): 42.102%
              Junk changes (ham -> junk): 95192 (24.920%), total percentage (changes / junk hits): 30.540%

       Where there are the following attributes:

       • Weight: average score for a symbols

       • Total hits: total number of hits and percentage of symbol hits divided by  total  number
         of messages

       • HAM  hits:  provides  the  following  information  about HAM messages with the specified
         symbol (from left to right):

       1. total symbol hits: number of messages that has this symbol and are HAM

       2. ham percentage: number of symbol hits divided by overall HAM messages count

       3. total ham hits: overall number of HAM messages

       4. ham with symbol percentage: percentage of number of hits with specified symbol  in  HAM
          messages divided by total number of HAM messages.

       • SPAM hits: provides the following information about SPAM messages - same as previous but
         for SPAM class.

       • Junk hits: provides the following information about Junk messages - same as previous but
         for JUNK class.

       • Spam  changes: displays data about how much messages switched their class because of the
         specific symbol weight.

       • Junk changes: displays data about how much messages switched their class because of  the
         specific symbol weight.

OPTIONS

       --log  Specifies  log  file  or  directory to read data from.  If a directory is specified
              rspamd_stats analyses files in the directory including known compressed file types.
              Number  of  log  files  can be limited using --num-logs and --exclude-logs options.
              This  assumes  that  files   in   the   log   directory   have   newsyslog(8)-   or
              logrotate(8)-like   name  format  with  numeric  indexes.   Files  without  indexes
              (generally it is merely one file) are considered the most  recent  and  files  with
              lower indexes are considered newer.

       --reject-score
              Specifies the reject (spam) threshold.

       --junk-score
              Specifies the junk (add header or rewrite subject) threshold.

       --alpha-score
              Specifies the minimum score for a symbol to be considered by this script.

       --symbol
              Add symbol or pattern (pcre format) to analyze.

       --num-logs
              If set, limits number of analyzed logfiles in the directory to the specified value.

       --exclude-logs
              Number of latest logs to exclude (0 by default).

       --correlations
              Additionally  print  correlation  rate  for  each  symbol  displayed.  This routine
              calculates merely paired correlations between symbols.

       --search-pattern
              Do not process input unless finding the specified regular  expression.   Useful  to
              skip logs to a certain position.

       --exclude
              Exclude log lines if certain symbols are fired (e.g.  GTUBE).  You may specify this
              option multiple time to skip multiple symbols.

       --start
              Select log  entries  after  this  time.   Format:  "YYYY-MM-DD  HH:MM:SS"  (can  be
              truncated  to  any  desired  accuracy).   If used with --end select entries between
              --start and --end.  The omitted date defaults to the current date if you supply the
              time.

       --end  Select  log  entries  before  this  time.   Format:  "YYYY-MM-DD  HH:MM:SS" (can be
              truncated to any desired accuracy).  If used with --start  select  entries  between
              --start and --end.  The omitted date defaults to the current date if you supply the
              time.

       --help Print a brief help message and exits.

       --man  Prints the manual page and exits.

AUTHORS

       Vsevolod Stakhov.

                                          March 5, 2018                           RSPAMD_STATS(8)