A short code at the very beginning of the line: d — delivered, b — bounced, t — transient failure, and so on.
Always written: without it the line cannot be parsed at all. The field set is defined in the accounting block, and fields are worth adding deliberately: there are as many delivery records as delivered recipients, and every extra column is multiplied by that volume.
Any accounting analysis starts with it — all other fields make sense only paired with it.
Where the field exists:
| Record type | How it is written |
|---|---|
| d — delivery | always written |
| b — bounce | always written |
| t — temporary failure | always written |
| tq — queue failure | always written |
| r — reception | always written |
| rb, rs — external report | always written |
| f — complaint | always written |
<acct-file /var/log/pmta/acct.csv> records d, b record-fields d rcpt, vmta</acct-file>
cut -d, -f1 /var/log/pmta/acct-*.csv | sort | uniq -c