<acct-file>set by the Hub
The line means different things depending on where accounting goes, and that is its main peculiarity.
For a file it is the ceiling at which the engine closes the file and starts a new one. The default is 250M, the minimum is 1M. It works without move-to too: then the new file starts in place, with an incremented number in its name.
For a webhook it is the maximum size of a batch. The default is 5M, the minimum 50K, the ceiling 10M.
This is the second closing condition, working together with move-interval for a file and with http-webhook-max-interval for a webhook: whichever comes first fires.
In the file block it is max-size 25M, ten times smaller than the vendor default. That makes sense: we have no move-to, the file starts anew in place, and small files are easier to parse.
In the telemetry block it is max-size 1M, five times smaller than the vendor’s 5M for a webhook. That makes sense too: one-minute batches are small anyway, and our receiver rejects a body larger than 32 MB with a 413 response, so the margin is thirtyfold.
The value depends on the stream type:
| Stream | Minimum | Default | Ceiling |
|---|---|---|---|
| file | 1M | 250M | not stated |
| webhook | 50K | 5M | 10M |
The meaning differs too: for a file it is the point where the next one begins, for a webhook — the maximum volume of one request.
# file: a new one starts in place when the ceiling is reached <acct-file /var/log/pmta/acct.csv> max-size 25M delete-after 7d </acct-file> # webhook: the same key means the maximum batch size <acct-file /var/log/pmta/mtahub-webhook.json> http-webhook-url https://hub.example.com/api/telemetry/pmta/7 http-webhook-max-interval 1m max-size 1M </acct-file>
what people get wrong and how it ends2 mistakes▶
§ 3.3.11.4
our experience
2 relations
ls -la /var/log/pmta/acct*.csv
3 articles
◇What the node tells about itself and through which channelsSeven observation surfaces: the web monitor, the console in four formats, the log, accounting, accounting search, metrics and export to external analytics.◇Two inbound report processors and what to do with themBounces by message and complaints are parsed by two identically structured blocks; each has its own address list and its own pair of decisions about the message’s fate.◇Five ways for a queue to hand off a messageA queue does not have to use SMTP: it can write to a file, run a program, call over HTTP or discard.