Knowledge base

PMTA knowledge base›Mechanism§ 4.1.2

The log and accounting — two files and two different questions

logging file and accounting file

Why these are two files and not one

The engine keeps two streams of records, and confusing them is the most common mistake when investigating a malfunction.

The log answers the question “what did the node do”: startup and shutdown, errors, connection traces when the switches are enabled. It is the first place to look when something went wrong.

Accounting answers the question “what happened to the messages”: one record per event, in a machine-readable format. It is configured with the <acct-file> block.

The separation is made for three reasons, and the vendor names them directly. The accounting format is more efficient for subsequent processing. Performance — accounting is written by its own rules. And the third, the most practical: the log can be handed over to support without disclosing accounting data.

The engine writes to the operating system log only what it could not write to its own — startup errors and the like. An empty engine log on a non-working node means that is where to look.

Both have rotation, but it is configured separately: log-rotate and log-auto-rotation for the log, move-interval, max-size and delete-after for accounting.

The main trap is looking for a message’s fate in the log. It is not there and will not be, however much detail you enable: the log writes about connections, not about messages. The reverse is also true — the cause of a dropped connection cannot be found in accounting, which holds only the result.

What the Hub does. It uses both, and differently.

Accounting is the source of all analytics: it arrives via webhook, is parsed, goes into the database and feeds the fleet panels.

The log we do not collect at all. It is read during investigations — over SSH, by hand. This is a deliberate choice: the log is voluminous, and the questions the panels ask are answered by accounting.

🔎 This leads to a practical rule for us: if a panel shows emptiness while the node is working, look at the log, and on the node itself. Telemetry about messages will say nothing about why it is not arriving.

Recommended values

The mechanism has no values of its own — they are set by two groups of lines:

What	Log	Accounting
where it lives	log-file	the path in the <acct-file> tag
how long it is kept	log-rotate	delete-after
when it switches	log-auto-rotation	move-interval, max-size
level of detail	log-* switches	records, record-fields

The separation itself, the three reasons and the role of the operating system log come from the manual (§ 4.1.2). The practical rule about an empty panel is ours.

Example configuration

# two streams, two settings, two different questions
log-file /var/log/pmta/loglog-rotate 8

<acct-file /var/log/pmta/acct.csv>
    records d, b
    delete-after 7d
</acct-file>

The log is configured with node-level lines, accounting with a block. They have only one thing in common: disk space.

yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.

▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Looking for a message's fate in the log

§ 4.1.2

What it costsThe log writes about the node’s work, not about messages. Enabling details will add connection tracing but still will not give the message’s history.

How to spot itThe log has not a single mention of the recipient.

How to do it rightLook at accounting: there is one record per event with each recipient.

Handing accounting to support instead of the log

§ 4.1.2

What it costsAccounting holds your recipients’ addresses and receiver responses. The log holds the node’s work. The separation was made precisely so that the latter can be handed over without disclosing the former.

How to spot itA file with the address base went to support.

How to do it rightHand over the log; if necessary, attach accounting with privacy-policy enabled.

Expecting telemetry to explain its own silence

our experience

What it costsThe panel is fed by accounting. If accounting does not arrive, only the node’s log can explain it — and it has to be looked at on the node itself.

How to spot itThe panel is empty, while the node is sending mail.

How to do it rightGo to the node and read the log; for the webhook, enable http-webhook-log-verbose.

Compatibility

PowerMTA 6.0

described in the manual of this version · platform: any

The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.

Inheritance

The mechanism has no inheritance — what is inherited are the directives that enable it. There is one log per node, but there can be several accounting files.

⇄

Related entries

2 relations

Works together with

The telemetry contractThe accounting half of the separation: the log answers “what did the node do,” accounting “what happened to the messages.” § 4.1.2 The node's own logThe very file in question: a record of the node’s work, not of messages. § 4.1.2

How to check on the node

The check is simple: the two files should grow differently — the log in jumps, accounting steadily:

ls -la /var/log/pmta/

Only accounting grows — that is normal when there are no malfunctions. Only the log grows — the node is reporting something, and that is the first thing to read. Nothing grows — the engine is not running or cannot write, and you need to look at the operating system log.

◇

What else to read

3 articles

◇What the node tells about itself and through which channelsSeven observation surfaces: the web monitor, the console in four formats, the log, accounting, accounting search, metrics and export to external analytics.◇A file, a program or an endpoint — and a file under each of the threeThree ways to hand off accounting records; an endpoint still has a file underneath, which is deleted only after a successful send, and a non-2xx response triggers a retry.◇The watchdog that restarts the engineKeeps an eye on the engine and brings it back up after a crash by itself, sending a crash report to the postmaster address.

In the Hub

Cost of a mistake: safe: a wrong value breaks nothing
Scenarios: Untangle a stuck queue · Collect telemetry