It doesnt need to run often, once a day or every 3 days.
A current temp solution might work ok though: Mail log is copied to a temp folder by chrontab and a php script is run to load and filter dates and bounces from that file, it saves all to database (bounce address and date) then on next run it can skip the ones older than last date from database.
Unless someone has a better solution I will use what I have.
The other question remains, anyone knows what is the 48/48 next to ctladdr ? I could not find any info. I also have it as "(0/0)" and I seen it somewhere, I think on other logs online as (35/35) or something similar.
It is part of the ctladdr because the next coma is after* it.
Jul 24 10:13:02 ip-10-170-14-112 sendmail: p6OAZZZ13169: to=SomeUser <email@example.com>, firstname.lastname@example.org (48/48), delay=00:00:01, xdelay=00:00:00, mailer=relay, pri=31046, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (p6OAZZZ13170 Message accepted for delivery)