In the dcoumentation I read
Format Notes For security reasons, starting with version 2.0.46, non-printable and other special characters in %r, %i and %o are
escaped using \xhh sequences, where hh stands for the hexadecimal
representation of the raw byte. Exceptions from this rule are " and \,
which are escaped by prepending a backslash, and all whitespace
characters, which are written in their C-style notation (\n, \t, etc).
In versions prior to 2.0.46, no escaping was performed on these
strings so you had to be quite careful when dealing with raw log
files.
This is a problem for Analog which is still the handiest analyser I use.
I get
.... "GET /somerequest?q=\"quoted string\"&someparm=bla"
in the logfile and it is of course flagged as corrupt since Analog expects
.... "GET /somerequest?q=%22quoted string%22&someparm=bla"
or similar.
I realise I can pre-process using something like
perl -p -i.bak -e 's/\\"/%22/g' logfile
But I'd rather not have to add this step to these files which are 50-90MB zipped per day
Thanks for any pointers
