Fields delimiter in new "full" log format

[Leonid Antonenkov <an...@olis.ru>]

Hello all!

Leonid Antonenkov wrote:
> I think it will be better to define _standard_ "full" log format

About fields delimiter in new "full" format:

In "combined" log format all fields separated with space character.
Some of fields (for example, %r - first line of request)
may contain space symbol, so such fields enclosed with '"' character.

The problem is in parsing log files:
if there is '"' character in first line of request,
results of parsing will be unpredictable.

In my opinion, the best way to store such data structures
(without changing main concept, without using XML, etc.)
is to store lines separated by 'separator' (tab, for example),
enclosed by 'encloser' ('"', for example)
and escaped with 'escaper' ('\', for example).
But this way needs changing code of Apache and so on.

Not the best, but, I think, better than current solution
is to define long delimiter with rare characters (for example ' |:| ')

Format string will be like this: 
LogFormat "%h |:| %l |:| %u |:| %t |:| %r |:| %>s |:| %b |:| %{Referer}i
|:| %{User-Agent}i" new_combined

Sincerely yours,
  Leonid Antonenkov

  Email: antonenk@olis.ru
ICQ UIN: 23637980

Re: Fields delimiter in new "full" log format

[Tony Finch <do...@dotat.at>]

On Thu, May 16, 2002 at 03:50:39PM +0400, Leonid Antonenkov wrote:
> 
> Not the best, but, I think, better than current solution
> is to define long delimiter with rare characters (for example ' |:| ')
> 
> Format string will be like this: 
> LogFormat "%h |:| %l |:| %u |:| %t |:| %r |:| %>s |:| %b |:| %{Referer}i
> |:| %{User-Agent}i" new_combined

That doesn't avoid the need for escaping. Before the current effort
to properly escape log lines and to be strict about the request line
format (and you also need to be strict about all other request headers),
the only way to reliably log in Apache is to use a newline delimiter
between fields and a double newline between log records, so instead of
one line a log record would be multiple lines. This is more convenient
for software than for humans, though...

I also suggest adding X-Forwarded-For to your full log, to get some
details of proxy forwarding.

Tony.
-- 
f.a.n.finch <do...@dotat.at> http://dotat.at/
SHANNON: SOUTHERLY 5 TO 7, DECREASING 4 IN EAST. RAIN THEN SHOWERS. MODERATE
BECOMING GOOD.