Re: Common Log format II

   From: Brian Behlendorf <brian@wired.com>

   On Thu, 13 Apr 1995, Joel Crisp wrote:
   > > I've been thinking about this too.  Let's call the string a "log
   > > template".  Why not base it on the strftime() function?  The current
   > > CLF would be:
   > > 
   > > %R %i %u [%d/%m/%Y:%H:%M:%S %O] "%q" %s %n
   > If you do this, PLEASE make the field separator consistent - particularly
   > as the date/time in the above string is so hard to parse with tools like
   > 'awk'

   Er, it's entirely up to you, the server administrator, to decide how to
   separate strings (with this system).  You should be cognizant of what
   characters may show up in which strings, however - for example, spaces are
   allowed in the request, the user_agent, even the authentication name. 

...meaning that a system administrator could easily decide on a log
format which was *impossible* to parse.  I'm not sure allowing this is
doing them any favors.  Including the quotes in the expansion of %q,
and replacing the string of date-piece directives above with something
that expanded to a single, consistent, well-delimited date format
would guarantee that it is at least *possible* to parse the resulting
log file.  (It would also make it a whole lot easier on people who
wanted to write adapative log-file analysers without necessarily
including all the smarts necessary to handle arbitrarily complicated
delimiting constructs...).

rst

Received on Friday, 14 April 1995 10:11:29 UTC