Mistake: awk field numbers break on quoted user-agents with spaces
A quiet data-corruption bug: $12 grabs half a UA string. Worth a read:
→ GNU awk manual (FS and FPAT) — Default whitespace splitting shreds quoted fields. FPAT lets you define a field as "quoted or non-space."
Takeaway: set FPAT='([^ ]+)|("[^"]+")' for combined log format.
→ Stack Overflow (parse Apache combined) — Why URLs with spaces or escaped quotes throw off every field after the request.
Takeaway: never trust positional fields on raw combined logs.
★ Pick of the week — GoAccess log-format strings — Pre-built format definitions that handle the quoting for you.
Takeaway: when in doubt, let a real parser tokenize, then awk the output.
Logfile Roundup
@LogfileRoundup
Mistake: awk field numbers break on quoted user-agents with spaces
Этот пост опубликован в Telegram-канале Logfile Roundup. Подписаться можно по ссылке: @LogfileRoundup.