In the dcoumentation I read
Format Notes For security reasons, starting with version 2.0.46, non-printable and other special characters in %r, %i and %o are escaped using \xhh sequences, where hh stands for the hexadecimal representation of the raw byte. Exceptions from this rule are " and \, which are escaped by prepending a backslash, and all whitespace characters, which are written in their C-style notation (\n, \t, etc). In versions prior to 2.0.46, no escaping was performed on these strings so you had to be quite careful when dealing with raw log files.
This is a problem for Analog which is still the handiest analyser I use.
.... "GET /somerequest?q=\"quoted string\"&someparm=bla"
in the logfile and it is of course flagged as corrupt since Analog expects
.... "GET /somerequest?q=%22quoted string%22&someparm=bla"
I realise I can pre-process using something like
perl -p -i.bak -e 's/\\"/%22/g' logfile
But I'd rather not have to add this step to these files which are 50-90MB zipped per day
Thanks for any pointers