Apache uses "-" for missing value.
parse.py combined_format_re assumes that the
second and third field will be missing (it looks for
"-(?P<unknown>.*?)-"
The second and third fields are for user id; in our log
files, the third field is filled in for most webDAV
requests, as these require authorization.
_testa='0.0.0.0 - first.m.last@example.com [19/Apr/
2002:12:22:02 -0400] "MKCOL / HTTP/1.1" 200 0'
# Yes, we had entries with spaces in them.
_testb='0.0.0.0 - first last [19/Apr/2002:12:22:02 -
0400] "DELETE / HTTP/1.1" 200 0'
# We even had a few that were entered as "",
# though I hope that was a config mistake.
I ended up using this regex for the user field:
'(?P<user2>(-)|([a-zA-Z0-9.@ _-]+)|"")'
It is possible that other characters would also appear,
but didn't happen to in our logs.
Logged In: YES
user_id=420501
Can you provide a few lines from your Apache log (the entire
line, not just the user fields). This way I can test any
changes against them.
Feel free to edit the usernames for privacy/security reasons.
Thanks,
Phil