From 61a40c7402dba11951e116a5789627162befaf62 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Tue, 6 Sep 2011 08:11:27 +0200 Subject: [PATCH] [MINOR] halog: support backslash-escaped quotes Some syslog servers escape quotes, which make the resulting logs unusable for URL processing since the parser looks for the first field beginning with a quote. It now supports also fields starting with backslash and quote in order to address this. No performance impact was measured. --- contrib/halog/halog.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/contrib/halog/halog.c b/contrib/halog/halog.c index 39e4320c8..32ca67099 100644 --- a/contrib/halog/halog.c +++ b/contrib/halog/halog.c @@ -1127,8 +1127,12 @@ void filter_count_url(const char *accept_field, const char *time_field, struct t * if there's nothing else. */ e = field_start(e, METH_FIELD - TIME_FIELD + 1); // avg 100 ns per line - while (*e != '"' && *e) + while (*e != '"' && *e) { + /* Note: some syslog servers escape quotes ! */ + if (*e == '\\' && e[1] == '"') + break; e = field_start(e, 2); + } if (unlikely(!*e)) { truncated_line(linenum, line); -- 2.47.3