In the dcoumentation I read

Format Notes For security reasons, starting with version 2.0.46, non-printable and other special characters in %r, %i and %o are escaped using \xhh sequences, where hh stands for the hexadecimal representation of the raw byte. Exceptions from this rule are " and \, which are escaped by prepending a backslash, and all whitespace characters, which are written in their C-style notation (\n, \t, etc). In versions prior to 2.0.46, no escaping was performed on these strings so you had to be quite careful when dealing with raw log files.

This is a problem for Analog which is still the handiest analyser I use.

I get

.... "GET /somerequest?q=\"quoted string\"&someparm=bla"

in the logfile and it is of course flagged as corrupt since Analog expects

.... "GET /somerequest?q=%22quoted string%22&someparm=bla"

or similar.

I realise I can pre-process using something like

perl -p -i.bak -e 's/\\"/%22/g' logfile

But I'd rather not have to add this step to these files which are 50-90MB zipped per day

Thanks for any pointers