rtf> In that spirit, let me propose that some generic indicator (such
rtf> as "-") be used for any field which is desired by the
rtf> configuration string (or by the fixed format) but is unknown or
rtf> empty for a particular log entry. Thus, if the configurable
rtf> string indicates REMOTE_IDENT should be logged between FULL YEAR
rtf> and CLIENT HOST ADDRESS (as in "%Y %I %C"), and REMOTE_IDENT is
rtf> empty, then the output should be like:
rtf> "1994 - simplon.ics.uci.edu"
rtf> rather than
rtf> "1994 simplon.ics.uci.edu"
rtf> for reasons that should be obvious to most hackers.
While I think preserving the number of fields is a good idea, I
suggest something along the lines of '--' or 'N/A' be used for empty
or "not applicable/available" fields. The meaning of either,
especially the latter, is more obvious to me than a single hyphen.
michael