User agent syntax in log files

Puzzled on how to interpret ua field from log files

[simplys]

First of all, does ua field in log files have a standard syntax, like what information is placed in the brackets and what outside them, what does the first, second.. term in the brackets stand for and what do all the acronyms mean: SV1, rv:1.7.8 ..?

Also, let's take the first row for ex: does it mean the user uses exactly MSIE 6.0 and Windows NT 5.1 or could she/he be using any browser/os compatible with those?

And the last question: by analyzing web log's user agent fields can it be done an exact mapping of the os/browsers used or just of their compatibility?

A few user agents from my log file as working example:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050517 Firefox/1.0.4
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; FunWebProducts; SV1; (R1 1.5); .NET CLR 1.1.4322)

thanks, Catalin

[jdMorgan]

> First of all, does ua field in log files have a standard syntax, like what information is placed in the brackets and what outside them,

No, unfortunately, many user-agents don't follow any standard - especially robots.

Generally, the ones that start with "Mozilla" declare basic compatibility with a version of Moxilla -- the first commercial browser (a la Netscape), then state whether they *are* Mozilla-based, or "compatible."

> what does the first, second.. term in the brackets stand for and what do all the acronyms mean: SV1, rv:1.7.8 ..?

What follows is generally a list of the "real" user-agent name (if other than Mozilla) and a list including version numbers of the browser, language-version (sometimes), operating system. ISPs, PC makers, and "extension" and "toolbar" makers have now taken to adding their bit of branding to the end as well.

> Also, let's take the first row for ex: does it mean the user uses exactly MSIE 6.0 and Windows NT 5.1 or could she/he be using any browser/os compatible with those?

Well, it could be MSIE 6.0 on Windows XP, Service Pack 1, or it could be any other user-agent set up to spoof that combination. You really can't tell, although it's safe to say that 99% of all users won't intentionally change their user-agent to spoof another user-agent. Well... except for Opera, which used to (and still may) ship with default settings to spoof Internet Explorer.

> And the last question: by analyzing web log's user agent fields can it be done an exact mapping of the os/browsers used or just of their compatibility?

As you can tell from the above discussion, it's a real mess. So, can you get an exact mapping? No. Can you be sure of their compatibility? No. You just have to settle for 95% accuracy, and let the spoofers fall where they will.

Jim