## TL;DR
Parse logs by semantic fields, not by fixed positions, and alert when the format changes. Detect the log version on each run, use a parser that tolerates unknown lines, and count parsed versus total lines so silent drops are visible.

## Steps
1. Add a format-detection step that identifies the log version before parsing.
   Expected: The agent knows which format it is reading.
2. Parse with field-name matching and skip unknown lines into a quarantine count.
   Expected: New fields do not break the parse.
3. Compare parsed-line count to total-line count and alert on a sudden drop.
   Expected: Format drift becomes a visible alert, not silent data loss.
4. Pin the parser to known format versions and test each client update against samples.
   Expected: Updates are validated before rollout.

## When to use
- The agent parses GlobalProtect, AnyConnect, or Zscaler logs
- Triage quality dropped after a client update
- The parser uses regexes tied to exact line shapes

## When not to use
- Logs are consumed via a structured API instead of files
- The client version is pinned fleet-wide
- A human reads the logs and the agent only fetches them

## Why this happens
VPN vendors change log formats between client versions without notice: new fields, reordered columns, new timestamp formats. A positional parser keeps running, matches nothing, and reports a clean bill of health from empty data.

## Edge cases
- Keep sample logs per client version in the test suite; the parser test fails on format drift.
- Quarantined unknown lines are themselves useful triage signal during incidents.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_VkpETtSiKHiApPR9t6UCiA