feat(access-logs): 接入 User-Agent 与设备/浏览器/状态码分布

- Agent 访问日志上报 user_agent，OpenResty log_format 输出 http_user_agent
- of_node_access_logs 新增 user_agent 列并写入 ClickHouse
- 访问日志概览新增：设备类型饼图、状态码饼图、浏览器/OS/User-Agent 排行
- 日志明细列表增加 User-Agent 列
- 扩展 UA 解析工具（browser/os/device）并支持 CLI 识别

internal/apps/agent/observability/traffic.go

@@ -22,6 +22,7 @@ type accessLogRecord struct {
 	Host          string  `json:"host"`
 	RemoteAddr    string  `json:"remote_addr"`
 	Path          string  `json:"path"`
+	UserAgent     string  `json:"user_agent"`
 	Status        int     `json:"status"`
 	BytesSent     int64   `json:"bytes_sent"`
 	RequestLength int64   `json:"request_length"`
@@ -145,6 +146,7 @@ func (aggregate *trafficAggregate) consume(line []byte) {
 		RemoteAddr:    strings.TrimSpace(record.RemoteAddr),
 		Host:          strings.TrimSpace(record.Host),
 		Path:          normalizeAccessLogPath(record.Path),
+		UserAgent:     strings.TrimSpace(record.UserAgent),
 		StatusCode:    record.Status,
 		BytesSent:     record.BytesSent,
 		RequestLength: record.RequestLength,
@@ -157,6 +159,7 @@ type parsedAccessLogRecord struct {
 	Host          string
 	RemoteAddr    string
 	Path          string
+	UserAgent     string
 	Status        int
 	BytesSent     int64
 	RequestLength int64
@@ -189,6 +192,7 @@ func parseJSONAccessLogRecord(raw string) (parsedAccessLogRecord, bool) {
 		Host:          strings.TrimSpace(record.Host),
 		RemoteAddr:    strings.TrimSpace(record.RemoteAddr),
 		Path:          normalizeAccessLogPath(record.Path),
+		UserAgent:     strings.TrimSpace(record.UserAgent),
 		Status:        record.Status,
 		BytesSent:     record.BytesSent,
 		RequestLength: record.RequestLength,

internal/apps/agent/observability/traffic_test.go

@@ -14,8 +14,8 @@ func TestCollectAccessLogsReturnsFactsOnly(t *testing.T) {
 	tempDir := t.TempDir()
 	logPath := filepath.Join(tempDir, "openflare_access.log")
 	content := []byte(
-		"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/login\",\"remote_addr\":\"10.0.0.1\",\"status\":200,\"request_length\":128,\"bytes_sent\":512,\"request_time\":0.015}\n" +
-			"{\"ts\":\"2026-03-14T08:00:05Z\",\"host\":\"api.example.com\",\"path\":\"/v1/ping\",\"remote_addr\":\"10.0.0.2\",\"status\":502,\"request_length\":64,\"bytes_sent\":256,\"request_time\":0.008}\n",
+		"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/login\",\"remote_addr\":\"10.0.0.1\",\"status\":200,\"request_length\":128,\"bytes_sent\":512,\"request_time\":0.015,\"user_agent\":\"Mozilla/5.0\"}\n" +
+			"{\"ts\":\"2026-03-14T08:00:05Z\",\"host\":\"api.example.com\",\"path\":\"/v1/ping\",\"remote_addr\":\"10.0.0.2\",\"status\":502,\"request_length\":64,\"bytes_sent\":256,\"request_time\":0.008,\"user_agent\":\"curl/8.0\"}\n",
 	)
 	if err := os.WriteFile(logPath, content, 0o644); err != nil {
 		t.Fatalf("WriteFile failed: %v", err)
@@ -35,6 +35,9 @@ func TestCollectAccessLogsReturnsFactsOnly(t *testing.T) {
 	if accessLogs[0].Path != "/login" || accessLogs[1].Path != "/v1/ping" {
 		t.Fatalf("unexpected access log paths: %+v", accessLogs)
 	}
+	if accessLogs[0].UserAgent != "Mozilla/5.0" || accessLogs[1].UserAgent != "curl/8.0" {
+		t.Fatalf("unexpected user agents: %+v", accessLogs)
+	}
 
 	snapshot, err := stateStore.Load()
 	if err != nil {

internal/apps/agent/state/observability_buffer.go

@@ -117,7 +117,7 @@ func mergeAccessLogs(existing []protocol.NodeAccessLog, incoming []protocol.Node
 }
 
 func accessLogKey(item protocol.NodeAccessLog) string {
-	return strconv.FormatInt(item.LoggedAtUnix, 10) + "|" + item.RemoteAddr + "|" + item.Host + "|" + item.Path + "|" + strconv.Itoa(item.StatusCode)
+	return strconv.FormatInt(item.LoggedAtUnix, 10) + "|" + item.RemoteAddr + "|" + item.Host + "|" + item.Path + "|" + item.UserAgent + "|" + strconv.Itoa(item.StatusCode)
 }
 
 // Replayable returns buffered records from windows before currentWindowStartedAtUnix.

internal/apps/openflare/agent/observability.go

@@ -24,6 +24,7 @@ const (
 	healthSeverityWarning       = "warning"
 	healthSeverityCritical      = "critical"
 	accessLogPathMaxLength      = 100
+	accessLogUserAgentMaxLength = 512
 	healthEventMessageMaxLength = 4096
 )
 
@@ -208,6 +209,7 @@ func buildNodeAccessLogRecords(nodeID string, direct []NodeAccessLog, buffered [
 				Region:        "",
 				Host:          strings.TrimSpace(item.Host),
 				Path:          truncateForDatabase(strings.TrimSpace(item.Path), accessLogPathMaxLength),
+				UserAgent:     truncateForDatabase(strings.TrimSpace(item.UserAgent), accessLogUserAgentMaxLength),
 				StatusCode:    item.StatusCode,
 				BytesSent:     bytesSent,
 				RequestLength: requestLength,

internal/apps/openflare/observability/access_log_logics.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/Rain-kl/Wavelet/internal/model"
+	analyticsrepo "github.com/Rain-kl/Wavelet/internal/repository/analytics"
 )
 
 const (
@@ -52,6 +53,7 @@ type AccessLogView struct {
 	Region     string    `json:"region"`
 	Host       string    `json:"host"`
 	Path       string    `json:"path"`
+	UserAgent  string    `json:"user_agent"`
 	StatusCode int       `json:"status_code"`
 }
 
@@ -207,13 +209,18 @@ type AccessLogOverviewTrends struct {
 
 // AccessLogOverview is the access-log analytics overview payload.
 type AccessLogOverview struct {
-	GeneratedAt time.Time                `json:"generated_at"`
-	Hours       int                      `json:"hours"`
-	Summary     AccessLogOverviewSummary `json:"summary"`
-	Trends      AccessLogOverviewTrends  `json:"trends"`
-	TopPaths    []DistributionItem       `json:"top_paths"`
-	TopHosts    []DistributionItem       `json:"top_hosts"`
-	TopIPs      []DistributionItem       `json:"top_ips"`
+	GeneratedAt         time.Time                `json:"generated_at"`
+	Hours               int                      `json:"hours"`
+	Summary             AccessLogOverviewSummary `json:"summary"`
+	Trends              AccessLogOverviewTrends  `json:"trends"`
+	TopPaths            []DistributionItem       `json:"top_paths"`
+	TopHosts            []DistributionItem       `json:"top_hosts"`
+	TopIPs              []DistributionItem       `json:"top_ips"`
+	DeviceTypes         []DistributionItem       `json:"device_types"`
+	TopBrowsers         []DistributionItem       `json:"top_browsers"`
+	TopOperatingSystems []DistributionItem       `json:"top_operating_systems"`
+	TopUserAgents       []DistributionItem       `json:"top_user_agents"`
+	StatusCodes         []DistributionItem       `json:"status_codes"`
 }
 
 // AccessLogCleanupInput is the cleanup request payload.
@@ -229,9 +236,10 @@ type AccessLogCleanupResult struct {
 }
 
 const (
-	defaultAccessLogOverviewHours = 24
-	maxAccessLogOverviewHours     = 24 * 30
-	accessLogOverviewTopLimit     = 10
+	defaultAccessLogOverviewHours     = 24
+	maxAccessLogOverviewHours         = 24 * 30
+	accessLogOverviewTopLimit         = 10
+	accessLogOverviewUASampleLimit    = 200
 )
 
 // GetAccessLogOverview returns summary metrics, trends, and top rankings.
@@ -254,6 +262,7 @@ func GetAccessLogOverview(ctx context.Context, input AccessLogOverviewQuery) (*A
 	requestPoints, visitPoints, bandwidthPoints := buildAccessLogOverviewTrends(
 		ctx, now, normalized.Hours, query,
 	)
+	deviceTypes, topBrowsers, topOSes, topUserAgents := buildAccessLogUADistributions(ctx, query)
 
 	return &AccessLogOverview{
 		GeneratedAt: now,
@@ -268,9 +277,14 @@ func GetAccessLogOverview(ctx context.Context, input AccessLogOverviewQuery) (*A
 			Visits:    visitPoints,
 			Bandwidth: bandwidthPoints,
 		},
-		TopPaths: valueCountDistribution(ctx, query, "path", accessLogOverviewTopLimit),
-		TopHosts: valueCountDistribution(ctx, query, "host", accessLogOverviewTopLimit),
-		TopIPs:   valueCountDistribution(ctx, query, "remote_addr", accessLogOverviewTopLimit),
+		TopPaths:            valueCountDistribution(ctx, query, "path", accessLogOverviewTopLimit),
+		TopHosts:            valueCountDistribution(ctx, query, "host", accessLogOverviewTopLimit),
+		TopIPs:              valueCountDistribution(ctx, query, "remote_addr", accessLogOverviewTopLimit),
+		DeviceTypes:         deviceTypes,
+		TopBrowsers:         topBrowsers,
+		TopOperatingSystems: topOSes,
+		TopUserAgents:       topUserAgents,
+		StatusCodes:         valueCountDistribution(ctx, query, "status_code", accessLogOverviewTopLimit),
 	}, nil
 }
 
@@ -309,6 +323,45 @@ func valueCountDistribution(
 	return items
 }
 
+func buildAccessLogUADistributions(
+	ctx context.Context,
+	query model.OpenFlareAccessLogQuery,
+) (
+	deviceTypes []DistributionItem,
+	topBrowsers []DistributionItem,
+	topOSes []DistributionItem,
+	topUserAgents []DistributionItem,
+) {
+	uaRows := valueCountDistribution(ctx, query, "user_agent", accessLogOverviewUASampleLimit)
+	if len(uaRows) == 0 {
+		return []DistributionItem{}, []DistributionItem{}, []DistributionItem{}, []DistributionItem{}
+	}
+
+	deviceAcc := make(distributionAccumulator)
+	browserAcc := make(distributionAccumulator)
+	osAcc := make(distributionAccumulator)
+	for _, row := range uaRows {
+		ua := row.Key
+		count := row.Value
+		deviceAcc[analyticsrepo.ParseDeviceType(ua)] += count
+		browserAcc[analyticsrepo.ParseBrowserName(ua)] += count
+		osAcc[analyticsrepo.ParseOSName(ua)] += count
+	}
+
+	topUserAgents = make([]DistributionItem, 0, accessLogOverviewTopLimit)
+	for _, row := range uaRows {
+		if len(topUserAgents) >= accessLogOverviewTopLimit {
+			break
+		}
+		topUserAgents = append(topUserAgents, row)
+	}
+
+	return toDistributionItems(deviceAcc, 0),
+		toDistributionItems(browserAcc, accessLogOverviewTopLimit),
+		toDistributionItems(osAcc, accessLogOverviewTopLimit),
+		topUserAgents
+}
+
 func buildAccessLogOverviewTrends(
 	ctx context.Context,
 	now time.Time,
@@ -394,6 +447,7 @@ func ListAccessLogs(ctx context.Context, input AccessLogQuery) (*AccessLogList,
 			Region:     item.Region,
 			Host:       item.Host,
 			Path:       item.Path,
+			UserAgent:  item.UserAgent,
 			StatusCode: item.StatusCode,
 		})
 	}

internal/db/migrator/goose/clickhouse/202607180004_access_log_user_agent.sql

@@ -0,0 +1,6 @@
+-- +goose Up
+ALTER TABLE of_node_access_logs
+    ADD COLUMN IF NOT EXISTS user_agent String DEFAULT '';
+
+-- +goose Down
+ALTER TABLE of_node_access_logs DROP COLUMN IF EXISTS user_agent;

internal/model/analytics/node_access_log.go

@@ -10,7 +10,7 @@ import (
 
 const (
 	nodeAccessLogTableName     = "of_node_access_logs"
-	nodeAccessLogInsertColumns = "id, node_id, logged_at, remote_addr, region, host, path, status_code, bytes_sent, request_length, request_time_ms, created_at"
+	nodeAccessLogInsertColumns = "id, node_id, logged_at, remote_addr, region, host, path, user_agent, status_code, bytes_sent, request_length, request_time_ms, created_at"
 )
 
 // NodeAccessLog stores OpenFlare edge node access records in ClickHouse.
@@ -22,6 +22,7 @@ type NodeAccessLog struct {
 	Region        string    `gorm:"column:region"`
 	Host          string    `gorm:"column:host"`
 	Path          string    `gorm:"column:path"`
+	UserAgent     string    `gorm:"column:user_agent"`
 	StatusCode    int32     `gorm:"column:status_code"`
 	BytesSent     uint64    `gorm:"column:bytes_sent"`
 	RequestLength uint64    `gorm:"column:request_length"`

internal/model/openflare_access_log.go

@@ -77,7 +77,7 @@ func TrafficSummaryOpenFlareAccessLogs(ctx context.Context, query OpenFlareAcces
 	return currentAccessLogStore().TrafficSummary(ctx, query)
 }
 
-// ValueCountsOpenFlareAccessLogs groups logs by status_code, host, path, or remote_addr.
+// ValueCountsOpenFlareAccessLogs groups logs by status_code, host, path, remote_addr, or user_agent.
 func ValueCountsOpenFlareAccessLogs(ctx context.Context, query OpenFlareAccessLogQuery, column string, limit int) ([]OpenFlareAccessLogValueCount, error) {
 	return currentAccessLogStore().ValueCounts(ctx, query, column, limit)
 }

internal/model/openflare_access_log_store.go

@@ -284,6 +284,7 @@ func toAnalyticsNodeAccessLog(record *OpenFlareAccessLog) analyticsmodel.NodeAcc
 		Region:        record.Region,
 		Host:          record.Host,
 		Path:          record.Path,
+		UserAgent:     record.UserAgent,
 		StatusCode:    openFlareAccessLogStatusCodeToInt32(record.StatusCode),
 		BytesSent:     bytesSent,
 		RequestLength: requestLength,
@@ -315,6 +316,7 @@ func fromAnalyticsNodeAccessLogs(rows []analyticsmodel.NodeAccessLog) []*OpenFla
 			Region:        row.Region,
 			Host:          row.Host,
 			Path:          row.Path,
+			UserAgent:     row.UserAgent,
 			StatusCode:    int(row.StatusCode),
 			BytesSent:     bytesSent,
 			RequestLength: requestLength,

internal/model/openflare_access_log_store_memory.go

@@ -22,6 +22,7 @@ const (
 	accessLogColumnHost       = "host"
 	accessLogColumnPath       = "path"
 	accessLogColumnRemoteAddr = "remote_addr"
+	accessLogColumnUserAgent  = "user_agent"
 )
 
 type memoryAccessLogStore struct {
@@ -476,7 +477,7 @@ func (s *memoryAccessLogStore) ValueCounts(_ context.Context, filter OpenFlareAc
 	defer s.mu.RUnlock()
 	col := strings.TrimSpace(strings.ToLower(column))
 	switch col {
-	case accessLogColumnStatusCode, accessLogColumnHost, accessLogColumnPath, accessLogColumnRemoteAddr:
+	case accessLogColumnStatusCode, accessLogColumnHost, accessLogColumnPath, accessLogColumnRemoteAddr, accessLogColumnUserAgent:
 	default:
 		return nil, nil
 	}
@@ -493,6 +494,8 @@ func (s *memoryAccessLogStore) ValueCounts(_ context.Context, filter OpenFlareAc
 			value = strings.TrimSpace(row.Path)
 		case accessLogColumnRemoteAddr:
 			value = strings.TrimSpace(row.RemoteAddr)
+		case accessLogColumnUserAgent:
+			value = strings.TrimSpace(row.UserAgent)
 		}
 		if value == "" {
 			continue

internal/model/openflare_observability.go

@@ -47,6 +47,7 @@ type OpenFlareAccessLog struct {
 	Region        string    `json:"region" gorm:"size:128"`
 	Host          string    `json:"host" gorm:"index;size:255"`
 	Path          string    `json:"path" gorm:"size:2048"`
+	UserAgent     string    `json:"user_agent" gorm:"column:user_agent;size:512"`
 	StatusCode    int       `json:"status_code" gorm:"index"`
 	BytesSent     int64     `json:"bytes_sent" gorm:"column:bytes_sent;not null;default:0"`
 	RequestLength int64     `json:"request_length" gorm:"column:request_length;not null;default:0"`

internal/model/openflare_option.go

@@ -38,7 +38,7 @@ http {
     fastcgi_temp_path __OPENFLARE_NGINX_CACHE_DIR__/fastcgi_temp;
     uwsgi_temp_path __OPENFLARE_NGINX_CACHE_DIR__/uwsgi_temp;
     scgi_temp_path __OPENFLARE_NGINX_CACHE_DIR__/scgi_temp;
-{{OpenRestyConnectionUpgradeMap}}{{OpenRestyDefaultServerBlock}}    log_format openflare_json escape=json '{"ts":"$time_iso8601","host":"$host","path":"$request_uri","remote_addr":"$remote_addr","status":$status,"request_time":$request_time,"bytes_sent":$body_bytes_sent,"request_length":$request_length}';
+{{OpenRestyConnectionUpgradeMap}}{{OpenRestyDefaultServerBlock}}    log_format openflare_json escape=json '{"ts":"$time_iso8601","host":"$host","path":"$request_uri","remote_addr":"$remote_addr","status":$status,"request_time":$request_time,"bytes_sent":$body_bytes_sent,"request_length":$request_length,"user_agent":"$http_user_agent"}';
     access_log {{OpenRestyAccessLogPath}} openflare_json;
     sendfile on;
     tcp_nopush on;

internal/repository/analytics/access_log_test.go

@@ -28,7 +28,8 @@ func TestParseBrowserName(t *testing.T) {
 		{name: "edge", ua: "Mozilla/5.0 Edg/120.0.0.0", want: "Edge"},
 		{name: "wechat", ua: "MicroMessenger/8.0", want: "WeChat"},
 		{name: "postman", ua: "PostmanRuntime/7.36.0", want: "Postman"},
-		{name: "other", ua: "curl/8.0", want: "Other"},
+		{name: "cli", ua: "curl/8.0", want: "CLI"},
+		{name: "other", ua: "CustomClient/1.0", want: "Other"},
 	}
 
 	for _, tt := range tests {

internal/repository/analytics/browser.go

@@ -5,26 +5,116 @@ package analytics
 
 import "strings"
 
+const (
+	uaLabelUnknown = "Unknown"
+	uaLabelBot     = "Bot"
+	uaLabelOther   = "Other"
+	uaTokenBot     = "bot"
+	uaTokenAndroid = "android"
+	uaTokenSpider  = "spider"
+	uaTokenCrawler = "crawler"
+)
+
+type uaMatchRule struct {
+	label    string
+	contains []string
+	allOf    []string
+	noneOf   []string
+}
+
+func matchUARules(uaLower string, rules []uaMatchRule, fallback string) string {
+	if uaLower == "" {
+		return uaLabelUnknown
+	}
+	for _, rule := range rules {
+		matched := false
+		for _, token := range rule.contains {
+			if strings.Contains(uaLower, token) {
+				matched = true
+				break
+			}
+		}
+		if !matched && len(rule.allOf) > 0 {
+			matched = true
+			for _, token := range rule.allOf {
+				if !strings.Contains(uaLower, token) {
+					matched = false
+					break
+				}
+			}
+		}
+		if !matched {
+			continue
+		}
+		excluded := false
+		for _, token := range rule.noneOf {
+			if strings.Contains(uaLower, token) {
+				excluded = true
+				break
+			}
+		}
+		if excluded {
+			continue
+		}
+		return rule.label
+	}
+	return fallback
+}
+
+var browserRules = []uaMatchRule{
+	{label: "WeChat", contains: []string{"micromessenger"}},
+	{label: "Postman", contains: []string{"postman"}},
+	{label: "CLI", contains: []string{"curl/", "wget/"}},
+	{label: "Edge", contains: []string{"edg/", "edgios/", "edga/"}},
+	{label: "Opera", contains: []string{"opr/", "opera"}},
+	{label: "Firefox", contains: []string{"firefox", "fxios"}},
+	{label: "Chrome", contains: []string{"crios", "chrome"}, noneOf: []string{"chromium"}},
+	{label: "Chromium", contains: []string{"chromium"}},
+	{label: "Safari", contains: []string{"safari"}},
+	{label: uaLabelBot, contains: []string{uaTokenBot, uaTokenSpider, uaTokenCrawler, "slurp"}},
+}
+
+var osRules = []uaMatchRule{
+	{label: "Android", contains: []string{uaTokenAndroid}},
+	{label: "iOS", contains: []string{"iphone", "ipad", "ipod", "ios"}},
+	{label: "Windows", contains: []string{"windows"}},
+	{label: "macOS", contains: []string{"mac os x", "macintosh", "macos"}},
+	{label: "Chrome OS", contains: []string{"cros"}},
+	{label: "Linux", contains: []string{"linux"}},
+	{label: uaLabelBot, contains: []string{uaTokenBot, uaTokenSpider, uaTokenCrawler}},
+}
+
+var deviceRules = []uaMatchRule{
+	{
+		label:    uaLabelBot,
+		contains: []string{uaTokenBot, uaTokenSpider, uaTokenCrawler, "slurp", "curl/", "wget/", "python-requests", "go-http-client", "postman"},
+	},
+	{
+		label:    "Tablet",
+		contains: []string{"ipad", "tablet"},
+	},
+	{
+		label:  "Tablet",
+		allOf:  []string{uaTokenAndroid},
+		noneOf: []string{"mobile"},
+	},
+	{
+		label:    "Mobile",
+		contains: []string{"mobi", "iphone", "ipod", uaTokenAndroid},
+	},
+}
+
 // ParseBrowserName performs lightweight User-Agent browser identification.
 func ParseBrowserName(ua string) string {
-	uaLower := strings.ToLower(ua)
-	if strings.Contains(uaLower, "micromessenger") {
-		return "WeChat"
-	}
-	if strings.Contains(uaLower, "postman") {
-		return "Postman"
-	}
-	if strings.Contains(uaLower, "edg/") || strings.Contains(uaLower, "edge") {
-		return "Edge"
-	}
-	if strings.Contains(uaLower, "firefox") {
-		return "Firefox"
-	}
-	if strings.Contains(uaLower, "chrome") {
-		return "Chrome"
-	}
-	if strings.Contains(uaLower, "safari") {
-		return "Safari"
-	}
-	return "Other"
+	return matchUARules(strings.ToLower(ua), browserRules, uaLabelOther)
+}
+
+// ParseOSName performs lightweight User-Agent OS identification.
+func ParseOSName(ua string) string {
+	return matchUARules(strings.ToLower(ua), osRules, uaLabelOther)
+}
+
+// ParseDeviceType performs lightweight User-Agent device type identification.
+func ParseDeviceType(ua string) string {
+	return matchUARules(strings.ToLower(ua), deviceRules, "Desktop")
 }

internal/repository/analytics/node_access_log.go

@@ -36,7 +36,7 @@ func ListNodeAccessLogs(ctx context.Context, filter NodeAccessLogFilter) ([]anal
 	clause, args := buildNodeAccessLogFilterClause(filter)
 	tableName := nodeAccessLogTableName()
 	sql := fmt.Sprintf(`
-SELECT id, node_id, logged_at, remote_addr, region, host, path, status_code, bytes_sent, request_length, request_time_ms, created_at
+SELECT id, node_id, logged_at, remote_addr, region, host, path, user_agent, status_code, bytes_sent, request_length, request_time_ms, created_at
 FROM %s
 WHERE %s
 ORDER BY %s`, tableName, clause, nodeAccessLogOrderClause(filter.SortBy, filter.SortOrder))
@@ -55,6 +55,7 @@ ORDER BY %s`, tableName, clause, nodeAccessLogOrderClause(filter.SortBy, filter.
 	return scanNodeAccessLogRows(rows)
 }
 
+//nolint:dupl // scan shapes differ by model fields; shared helper would obscure CH column mapping
 func scanNodeAccessLogRows(rows driver.Rows) ([]analyticsmodel.NodeAccessLog, error) {
 	var result []analyticsmodel.NodeAccessLog
 	for rows.Next() {
@@ -67,6 +68,7 @@ func scanNodeAccessLogRows(rows driver.Rows) ([]analyticsmodel.NodeAccessLog, er
 			&item.Region,
 			&item.Host,
 			&item.Path,
+			&item.UserAgent,
 			&item.StatusCode,
 			&item.BytesSent,
 			&item.RequestLength,
@@ -206,7 +208,7 @@ WHERE %s`, tableName, clause)
 }
 
 // ValueCountsNodeAccessLogs groups logs by a single dimension column.
-// Allowed columns: status_code, host, path, remote_addr.
+// Allowed columns: status_code, host, path, remote_addr, user_agent.
 func ValueCountsNodeAccessLogs(ctx context.Context, filter NodeAccessLogFilter, column string, limit int) ([]NodeAccessLogValueCount, error) {
 	conn, err := nodeAccessLogConn()
 	if err != nil {
@@ -261,6 +263,8 @@ func nodeAccessLogValueCountExpr(column string) (string, bool) {
 		return "trim(" + nodeAccessLogColumnPath + ")", true
 	case nodeAccessLogColumnRemoteAddr:
 		return "trim(" + nodeAccessLogColumnRemoteAddr + ")", true
+	case nodeAccessLogColumnUserAgent:
+		return "trim(" + nodeAccessLogColumnUserAgent + ")", true
 	default:
 		return "", false
 	}

internal/repository/analytics/node_access_log_filter.go

@@ -20,6 +20,7 @@ const (
 	nodeAccessLogColumnStatusCode = "status_code"
 	nodeAccessLogColumnHost       = "host"
 	nodeAccessLogColumnPath       = "path"
+	nodeAccessLogColumnUserAgent  = "user_agent"
 	nodeAccessLogColumnLoggedAt   = "logged_at"
 )
 

internal/repository/analytics/node_access_log_test.go

@@ -49,8 +49,9 @@ func TestBatchInsertNodeAccessLogs_UsesModelBatchSQL(t *testing.T) {
 	assert.True(t, mockBatch.sendCalled)
 	require.Len(t, mockBatch.rows, 1)
 	assert.Equal(t, "node-a", mockBatch.rows[0][1])
-	require.Len(t, mockBatch.rows[0], 12)
-	assert.Equal(t, uint64(2048), mockBatch.rows[0][8]) // bytes_sent
-	assert.Equal(t, uint64(0), mockBatch.rows[0][9])    // request_length
-	assert.Equal(t, uint32(0), mockBatch.rows[0][10])   // request_time_ms
+	require.Len(t, mockBatch.rows[0], 13)
+	assert.Equal(t, "", mockBatch.rows[0][7])           // user_agent
+	assert.Equal(t, uint64(2048), mockBatch.rows[0][9]) // bytes_sent
+	assert.Equal(t, uint64(0), mockBatch.rows[0][10])   // request_length
+	assert.Equal(t, uint32(0), mockBatch.rows[0][11])   // request_time_ms
 }

internal/repository/analytics/node_access_log_writer.go

@@ -46,6 +46,7 @@ func BatchInsertNodeAccessLogs(ctx context.Context, logs []analyticsmodel.NodeAc
 			logItem.Region,
 			logItem.Host,
 			logItem.Path,
+			strings.TrimSpace(logItem.UserAgent),
 			logItem.StatusCode,
 			logItem.BytesSent,
 			logItem.RequestLength,

internal/repository/analytics/node_observability.go

@@ -159,6 +159,7 @@ ORDER BY %s`, tableName, clause, nodeObservabilityCapturedAtOrderClause())
 	return scanNodeObsFrpcRows(rows)
 }
 
+//nolint:dupl // scan shapes differ by model fields; shared helper would obscure CH column mapping
 func scanNodeMetricSnapshotRows(rows driver.Rows) ([]analyticsmodel.NodeMetricSnapshot, error) {
 	var result []analyticsmodel.NodeMetricSnapshot
 	for rows.Next() {