Squid log reader

Reading Squid’s log files can be hard for us humans. This Perl script will help you decipher them.

Note that since Squid version 2.6 you can customize the log format. See http://www.squid-cache.org/Doc/config/logformat/ for details. I personally prefer this log format:

logformat squid %{%d.%m.%Y-%H:%M:%S}tl.%tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt

#!/usr/bin/perl -w
#
# Squid log reader
#
# Author: Christoph Haas <email@christoph-haas.de>
# License: GPL >= 2
#
# Version 1.01 (6.3..2005)

use Getopt::Std;
use Time::Local;
use strict;

$|=1;

my %opt=();
my $logfile;

unless ($ARGV[0])	# no arguments?
{
	&usage();
}

getopts("fu:i:ha:l:s:e:",\%opt);

if ($ARGV[0])
{
	print "Unknown option (".join('/', @ARGV).")\n" if @ARGV;
}

if (defined $opt{h})
{
	&usage;
}

if (defined $opt{l})
{
	$logfile = $opt{l};
}
else
{
	$logfile = 'access.log';
}

if (defined $opt{f})
{
	open (LOG, "tail -f $logfile|") || die "Where is '$logfile'?";
}
else
{
	open (LOG, "<$logfile") || die "Where is '$logfile'?";
}

my $starttime;
my $endtime;
if (defined $opt{s})
{
	$opt{s} =~ /^(\d+)\.(\d+)\.(\d+)-(\d+):(\d+)$/ or die "-s format looks weird\n";
	my ($startday, $startmonth, $startyear, $starthour, $startminute) = ($1, $2, $3, $4, $5);
	$startmonth--;
	$startyear-=1900;
	$starttime = timelocal(0,$startminute,$starthour,$startday,$startmonth,$startyear);
}
if (defined $opt{e})
{
	$opt{e} =~ /^(\d+)\.(\d+)\.(\d+)-(\d+):(\d+)$/ or die "-e format looks weird\n";
	my ($endday, $endmonth, $endyear, $endhour, $endminute) = ($1, $2, $3, $4, $5);
	$endmonth--;
	$endyear-=1900;
	$endtime = timelocal(0,$endminute,$endhour,$endday,$endmonth,$endyear);
}

my $line;
while (<LOG>)
{
	my ($timestamp, $junk, $ip, $errorcode, $size, $method, $url, $user,
		$routing, $mime_type)
		= split;

	# Handle options
	if (defined $opt{u})
	{
		next if $opt{u} ne $user;
	}

	if (defined $opt{i})
	{
		next if $opt{i} ne $ip;
	}

	if (defined $opt{a})
	{
		my $search = $opt{a};
		next if $url!~/$search/o;
	}

	if ($line++ == 0)
	{
		print "Log starts at ".localtime($timestamp)."\n";
	}

	if (defined $starttime && $starttime>0)
	{
		next if $timestamp < $starttime;
	}
	if (defined $endtime && $endtime>0)
	{
		exit if $timestamp > $endtime;
	}

	print "Time:           ".localtime($timestamp)."\n";
	print "IP:             $ip\n";
	print "Error:          $errorcode\n";
	print "Size:           $size Bytes\n";
	print "Method:         $method\n";
	print "URL:            $url\n";
	print "User:           $user\n";
	print "Routing method: $routing\n";
	print "MIME type:      $mime_type\n";
	print "--------------------------------\n";
}

close LOG;

######################

sub usage
{
	print "Usage: $0 [-f] [-i IP-address] [-u username]\n";
	print " -f         = follow access log file (like 'tail -f')\n";
	print " -u user    = show only accesses from this user\n";
	print " -a url     = show only accesses to this address/url\n";
	print " -i ipaddr  = show only accesses from this IP address\n";
	print " -l logfile = use this log file as input\n";
	print " -s dd.mm.yyyy-hh:mm   = start time (no entries before this time)\n";
	print " -e dd.mm.yyyy-hh:mm   = end time (no entries after this time)\n";
	print " -h         = show this usage information\n";
	exit 10;
}