Squid log reader

Reading Squid’s log files can be hard for us humans. This Perl script will help you decipher them.

Note that since Squid version 2.6 you can customize the log format. See http://www.squid-cache.org/Doc/config/logformat/ for details. I personally prefer this log format:

logformat squid %{%d.%m.%Y-%H:%M:%S}tl.%tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt



#!/usr/bin/perl -w
#
# Squid log reader
#
# Author: Christoph Haas <email@christoph-haas.de>
# License: GPL >= 2
#
# Version 1.01 (6.3..2005)

use Getopt::Std;
use Time::Local;
use strict;

$|=1;

my %opt=();
my $logfile;

unless ($ARGV[0])	# no arguments?
{
	&usage();
}

getopts("fu:i:ha:l:s:e:",\%opt);

if ($ARGV[0])
{
	print "Unknown option (".join('/', @ARGV).")\n" if @ARGV;
}

if (defined $opt{h})
{
	&usage;
}

if (defined $opt{l})
{
	$logfile = $opt{l};
}
else
{
	$logfile = 'access.log';
}

if (defined $opt{f})
{
	open (LOG, "tail -f $logfile|") || die "Where is '$logfile'?";
}
else
{
	open (LOG, "<$logfile") || die "Where is '$logfile'?";
}

my $starttime;
my $endtime;
if (defined $opt{s})
{
	$opt{s} =~ /^(\d+)\.(\d+)\.(\d+)-(\d+):(\d+)$/ or die "-s format looks weird\n";
	my ($startday, $startmonth, $startyear, $starthour, $startminute) = ($1, $2, $3, $4, $5);
	$startmonth--;
	$startyear-=1900;
	$starttime = timelocal(0,$startminute,$starthour,$startday,$startmonth,$startyear);
}
if (defined $opt{e})
{
	$opt{e} =~ /^(\d+)\.(\d+)\.(\d+)-(\d+):(\d+)$/ or die "-e format looks weird\n";
	my ($endday, $endmonth, $endyear, $endhour, $endminute) = ($1, $2, $3, $4, $5);
	$endmonth--;
	$endyear-=1900;
	$endtime = timelocal(0,$endminute,$endhour,$endday,$endmonth,$endyear);
}

my $line;
while (<LOG>)
{
	my ($timestamp, $junk, $ip, $errorcode, $size, $method, $url, $user,
		$routing, $mime_type)
		= split;

	# Handle options
	if (defined $opt{u})
	{
		next if $opt{u} ne $user;
	}

	if (defined $opt{i})
	{
		next if $opt{i} ne $ip;
	}

	if (defined $opt{a})
	{
		my $search = $opt{a};
		next if $url!~/$search/o;
	}

	if ($line++ == 0)
	{
		print "Log starts at ".localtime($timestamp)."\n";
	}

	if (defined $starttime && $starttime>0)
	{
		next if $timestamp < $starttime;
	}
	if (defined $endtime && $endtime>0)
	{
		exit if $timestamp > $endtime;
	}

	print "Time:           ".localtime($timestamp)."\n";
	print "IP:             $ip\n";
	print "Error:          $errorcode\n";
	print "Size:           $size Bytes\n";
	print "Method:         $method\n";
	print "URL:            $url\n";
	print "User:           $user\n";
	print "Routing method: $routing\n";
	print "MIME type:      $mime_type\n";
	print "--------------------------------\n";
}

close LOG;

######################

sub usage
{
	print "Usage: $0 [-f] [-i IP-address] [-u username]\n";
	print " -f         = follow access log file (like 'tail -f')\n";
	print " -u user    = show only accesses from this user\n";
	print " -a url     = show only accesses to this address/url\n";
	print " -i ipaddr  = show only accesses from this IP address\n";
	print " -l logfile = use this log file as input\n";
	print " -s dd.mm.yyyy-hh:mm   = start time (no entries before this time)\n";
	print " -e dd.mm.yyyy-hh:mm   = end time (no entries after this time)\n";
	print " -h         = show this usage information\n";
	exit 10;
}

3 thoughts on “Squid log reader

  • 2010-02-16 at 10:39
    Permalink

    this is what i am expecting

    Reply
  • 2012-09-14 at 03:01
    Permalink

    i have installed squid in centos 6.2 , but while adding squidguard…. filter is working together with squid…if anybody can give some idea,it would be helpful

    Reply
    • 2012-09-19 at 12:09
      Permalink

      sorry …i missed the “not working ” …

      i have installed squid in centos 6.2 , but while adding squidguard…. filter is not working together with squid…if anybody can give some idea,it would be helpful

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close