Squid log reader

Reading Squid’s log files can be hard for us humans. This Perl script will help you decipher them.

Note that since Squid version 2.6 you can customize the log format. See http://www.squid-cache.org/Doc/config/logformat/ for details. I personally prefer this log format:

logformat squid %{%d.%m.%Y-%H:%M:%S}tl.%tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt



#!/usr/bin/perl -w
#
# Squid log reader
#
# Author: Christoph Haas <email@christoph-haas.de>
# License: GPL >= 2
#
# Version 1.01 (6.3..2005)

use Getopt::Std;
use Time::Local;
use strict;

$|=1;

my %opt=();
my $logfile;

unless ($ARGV[0])	# no arguments?
{
	&usage();
}

getopts("fu:i:ha:l:s:e:",\%opt);

if ($ARGV[0])
{
	print "Unknown option (".join('/', @ARGV).")\n" if @ARGV;
}

if (defined $opt{h})
{
	&usage;
}

if (defined $opt{l})
{
	$logfile = $opt{l};
}
else
{
	$logfile = 'access.log';
}

if (defined $opt{f})
{
	open (LOG, "tail -f $logfile|") || die "Where is '$logfile'?";
}
else
{
	open (LOG, "<$logfile") || die "Where is '$logfile'?";
}

my $starttime;
my $endtime;
if (defined $opt{s})
{
	$opt{s} =~ /^(\d+)\.(\d+)\.(\d+)-(\d+):(\d+)$/ or die "-s format looks weird\n";
	my ($startday, $startmonth, $startyear, $starthour, $startminute) = ($1, $2, $3, $4, $5);
	$startmonth--;
	$startyear-=1900;
	$starttime = timelocal(0,$startminute,$starthour,$startday,$startmonth,$startyear);
}
if (defined $opt{e})
{
	$opt{e} =~ /^(\d+)\.(\d+)\.(\d+)-(\d+):(\d+)$/ or die "-e format looks weird\n";
	my ($endday, $endmonth, $endyear, $endhour, $endminute) = ($1, $2, $3, $4, $5);
	$endmonth--;
	$endyear-=1900;
	$endtime = timelocal(0,$endminute,$endhour,$endday,$endmonth,$endyear);
}

my $line;
while (<LOG>)
{
	my ($timestamp, $junk, $ip, $errorcode, $size, $method, $url, $user,
		$routing, $mime_type)
		= split;

	# Handle options
	if (defined $opt{u})
	{
		next if $opt{u} ne $user;
	}

	if (defined $opt{i})
	{
		next if $opt{i} ne $ip;
	}

	if (defined $opt{a})
	{
		my $search = $opt{a};
		next if $url!~/$search/o;
	}

	if ($line++ == 0)
	{
		print "Log starts at ".localtime($timestamp)."\n";
	}

	if (defined $starttime && $starttime>0)
	{
		next if $timestamp < $starttime;
	}
	if (defined $endtime && $endtime>0)
	{
		exit if $timestamp > $endtime;
	}

	print "Time:           ".localtime($timestamp)."\n";
	print "IP:             $ip\n";
	print "Error:          $errorcode\n";
	print "Size:           $size Bytes\n";
	print "Method:         $method\n";
	print "URL:            $url\n";
	print "User:           $user\n";
	print "Routing method: $routing\n";
	print "MIME type:      $mime_type\n";
	print "--------------------------------\n";
}

close LOG;

######################

sub usage
{
	print "Usage: $0 [-f] [-i IP-address] [-u username]\n";
	print " -f         = follow access log file (like 'tail -f')\n";
	print " -u user    = show only accesses from this user\n";
	print " -a url     = show only accesses to this address/url\n";
	print " -i ipaddr  = show only accesses from this IP address\n";
	print " -l logfile = use this log file as input\n";
	print " -s dd.mm.yyyy-hh:mm   = start time (no entries before this time)\n";
	print " -e dd.mm.yyyy-hh:mm   = end time (no entries after this time)\n";
	print " -h         = show this usage information\n";
	exit 10;
}

3 thoughts on “Squid log reader”

  1. i have installed squid in centos 6.2 , but while adding squidguard…. filter is working together with squid…if anybody can give some idea,it would be helpful

    1. sorry …i missed the “not working ” …

      i have installed squid in centos 6.2 , but while adding squidguard…. filter is not working together with squid…if anybody can give some idea,it would be helpful

Leave a Reply

Your email address will not be published. Required fields are marked *

Scroll to Top