Squid stores the logs in the
access.log file in this format by default:
time elapsed remotehost code/status bytes method URL rfc931 peerstatus/peerhost type
what we need here is the
remotehost which is the IP address of the client, and
bytes which is the bytes received (downloaded) during the request.
If you're wondering, Squid counts the bytes for the CONNECT requests too.
You can code a script in any programming language to find the lines containing the client's IP address, then for each line, parse it to get the bytes and add them together. After that you have to remove the
access.log file so your script doesn't count the counted bytes again during the next script execution... Or instead of removing the access.log file you can make use of
time (in the log format) which is the timestamp of the request, and let your script count the bytes after the last script execution's timestamp. Or you can use
grep to find the lines containing the client IP and
sed to remove them from the
access.log file, see https://stackoverflow.com/a/11797762/8524395 and https://stackoverflow.com/a/5410784/8524395
You can even configure the log format to make it easier during coding. See http://www.squid-cache.org/Doc/config/logformat/ and https://wiki.squid-cache.org/Features/LogFormat
And you can also count the quota used by username if you don't need to do it by the client IP address. Do the same idea but first modify your logformat to contain the username, see:
un User name (any available)
ul User name from authentication
ue User name from external acl helper
ui User name from ident
un A user name. Expands to the first available name
from the following list of information sources:
- authenticated user name, like %ul
- user name supplied by an external ACL, like %ue
- SSL client name, like %us
- ident user name, like %ui
I've downloaded an exactly 100MB file through the Squid server using
access.log file logged the request as 105048163 bytes (105.048163 MB).
The same request was made again and the same bytes amount was logged.
Also the same test was done for an exactly 1GB (1000MB) file. Squid logged it as 1050436965 bytes (1050.436965 MB)