Squid proxy access log — Forensic Artifact Reference (Network)

01Location

Path set by the access_log directive in squid.conf; read the configuration before assuming a path
Rotated copies of the same file, if log rotation is configured

Which client address asked the proxy for which URL or host, and how did the proxy answer?
Roughly when did a transaction start, given the log time and the elapsed time?
Was an HTTPS connection tunnelled through the proxy, and how many bytes did the proxy send back to the client through it?

Format	Plain text, one line per transaction. The default 'squid' format is: %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt. A site can define other formats with logformat, so confirm which one wrote the file.
Applies to	Format codes as documented in the current Squid source. Older releases and sites with a custom logformat may differ.

Field	What it tells you
Time (%ts.%03tu)	Seconds since the epoch, then milliseconds: the 'current time' when the entry was written.
Elapsed (%tr)	Response time in milliseconds, printed in a field six characters wide.
Client address (%>a)	The client's source IP address as seen by the proxy.
Result/status (%Ss/%03>Hs)	Squid's request status such as TCP_MISS, a slash, then the HTTP status code sent to the client.
Size (%<st)	Total size of the reply sent to the client, after adaptation. It does not count the request.
Method and URL (%rm %ru)	The request method and the request URL received or computed and sanitized. For CONNECT the target is host and port only.
User (%[un)	The first available user name (authenticated, external ACL or SSL client name); a dash if none.
Hierarchy/peer (%Sh/%<a)	Squid's hierarchy status and the IP address of the last server or peer connection.
Content type (%mt)	The MIME content type of the reply.

Field	Encoding	Note
Time (%ts.%03tu)	Unix seconds and milliseconds (decimal text)	Written when the entry is logged, which is when the transaction finishes. Squid documents the transaction start separately (%tS); it is not part of the default format. Subtracting the elapsed time gives an estimate of the start, not a recorded start.

Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.

Collect the log files and the squid.conf that wrote them, including every logformat and access_log line. Without the configuration the columns are guesses.
Record the time zone of the proxy host. The time field is an epoch value; convert it to UTC and state the host's zone separately.
Check the first and last line against the requested window, and check whether rotation or a row limit cut the export short.
Read CONNECT lines as 'this client opened a tunnel to this host and port', never as a statement about what was inside it.
Map the client address to a host through the DHCP lease that was valid at that moment, then correlate with the DNS log. With an explicit proxy, the name may have been resolved by the proxy rather than by the client.

The log records what passed through this proxy. Traffic that bypassed it, or went to a destination the client reached without the proxy, is absent.
The time is the logging time, not the start. For a long transfer the two differ by the elapsed time, and a tunnel can stay open for minutes.
HTTPS inside a CONNECT tunnel is not decrypted by default. The size field is the reply size and says nothing about what was sent or typed.
A user name appears only if the proxy authenticated the client or an ACL helper supplied one. A dash does not mean an anonymous person.