we are given a squid_access.log squid proxy log file and are asked the following questions:

1. In what year was this log saved?
2. How many milliseconds did the fastest request take?
3. How many milliseconds did the longest request take?
4. How many different IP addresses did the proxy service in this log?
5. How many GET requests were made?
6. How many POST requests were made?
7. What company created the antivirus used on the host at 192.168.0.224?
8. What url is used to download an antivirus update?

just for my own sanity, and to easily answer some of the date/time related questions, let's convert all the timestamps from Epoch time to regular timestamps:

Click to reveal

awk '{ cmd="date -d @"$1" \"+%Y-%m-%d %H:%M:%S\""; cmd | getline date; close(cmd); print date, $0 }' squid_access.log > new.log

head new.log

looks pretty good. now we can easily answer Question 1.

On to Question 2. in order to answer this one, we need to understand the structure of squid logs. squid logs don't have column headers, but if they did, they would look like this:

Timestamp Response_Time_ms Client_IP Result_Code Size_Bytes HTTP_Method URL User_Ident Hierarchy_Status Content_Type

1619654401.123 456 192.168.1.100 TCP_MISS/200 512 GET http://example.com/index.html - HIER_DIRECT/93.184.216.34 text/html

with each column being space delimited. again, that's:

Timestamp Response_Time_ms Client_IP Result-Code Size_Bytes HTTP_Method URL User_Ident Hierarchy_Status Content_Type

10 columns total.

To answer Question 2, we need to isolate column 2 in the original log file (the one that's properly space-delimited) using awk, and then sort -n to "sort by number smallest to largest".

Click to reveal

awk '{print $2}' squid_access.log | sort -n | head -1

to get the next question, we do a similar statement, but use sort -nr instead ("sort by number smallest to largest, but in reverse)

Click to reveal

awk '{print $2}' squid_access.log | sort -nr | head -1

for this next question, we're going to awk again, sort -u to grab unique IP addresses, and then wc -l to grab a total number of unique IPs:

Click to reveal

awk '{print $3}' squid_access.log | sort -u > IPs.txt; wc -l IPs.txt (remember, column 3 is the Client_IP column)

Easy enough. For the Question 5, let's continue awking, this time isolating column 6 (HTTP_method), and then grepping with wc -l to find the specifics:

Click to reveal

awk '{print $6}' squid_access.log > requests.log

cat requests.log| grep 'GET' | wc -l

and again but for POST for Question 6:

cat requests.log| grep 'POST' | wc -l

for Question 7, i honestly have no idea how to find this, so let's just grep for it and see if we get lucky:

Click to reveal

grep '192.168.0.224' squid_access.log

we can clearly see in the URL that this is a symantec domain and with a keen eye, we can see norton in the URL.

NOTE: if you get a question similar to this in the future, always do <company> <software>, similar to how you'd do <make> <model> for a car.

Making good progress. awk and grep are our friends when parsing through squid logs, for sure!

On to the last question. we already have the answer on our screen, we just need a keen eye once more. updates are files that get unpacked and installed. so using the above command again, but adding zip, we can further isolate and be sure to copy/paste the proper information:

Click to reveal

grep '192.168.0.224' squid_access.log | grep 'zip'

And there we have it! Squid Logs? DONE!