Squid

squid -k parse                                        # config errors, exits non-zero on failure
systemctl status squid                                # running, last start error
journalctl -u squid -n 50 --no-pager                  # startup and reconfigure messages
curl -x http://localhost:3128 -sI https://example.com # end-to-end from the proxy host
tail -n 20 /var/log/squid/access.log                  # what Squid decided for each request

acl localnet src 10.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80 443 21 70 210 1025-65535
acl CONNECT method CONNECT

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access deny all

debug_options ALL,1 28,3

squid -k reconfigure
tail -f /var/log/squid/cache.log | grep -E 'ACL|checking'

acl allowed dstdomain "/etc/squid/allowed-domains.txt"

http_port 3128
visible_hostname proxy.example.com

acl localnet src 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
acl SSL_ports port 443
acl Safe_ports port 80 443
acl CONNECT method CONNECT

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access deny all

cache_dir ufs /var/spool/squid 10000 16 256   # 10000 MB, 16 first-level, 256 second-level dirs
maximum_object_size 512 MB
cache_mem 512 MB
coredump_dir /var/spool/squid

access_log daemon:/var/log/squid/access.log squid
logfile_rotate 7

forwarded_for delete   # drop X-Forwarded-For so internal client IPs do not leak upstream
via off                # drop the Via header

squid -z                          # create cache_dir structure; run once with Squid stopped
systemctl enable --now squid      # needs root
squid -k parse && squid -k reconfigure   # after every change

# regex                        min(min) percent max(min) options
refresh_pattern -i \.(deb|rpm|whl|tgz)$ 10080  90%  43200  override-expire
refresh_pattern ^ftp:                   1440   20%  10080
refresh_pattern .                          0   20%   4320

curl -s http://localhost:3128/squid-internal-mgr/info | grep -iE 'hit ratio|StoreEntries|Storage'
curl -s http://localhost:3128/squid-internal-mgr/storedir | grep -E 'Maximum|Current'

acl PURGE method PURGE
http_access allow localhost PURGE
http_access deny PURGE

curl -s -o /dev/null -w '%{http_code}\n' -X PURGE -x http://localhost:3128 http://example.com/file

200

auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 20
auth_param basic realm Proxy
auth_param basic credentialsttl 2 hours

acl authenticated proxy_auth REQUIRED
http_access allow authenticated

htpasswd -c /etc/squid/passwd alice   # -c creates or overwrites the file; omit it to add users

# Intercept: the router or nftables redirects port 80 to 3129; clients have no proxy setting
http_port 3129 intercept

# Reverse proxy (accelerator) in front of one origin
http_port 80 accel defaultsite=app.example.com
cache_peer 192.0.2.5 parent 8080 0 no-query originserver name=app
acl our_sites dstdomain app.example.com
http_access allow our_sites
cache_peer_access app allow our_sites
cache_peer_access app deny all

cache_peer upstream.example.com parent 3128 0 no-query default
acl internal dstdomain .internal.example.com
never_direct deny internal   # internal hosts may go direct
never_direct allow all       # everything else must use a parent

awk '{print $9}' /var/log/squid/access.log | cut -d/ -f1 | sort | uniq -c

  8123 DEFAULT_PARENT
   212 HIER_DIRECT
    40 HIER_NONE

curl -s http://localhost:3128/squid-internal-mgr/info            # uptime, hit ratios, FD usage
curl -s http://localhost:3128/squid-internal-mgr/5min | grep -E 'client_http|server_http'
curl -s http://localhost:3128/squid-internal-mgr/info | grep -iE 'file desc'

#!/usr/bin/env bash
set -euo pipefail
proxy=${1:-http://localhost:3128}
canary=${2:-https://example.com}

squid -k parse >/dev/null 2>&1 || { echo "config invalid"; exit 1; }
systemctl is-active --quiet squid   || { echo "squid not running"; exit 1; }

code=$(curl -x "$proxy" -o /dev/null -sw '%{http_code}' --max-time 10 "$canary" || true)
[[ $code =~ ^(200|204|301|302)$ ]] || { echo "canary failed: HTTP $code"; exit 1; }

fd=$(curl -s "$proxy/squid-internal-mgr/info" | awk -F'\t' '/Number of file desc.*avail/ {print $2}')
echo "ok: canary $code, fds available $fd"

#!/usr/bin/env bash
set -euo pipefail
log=${1:-/var/log/squid/access.log}
mins=${2:-15}
since=$(( $(date +%s) - mins*60 ))

awk -v s="$since" '$1 >= s {
    n++; bytes += $5
    if ($4 ~ /HIT/)    hit++
    if ($4 ~ /DENIED/) deny++
    host=$7; sub(/^[a-z]+:\/\//,"",host); sub(/[:\/].*/,"",host); dst[host]++
    cli[$3]++
  }
  END {
    if (!n) { print "no requests in window"; exit }
    printf "requests: %d (%.1f/s)\n", n, n/(60*'"$mins"')
    printf "hit ratio: %.1f%%   denied: %.1f%%   traffic: %.1f MB\n", 100*hit/n, 100*deny/n, bytes/1048576
    print "top clients:";      for (c in cli) print "  " cli[c], c | "sort -rn | head -5"
    close("sort -rn | head -5")
    print "top destinations:"; for (d in dst) print "  " dst[d], d | "sort -rn | head -5"
  }' "$log"

#!/usr/bin/env bash
set -euo pipefail
proxy=${PROXY:-http://localhost:3128}
while IFS= read -r url; do
  [[ -z $url || $url == \#* ]] && continue
  code=$(curl -s -o /dev/null -w '%{http_code}' -X PURGE -x "$proxy" "$url")
  printf '%s  %s\n' "$code" "$url"
done < "${1:-urls.txt}"

# Result codes by count
awk '{print $4}' /var/log/squid/access.log | sort | uniq -c | sort -rn | head

# Top destination hosts
awk '{print $7}' /var/log/squid/access.log | sed -E 's#^[a-z]+://##; s#[:/].*##' | sort | uniq -c | sort -rn | head

# Top clients by request count
awk '{print $3}' /var/log/squid/access.log | sort | uniq -c | sort -rn | head

# Bytes served per client
awk '{b[$3]+=$5} END {for (c in b) printf "%12d %s\n", b[c], c}' /var/log/squid/access.log | sort -rn | head

# Denied requests with client and URL
awk '$4 ~ /DENIED/ {print $3, $7}' /var/log/squid/access.log | sort | uniq -c | sort -rn | head

# Hit ratio from the log
awk '{t++; if ($4 ~ /HIT/) h++} END {printf "%.1f%% of %d\n", 100*h/t, t}' /var/log/squid/access.log

# Requests per minute (strftime needs gawk)
gawk '{print strftime("%H:%M", $1)}' /var/log/squid/access.log | uniq -c | tail -20

# Status and total time for a site through the proxy, from a client
curl -x http://proxy.example.com:3128 -o /dev/null -sw '%{http_code} %{time_total}\n' https://example.com

# Show the running http_access rules (the "config" page is refused unless cachemgr_passwd allows it)
curl -s http://localhost:3128/squid-internal-mgr/config | grep -E '^http_access'

# Validate then reload
squid -k parse && squid -k reconfigure

# Slowest requests: elapsed time, status, URL
sort -k2 -rn /var/log/squid/access.log | awk '{print $2, $4, $7}' | head

# Bandwidth per destination host (bytes sent to client)
awk '{h=$7; sub(/^[a-z]+:\/\//,"",h); sub(/[:\/].*/,"",h); b[h]+=$5} END {for (x in b) printf "%12d %s\n", b[x], x}' /var/log/squid/access.log | sort -rn | head

# CONNECT (HTTPS) targets, which never cache
awk '$6=="CONNECT" {print $7}' /var/log/squid/access.log | sort | uniq -c | sort -rn | head

# Requests per authenticated user
awk '$8!="-" {print $8}' /var/log/squid/access.log | sort | uniq -c | sort -rn | head

# Average and max elapsed time in ms
awk '{s+=$2; if ($2>m) m=$2} END {printf "avg=%.0f max=%d n=%d\n", s/NR, m, NR}' /var/log/squid/access.log

# 5xx responses with the origin and hierarchy code
awk '$4 ~ /\/5[0-9][0-9]$/ {print $4, $9, $7}' /var/log/squid/access.log | sort | uniq -c | sort -rn | head

# Cache hit ratio for a single content type (e.g. images)
awk '$10 ~ /^image/ {t++; if ($4 ~ /HIT/) h++} END {if (t) printf "%.1f%% of %d\n", 100*h/t, t}' /var/log/squid/access.log

# File descriptor usage right now
curl -s http://localhost:3128/squid-internal-mgr/info | grep -iE 'file descriptor|Number of file'

# Live memory and disk cache utilisation
curl -s http://localhost:3128/squid-internal-mgr/info | grep -iE 'Storage (Mem|Swap) size|Maximum'

# Median object size served (needs numeric sort of bytes column)
awk '$5 ~ /^[0-9]+$/ {print $5}' /var/log/squid/access.log | sort -n | awk '{a[NR]=$1} END {print a[int(NR/2)]}'

# Clients exceeding a request-rate threshold in the last 10000 lines
tail -10000 /var/log/squid/access.log | awk '{c[$3]++} END {for (x in c) if (c[x] > 500) print c[x], x}' | sort -rn

# Which parent handled each miss
awk '$4 ~ /MISS/ {print $9}' /var/log/squid/access.log | cut -d/ -f1 | sort | uniq -c | sort -rn

# Open the cache manager menu (lists every mgr page available)
curl -s http://localhost:3128/squid-internal-mgr/menu

# Confirm the running binary and build options
squid -v | head -3

cache_mem 2048 MB                  # in-memory hot objects and in-transit data
maximum_object_size_in_memory 1 MB # objects larger than this never sit in cache_mem
maximum_object_size 4 GB           # ceiling for a single cached object on disk
minimum_object_size 0 KB
cache_replacement_policy heap LFUDA  # keep popular objects; better hit ratio than the default LRU for mixed sizes
memory_replacement_policy heap GDSF   # favour keeping many small objects in RAM
cache_swap_low 90                  # start replacement at 90% full
cache_swap_high 95                 # replace aggressively above 95%

cache_dir rock /var/spool/squid/rock 20000 max-size=32768   # small objects, one file, low overhead
cache_dir aufs /var/spool/squid/aufs 40000 16 256 min-size=32769   # larger objects, threaded I/O