Squid's access.log is a native input format for the audit: no export screen, no conversion, no vendor console. If you run the internet's oldest proxy, you are one grep away from a shadow AI inventory.
The audit reads Squid's native log line directly. Rotate, slice by date, upload. That is the entire pipeline.
A mid-size university proxies both its research clusters and its teaching labs through Squid, with proxy auth on staff and cluster accounts. The audit ran once per network. Sample data.
Two audits, two governance paths: research findings went to the data-stewardship office, teaching findings to the academic-integrity committee. Splitting the export by network is what made both conversations precise.
Universities generate serious log volume. Three slicing habits keep uploads inside the caps and questions crisp.
Separate uploads per subnet range answer separate questions, as the scenario showed. One merged file answers a blurrier question with bigger numbers.
Rotated logs make windows trivial: last month is a file glob. Concatenate rotations up to 2,000,000 lines or 25 MB per full report.
CONNECT lines carry the hostname evidence. Grepping to them alone cuts file size sharply without losing a single AI finding.
Uploads are read once and discarded. Usernames appear only in your report's per-user table, paths never appear anywhere, and reports are deletable before their 90-day expiry.
Squid deployments mix authenticated and anonymous access more than any other source in this series.
Staff and cluster accounts produce named rows: jkovacs, smehta. In research settings those map to groups and grants, which is the accountability that matters.
"-" usernames fall back to client IPs, so teaching labs read per machine. For integrity questions, per-lab granularity is usually the right resolution anyway.
Both shapes coexist in one upload and in one report. The per-source table simply lists usernames and IPs together, each with its tools and hits.
| Report section | With access.log |
|---|---|
| Summary tiles | Full totals per uploaded slice: tools, high-risk, training exposure, abusive, unsanctioned. |
| Tool table | Every matched host with category, risk, sovereignty and dated training verdicts, API subdomains folded in via walk-up. |
| Per-source table | Auth usernames and client IPs as sources with per-tool hit counts. |
| Sanctioned split | Your approved list, per network slice if you audit per network. |
| CSV + PDF | Full-report tier: CSV for the data-stewardship office, PDF for the committee pack. |
Three pages of sample data show exactly what an access.log slice becomes: tiles, verdicts, per-source rows. Committee-ready without editing.
University shadow AI splits into three governance lanes. The report's columns tell you which lane each row belongs to.
Training verdicts and sovereignty flags on research-network tools. Grant conditions and ethics approvals hinge on exactly these columns.
Paraphrasers and homework tools on teaching networks, read as volume trends against the assessment calendar rather than as individual accusations.
Abusive-purpose flags and high-risk tools anywhere. The shortest list, the fastest action, usually a same-day block.
Semester-boundary re-runs per network keep all three lanes fed. Costs per report drop with packs, detailed on the pricing page.
No. The native format is supported directly, rotations concatenated and all. Custom logformats parse when a hostname is present on the line.
No. CONNECT lines log the destination hostname, which is the exact evidence the matcher consumes. No SSL bumping required.
Per network: research, teaching, halls, guest. Each slice becomes its own report, and each report lands with the committee that owns that network's question.
The upload contains hostnames, identities and timestamps; paths are dropped, the file is discarded post-run, reports delete on demand. That paragraph usually satisfies the review.
Yes, any archived rotation uploads like a current one. Retroactive baselines are the cheapest way to ground a policy debate in numbers.
Free previews for spot checks; $99 per full report, $60 each in the 5-pack. Two networks audited each semester is well under any committee's coffee budget. See pricing.
Ops teams automate what they repeat. The whole export step reduces to muscle memory.
A cron that gathers last month's rotations per subnet into dated files. Export day becomes "attach file", nothing more.
Keeping only tunnel lines cuts most of the volume while preserving every hostname the audit can use. One grep, kept in the runbook.
A quick line count against the 2,000,000-line cap decides full-month upload versus two half-month runs, before anything leaves the box.
Teams that script the slice run audits on time. Teams that export by hand run them "next sprint". The scenario university automated after their second manual quarter.
Your access.log already knows which AI tools the campus reaches. Slice one network's month and see the free totals today.
Run the free audit