Here is the actual command I use to audit my Squid proxy logs:
code:
zcat $(ls -tr access.log.*.gz) |cat - access.log|egrep -i "$(cat badwords)"|egrep -vi "$(cat goodwords)" >suspect.log
php -q suspect.php
The files "badwords" and "goodwords" contain the patterns that I am interested in.

The PHP script simply converts the log file to CSV for importing into Excel, converts timestamps to local time, and does a database lookup to the SQL proxy authorisation database to get users full names.

I use PHP rather than perl as perl gives me a blinding headache every time I read the O'Reilly book [Wink]