Newer version of squid (>2.6) supports sending data to a syslog-ng server.
Format of that is different from access.log found locally on the squid server, here it is:
Nov 18 14:25:46 http1 squid[3121]: 1227014746.221 112 10.2.104.110 TCP_MISS/200 11808 GET http://www.site.it/immagine.jpg - - image/jpeg
So, using SARG does not find any record.
Is it possible to improve sarg to read this type format file.