Squid user upload/downloading to saturation
I have a proxy server with dansguardian for filtering sites. I am using cacti and other Monitoring tools to check the usage pattern and can see that someone is uploading/downloading files which results saturation.
Now the problem is how to pin point the exact user who is responsible for this? As through log (tail -f) its hard to capture.
As I am storing dansguardian log not proxy's so cant use sarg or other proxy log monitoring tools; so is there any tool which will pinpoint the user/users?