i suspect the "runtime" analysis of access.log is being done to stop the downloading file by client
i think there is a better idea to solve this: this should be done be squid internally because it's the best place to know how much was sent and to stop sending at "any" moment also, we could examine "content-length" for this purpose before sending something to the client
what do you think about that?
adding this to squid3 have to wait some time, because we (me&mateusz) are finishing our vary-etag support and i think we will have to reorganize our code in the near future...
regards mmatusiak
