I'm not as familiar with Squid logs as I used to be with Apache logs - is the numeric value before the TCP_MISS:DIRECT the amount downloaded, or the final byte offset of the range of bytes downloaded? If the latter is the case, your plan will work, and the logs you show here could mean that someone started a download and the download was interrupted and then resumed. If the former is the case, it means that the user started a download, the download failed, and the user started the download again from the beginning, succeeding the second time - it can't ever represent a resumed download, and you'll never count them. You'll also never count files downloaded using download accelerators, which request multiple byte ranges of a file in parallel.