Hi Jaspar I use an expression like this, which will work on almost all Limux machines, Cygwin on windows and I expect Mac OSX or a terminal in Android so long as you have a version of grep similar to GNU grep. echo "http://cache.pack.google.com/edgedl/chrome/win/34.0.1847.116_33.0.1750.154_chrome_updater.exe" | grep -Pi "pack.google.com/.*\.(exe|crx)" This shows a match, so I think your expression is OK. Do you have any refresh_pattern entries earlier in your squid.conf which may inadvertently match? I see some of your requests have a query string attached. Many squid.conf recipies have the following, which will block caching of URLs with query strings. acl QUERY urlpath_regex cgi-bin \? no_cache deny QUERY If you want to see the part of your query string after the ? in your log, you will have to add this to your squid.conf: strip_query_terms off But for privacy reasons you may not want to leave this on.