Sets Squid Proxy to log IP address from X-Forwarded-For header instead of the real client ip address if the X-Forwarded-For header exists.

squid-xff-log.conf

# Has XFF header with a value
acl has-xff req_header X-Forwarded-For ^(([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)|(\[([0-9a-f]+)?:([0-9a-f:]+)?:([0-9a-f]+|0-9\.]+)?\]))

# default logformat
logformat squid      %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt

# default logformat using XFF instead of client IP address
logformat squid-xff  %ts.%03tu %6tr %{X-Forwarded-For}>h %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt

# If no XFF header, use default format
access_log stdio:/var/log/squid/access.log squid !has-xff
# If XFF use XFF format
access_log stdio:/var/log/squid/access.log squid-xff has-xff

This is smarter, but requires Squid v3.5+:

http_port 3128 require-proxy-header
acl localnet src 10.0.0.0/8
proxy_protocol_access allow localnet
follow_x_forwarded_for allow localhost
follow_x_forwarded_for allow localnet
acl_uses_indirect_client on
delay_pool_uses_indirect_client on
log_uses_indirect_client on
tproxy_uses_indirect_client off