When TCP_DENIED which rule was responsible

I know I have somehow introduced a very bad expression into a file.

I use the following acls to suck in lists of sites:
acl mailsites url_regex -i "/etc/squid/gamesites"
acl chatsites url_regex -i "/etc/squid/chatsites"

and the followin http_access rule
http_access deny chatsites all
http_access deny gamesites all

I am now getting odd matches. Almost all of the sites that have the odd
matches had '_' or '?' (underscores or question marks) in the url. Is there
anyway from looking at the logs to tell which file caused the site to be
denied. Has anyone worked out a shell or perl script to go through an acl
file and see which matched a URL? [I could write a very simple one, but I'm
lazy enough to ask first]I'm using the 2.2stable1 version that was
orginally installed even though I know the RedHat RPMS are upto stable4 or 5.]

I looked at the info in the log and parsed it out by hand, but it simply
had the basic log information.
time: 937766848.794
elapsed time for something?: 206
remotehost:192.168.120.17
code/status/peerstatus:TCP_DENIED/403
bytes: 1299
method: GET
url: http://www-rl.netscape.com/wtgn?
I don't know: -
mime/type?: NONE/-
I don't know: -

--
Josh Kuperman        Saratoga Springs Public Library
sar_kuper@sals.edu   49 Henry St  
518.584.7860x211     Saratoga Springs, NY 12866
http://www.library.saratoga.ny.us