[squid-users] Sudden but sustained high bandwidth usage

[Heiler Bemerguy]

Hi Amos,

You didn't notice it was always the same client ? The same IP address 
redownloading ad eternum..

I managed to fix it by not caching stuff with "?" in it:

*refresh_pattern -i (/cgi-bin/|\?) 0 0% 0*

But I don't know if it's the best approach..

The URL was like that:
/10.101.1.50 TCP_HIT/206 402 GET 
//http://bg.v4.a.dl.ws.microsoft.com/dl/content/d/updt/2015/07/096c4bbc-4bc2-4ba1-8fd7-2e8cf3fb1937_132a7d6799d3bd625b0e5b375aa13552593bf0ed.appxbundle//? 
- HIER_NONE/- application/octet-stream/

(After the "?" there were some variables)

Anyways, this isn't the cause of the ultra-high bandwidth load.. (*our 
DL link is 100% used by squid right now!*). Most traffic comes from 
windows updates...

/1457015568.658   9400 10.12.0.197 *TCP_SWAPFAIL_MISS/206* 1067290 GET 
http://au.v4.download.*windowsupdate*.com/c/msdownload/update/software/crup/2015/02/publisher-x-none_08ccd79ac8a6bb475040360b6c9d8c9e1f258c9d.*cab 
*- HIER_DIRECT/201.30.251.40 application/octet-stream//
//1457015624.067  36878 10.12.0.234 *TCP_MISS/206* 77842 GET 
http://au.v4.download.*windowsupdate*.com/d/msdownload/update/software/crup/2014/02/windows8.1-kb2919355-x64_66955196a82751d1c8d9806d321487562b159f41.*psf 
*- HIER_DIRECT/201.30.251.40 application/octet-stream//
//1457015750.556 126469 10.12.0.234 *TCP_MISS/206* 151183 GET 
http://au.v4.download.*windowsupdate*.com/d/msdownload/update/software/crup/2014/02/windows8.1-kb2919355-x64_66955196a82751d1c8d9806d321487562b159f41.*psf 
*- HIER_DIRECT/201.30.251.40 application/octet-stream//
//1457015753.263  11011 10.12.0.197 *TCP_MISS/206* 1616920 GET 
http://au.v4.download.*windowsupdate*.com/c/msdownload/update/software/crup/2015/03/onenote-x-none_dd4f2bc75fc38be514c4009ce4d289e41f6b75d0.*cab 
*- HIER_DIRECT/201.30.251.40 application/octet-stream//
//1457015780.978  13451 10.12.0.197 *TCP_SWAPFAIL_MISS/206* 2225824 GET 
http://au.v4.download.*windowsupdate*.com/c/msdownload/update/software/crup/2015/03/onenote-x-none_dd4f2bc75fc38be514c4009ce4d289e41f6b75d0.*cab 
*- HIER_DIRECT/201.30.251.40 application/octet-stream/

Do you see anything that could make it re-download over and over again 
in this config?

/acl windowsupdate dstdomain .ws.microsoft.com 
.windowsupdate.microsoft.com .update.microsoft.com .windowsupdate.com 
.armdl.adobe.com//
//http_access allow windowsupdate//
//range_offset_limit none windowsupdate//
//
//maximum_object_size 10 GB//
//cache_mem 4 GB//
//maximum_object_size_in_memory 2 MB//
//memory_replacement_policy heap GDSF//
//cache_replacement_policy heap LFUDA//
//
//cache_dir rock /cache2/rock1 90000 min-size=0 max-size=32768//
//cache_dir rock /cache/rock1 300000 min-size=32769 max-size=10737418240//
//
//refresh_pattern -i 
(microsoft|windowsupdate)\.com.*\.(cab|exe|ms[i|u|f]|dat|zip|psf|appx|esd)$ 
483840 80% 483840 override-expire ignore-reload//
// ignore-must-revalidate ignore-private ignore-no-store store-stale//
//refresh_pattern -i \.aspx$ 0 0% 0//
//refresh_pattern -i (/cgi-bin/|\?) 0 0% 0//
//refresh_pattern . 0 50% 10080 store-stale//
//
//read_ahead_gap 4096 KB//
//client_request_buffer_max_size 128 KB//
//connect_timeout 60 seconds//
//request_timeout 30 seconds//
//reload_into_ims on//
//via off/

Best Regards,

-- 
Heiler Bemerguy - (91) 98151-4894
Assessor Técnico - CINBESA (91) 3184-1751


Em 03/03/2016 01:42, Amos Jeffries escreveu:
> On 3/03/2016 10:33 a.m., Heiler Bemerguy wrote:
>> Hello guys..
>>
>> Thanks for the tips. I've ajusted some stuff here and noticed these
>> repeated GETS below.. they are HITS, but why is this happening?
> Because lots of clients want the object(s).
>
> If they are HITs then whats the problem? Squid is doing what you asked
> it to. Caching the traffic and presenting it whenever a client asks.
>
>
> Amos
>
> _______________________________________________
> squid-users mailing list
> squid-users at lists.squid-cache.org
> http://lists.squid-cache.org/listinfo/squid-users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20160303/f94179e6/attachment.html>