[squid-users] Squid stopped writing the log files... just for a while.

[Antony Stone]

On Wednesday 23 August 2017 at 15:26:53, Verónica Ovando wrote:

> >> Hi all.
> >> 
> >> Squid has a strange behavior: suddenly, it stops writing the log files
> >> (access.log and cache.log) for about 30 seconds clients cannot access
> >> the cache.

> > 10. What does access_log tell you about the requests immediately before,
> > and during, the 30 second holdup?
>
> Nothing. Squid continues responding all the requests normally.

I'm puzzled by the two statements:

"it stops writing the log files for about 30 seconds [and] clients cannot 
access the cache" and
"Squid continues responding [to] all the requests normally".

So, are you saying that Squid is processing requests and returning content 
quite normally, without the users noticing any problem, and it's just that the 
log files are not being written for 30 seconds or so?

Are you saying that all requests get fetched directly from the origin servers, 
and the cache is not being used, for these 30 seconds?

Maybe you could clarify?

> This is the last request until it holdups:
> 1503416750.346    386 192.168.0.2 TCP_REFRESH_UNMODIFIED/304 235 GET
> http://www.mysite.com user HIER_DIRECT/www.mysite.com - This is the next
> request:
> 1503416781.864 141376 192.168.0.2 TCP_MISS/200 5599 CONNECT
> play.google.com:443 user HIER_DIRECT/play.google.com -

Okay, so I see there's a 36 second gap between those two requests; were 
clients sending requests during that time?

Have you tried doing a packet capture on the Squid box's interfaces to see 
whether client requests are coming in, but Squid is not sending the proxied 
requests out, or whether it's sending the requests, egtting the response, but 
not sending that back to the client?


Antony.

-- 
"In fact I wanted to be John Cleese and it took me some time to realise that 
the job was already taken."

 - Douglas Adams

                                                   Please reply to the list;
                                                         please *don't* CC me.