[squid-users] SSLBump, system requirements ?
Yuri
yvoinov at gmail.com
Tue Mar 20 16:47:46 UTC 2018
20.03.2018 21:30, FredB пишет:
> Hi all,
>
> I'm testing SSLBump and Squid eats up all my CPU, maybe I made something wrong or maybe some updates are required ? Any advice would be greatly appreciated.
>
> Debian 8.10 64 bits, Squid 3.5.27 + 64 Go ram + SSD + 15 Cores Xeon(R) CPU E5-2637 v2 @ 3.50GHz
Big box. How much users and traffic?
>
> FI, I don't see anything about limit reached in kern.log (File descriptor or network)
>
> acl nobump dstdomain "/home/squid/domains" -> Some very used websites (google, fb, etc) otherwise the system dies after less 1 minute
> http_port 3128 ssl-bump cert=/etc/squid/ca_orion/cert generate-host-certificates=on dynamic_cert_mem_cache_size=500MB
> sslcrtd_program /usr/lib/squid/ssl_crtd -s /usr/lib/squid/ssl_db -M 100MB
Disbalanced config.
dynamic_cert_mem_cache_size=500MB
and only 100 MB on disk?
sslcrtd_program /usr/lib/squid/ssl_crtd -s /usr/lib/squid/ssl_db -M 100MB
> sslcrtd_children 2000 startup=100 idle=20
Why so much children? Again - for what workload?
> sslproxy_capath /etc/ssl/certs/
> sslproxy_foreign_intermediate_certs /etc/squid/ssl_certs/imtermediate.ca.pem
> acl step1 at_step SslBump1
> ssl_bump peek step1 all
> ssl_bump splice nobump
> ssl_bump bump all
>
> The sslcrtd_children increases quickly and permanently
>
> root at proxyorion5:/tmp# ps -edf | grep ssl | wc -l
> 1321
> root at proxyorion5:/tmp# ps -edf | grep ssl | wc -l
> 1341
> root at proxyorion5:/tmp# ps -edf | grep ssl | wc -l
> 1341
> root at proxyorion5:/tmp# ps -edf | grep ssl_crt | wc -l
> 1380
> root at proxyorion5:/tmp# ps -edf | grep ssl_crt | wc -l
> 1381
> root at proxyorion5:/tmp# ps -edf | grep ssl_crt | wc -l
> 1382
> root at proxyorion5:/tmp# ps -edf | grep ssl_crt | wc -l
> 1395
>
> Of course after a while 2000 is reached and the system becomes completely mad, but I already tried 200, 500, 1000, etc
>
> Right after squid start CPU and load average values are very, very, high
>
> top - 16:06:17 up 13 days, 2:46, 3 users, load average: 102,02, 56,67, 30,75
> Tasks: 1964 total, 3 running, 1961 sleeping, 0 stopped, 0 zombie
> %Cpu(s): 15,3 us, 3,7 sy, 0,0 ni, 80,2 id, 0,4 wa, 0,0 hi, 0,4 si, 0,0 st
> KiB Mem: 66086692 total, 52378248 used, 13708444 free, 2899764 buffers
> KiB Swap: 1952764 total, 0 used, 1952764 free. 32798948 cached Mem
>
> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
> 23711 squid 20 0 3438832 2,976g 13784 R 100,0 4,7 6:01.02 squid
> 23724 squid 20 0 24868 8552 4340 S 3,6 0,0 0:02.46 ssl_crtd
> 23712 squid 20 0 25132 8896 4428 R 3,0 0,0 0:02.62 ssl_crtd
> 23714 squid 20 0 24868 8556 4344 S 2,3 0,0 0:02.43 ssl_crtd
> 23716 squid 20 0 24868 8636 4428 S 2,3 0,0 0:02.26 ssl_crtd
> 23720 squid 20 0 24868 8612 4400 S 2,3 0,0 0:02.58 ssl_crtd
> 23771 squid 20 0 24868 8580 4368 S 2,0 0,0 0:01.86 ssl_crtd
> 23780 squid 20 0 24872 8484 4268 S 2,0 0,0 0:01.86 ssl_crtd
> 23787 squid 20 0 24868 8612 4404 S 2,0 0,0 0:01.92 ssl_crtd
.... what means some bottlenecks. Obviously.
>
>
> The same system without SSLBump and e2guardian (web filtering) added (I tried without more or less 10% CPU )
>
> Tasks: 304 total, 2 running, 302 sleeping, 0 stopped, 0 zombie
> %Cpu(s): 2,0 us, 1,1 sy, 0,0 ni, 95,9 id, 0,1 wa, 0,0 hi, 0,9 si, 0,0 st
> KiB Mem: 66086700 total, 65627952 used, 458748 free, 2652264 buffers
> KiB Swap: 1952764 total, 20884 used, 1931880 free. 32639208 cached Mem
>
> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
> 20389 e2guard+ 20 0 0,122t 1,133g 6144 S 28,6 1,8 191:06.50 e2guardian
> 20283 squid 20 0 21,761g 0,021t 8128 R 24,2 34,0 145:00.09 squid
> 101 root 20 0 0 0 0 S 1,3 0,0 19:05.09 kswapd1
> 100 root 20 0 0 0 0 S 1,0 0,0 22:41.82 kswapd0
> 8 root 20 0 0 0 0 S 0,7 0,0 68:49.48 rcu_sched
> 24 root 20 0 0 0 0 S 0,3 0,0 8:37.14 ksoftirqd/3
> 65 root 20 0 0 0 0 S 0,3 0,0 8:05.02 ksoftirqd/11
> 929 root 20 0 71928 6984 4716 S 0,3 0,0 17:53.57 syslog-ng
> 8069 root 20 0 0 0 0 S 0,3 0,0 0:22.35 kworker/0:0
> 16624 root 20 0 25868 3236 2592 R 0,3 0,0 0:00.19 top
> 20291 squid 20 0 59504 5228 4568 S 0,3 0,0 0:03.41 digest_
>
> FredB
>
> _______________________________________________
> squid-users mailing list
> squid-users at lists.squid-cache.org
> http://lists.squid-cache.org/listinfo/squid-users
--
"C++ seems like a language suitable for firing other people's legs."
*****************************
* C++20 : Bug to the future *
*****************************
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: OpenPGP digital signature
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20180320/9f4f62cc/attachment-0001.sig>
More information about the squid-users
mailing list