[squid-users] c-icap, clamav and squid

[Alex Rousskov]

On 2/12/21 4:31 AM, Vieri wrote:

> I've had a c-icap/squid failure and noticed that it was because my tmpfs on /var/tmp was full (12 GB).
> 
> It was filled with files such as these:
> 
> # lsof +D /var/tmp/
> COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF       NODE NAME
> c-icap     773 root   31u   REG   0,48     1204 2169779504 /var/tmp/CI_TMP_xqWE8                                                       B
> c-icap    3080 root   29u   REG   0,48     1204 2169784571 /var/tmp/CI_TMP_pE6B7                                                       6
> 
> The fact that these files build up and are not deleted might be a side-effect of something that's failing.
> 
> Do you think that the c-icap process is the only one responsible for cleaning these files up?
> Or is there some Squid configuration option or a cache log event I should check regarding this?


Definitely not Squid configuration. Squid does not know anything about
these files or even about c-icap/clamav purposes. The ICAP protocol does
not have a notion of a disk file.

If there are no live ICAP transactions using those files, then somebody
(c-icap and/or clamav) is not deleting unused files when they should be
deleting them. The latter could mean a misconfigured lazy garbage
collection, overload conditions, or bugs, but it will be all on the ICAP
service side. I do not know enough about c-icap and do not remember
enough about clamav to guide you to a solution, unfortunately.

Alex.