<p dir="ltr">Hi Eliezer,</p>
<p dir="ltr">Thanks for your response.</p>
<p dir="ltr">I have set up a VM to test out configurations in the same data center and address space as the problematic one. <br>
What I haven't done is test it by rebuilding the squid configuration from the defaults up and trying to use the same IP, that will probably be what I'll try tomorrow.</p>
<p dir="ltr">Also, thanks for the tip on the CARP example. I was trying to find a configuration that took advantage of SMP, but I see how that complicates things further.</p>
<p dir="ltr">Thanks so much for the suggestions! I'll update this thread further if things start working a bit better. <br>
And thank you again for packaging newer squid versions for CentOS!</p>
<p dir="ltr">Pat Blair<br>
Sr. Unix Administrator<br>
Peapod, LLC<br>
<a href="mailto:pblair@peapod.com">pblair@peapod.com</a></p>
<div class="gmail_quote">On Oct 29, 2015 21:09, "Eliezer Croitoru" <<a href="mailto:eliezer@ngtech.co.il">eliezer@ngtech.co.il</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hey Patrick,<br>
<br>
Thanks for clearing the picture out.<br>
Since it's HTTPS traffic it will might be a bit difficult to debug.<br>
<br>
I wanted to notify you that squid 3.5.10 is suffering from some bugs but it is very hard for me to actually find this specific issue meet any of the know bugs else then one bug(something with ssl-bump).<br>
<br>
One thing I can think of in this scenario in order to maybe somehow change how things are would be to use a second proxy just for the test.<br>
If you can run another proxy on a tiny VM with another IP on the same DC as the existing one it would narrow down couple things.<br>
If it works OK with squid default conf file then try to assign the IP of the problematic proxy to the new one.<br>
If it works with the same IP it's an issue with something in the proxy setup or the conf.<br>
<br>
<br>
Another approach would be to use the secondary DC proxy as a cache_peer of the primary DC proxy to verify if it affects the traffic in a similar way.<br>
<br>
--<br>
In the first post you have mentioned this link:<br>
<a href="http://wiki.squid-cache.org/ConfigExamples/SmpCarpCluster" rel="noreferrer" target="_blank">http://wiki.squid-cache.org/ConfigExamples/SmpCarpCluster</a><br>
<br>
This specific example was intended for caching optimization or something similar.<br>
Since your case involves CONNECT requests which cannot be cached anyway and also this CARP has certain limitations I would first try to simplify the setup into a no-disk RAM only cache with couple workers rather then multi workers peering.<br>
The CARP example actually limits the whole service to the frontend capabilities and there for it's recommended to not use it if possible.<br>
Try a default squid.conf if possible.<br>
<br>
Since the issue can be reproduced very easily testing the different options will take couple minutes and can be done after work hours.<br>
<br>
The above options is what I would have tried with my own servers.<br>
<br>
Eliezer<br>
<br>
On 30/10/2015 01:17, Patrick Blair - Peapod wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
It is very unclear, our network team is trying to determine if a<br>
network issue may be in play, but we believe that is unlikely...<br>
<br>
I couldn't understand how you ran the tests.<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
>I do understand that you have two proxies and one is peering to the<br>
>other, right?<br>
</blockquote>
Apologies if that wasn't clear, I'll try to give a better explanation:<br>
<br>
- There is always one proxy in this situation.<br>
- The difference is that we run the proxy out of our secondary<br>
datacenter and route all user internet traffic through that location so it<br>
doesn't cause any issues with the traffic to our website flowing in and out<br>
of our primary datacenter.<br>
- A test instance I used to recreate the squid instance that is having<br>
the issues with, works as expected in our primary datacenter, however, the<br>
older version of squid we were using is located in the secondary datacenter<br>
and also works as expected, only the newer version doesn't work.<br>
<br>
<br>
Thanks for your help!<br>
<br>
Pat Blair<br>
Sr. Unix Administrator<br>
Peapod, LLC<br>
<a href="mailto:pblair@peapod.com" target="_blank">pblair@peapod.com</a><br>
</blockquote>
<br>
</blockquote></div>
<br>
<div>This email and any attachments may contain information that is proprietary,</div><div>confidential and/or privileged and for the sole use of the intended recipients(s)</div><div>only.</div><div>If you are not the intended recipient, please notify the sender by return</div><div>email and delete all copies of this email and any attachments. Ahold and/or its</div><div>subsidiaries shall neither be liable for the inaccurate or incomplete transmission</div><div>of the information contained in this email or any attachments, nor for any delay</div><div>in its receipt. To the extent this email is intended to create any legal obligation,</div><div>the obligation shall bind only the contracting entity and not any other entity within</div><div>the Ahold Group.</div>
<br>
<div>This email and any attachments may contain information that is proprietary,</div><div>confidential and/or privileged and for the sole use of the intended recipients(s)</div><div>only.</div><div>If you are not the intended recipient, please notify the sender by return</div><div>email and delete all copies of this email and any attachments. Ahold and/or its</div><div>subsidiaries shall neither be liable for the inaccurate or incomplete transmission</div><div>of the information contained in this email or any attachments, nor for any delay</div><div>in its receipt. To the extent this email is intended to create any legal obligation,</div><div>the obligation shall bind only the contracting entity and not any other entity within</div><div>the Ahold Group.</div>