<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
Not necessary. May be bottleneck in OS.<br>
<br>
21.04.16 19:25, Odhiambo Washington пишет:<br>
<span style="white-space: pre;">> So, what could possibly be
wrong with my setup, that squid consumes so much CPU?<br>
><br>
> On 21 April 2016 at 16:22, Yuri Voinov <<a class="moz-txt-link-abbreviated" href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:yvoinov@gmail.com"><mailto:yvoinov@gmail.com></a>> wrote:<br>
><br>
><br>
> It must not be. My most active setup has 3% CPU all time
dirung peak hours.<br>
><br>
> Typical view:<br>
><br>
> <a class="moz-txt-link-freetext" href="https://i1.someimage.com/NzM1erI.png">https://i1.someimage.com/NzM1erI.png</a><br>
><br>
><br>
> 21.04.16 19:18, Odhiambo Washington пишет:<br>
> > Is is expected that using<br>
> ssl_bump results into high CPU usage all the time?<br>
><br>
><br>
><br>
> > This is squid-3.5.17<br>
><br>
><br>
><br>
> > That is what I am seeing:<br>
><br>
><br>
><br>
> > last pid: 26673; load averages: 2.24, 2.00,<br>
>
2.10
<br>
> up 0+03:47:56 16:08:30<br>
><br>
> > 160 processes: 2 running, 157 sleeping, 1 zombie<br>
><br>
> > CPU: 86.1% user, 0.0% nice, 7.8% system, 3.3%
interrupt,<br>
> 2.7% idle<br>
><br>
> > Mem: 843M Active, 1942M Inact, 185M Wired, 43M
Cache, 89M<br>
> Buf, 97M Free<br>
><br>
> > Swap: 5900M Total, 1248K Used, 5899M Free<br>
><br>
><br>
><br>
> > PID USERNAME THR PRI NICE SIZE RES
STATE C <br>
> TIME WCPU COMMAND<br>
><br>
> > 13309 squid 17 20 0 305M 264M
uwait 0 <br>
> 7:38 80.86% squid<br>
><br>
> > 26088 squid 1 21 0 12812K 5352K
sbwait 1 <br>
> 0:04 2.49% ssl_crtd<br>
><br>
> > 26090 squid 1 20 0 12812K 5272K
sbwait 1 <br>
> 0:01 0.88% ssl_crtd<br>
><br>
><br>
><br>
><br>
><br>
> > My config has:<br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
> > acl no_ssl_interception ssl::server_name<br>
> "/usr/local/etc/squid/ssl_bump_broken_sites.txt"<br>
><br>
> > ssl_bump splice no_ssl_interception<br>
><br>
> > ssl_bump peek step1<br>
><br>
> > ssl_bump stare step2<br>
><br>
> > #ssl_bump bump all<br>
><br>
> > #ssl_bump splice all<br>
><br>
><br>
><br>
> > I think I read somewhere that 'ssl_bump splice
all" is the<br>
> default behaviour, hence why I have commented it out.
All I need<br>
> is just become a TCP tunnel without decrypting proxied
traffic.<br>
><br>
><br>
><br>
> > Thank you.<br>
><br>
><br>
><br>
><br>
><br>
> > --<br>
><br>
> > Best regards,<br>
><br>
> > Odhiambo WASHINGTON,<br>
><br>
> > Nairobi,KE<br>
><br>
> > +254 7 3200 0004/+254 7 2274 3223<br>
><br>
> > "Oh, the cruft."<br>
><br>
><br>
><br>
><br>
><br>
> > _______________________________________________<br>
><br>
> > squid-users mailing list<br>
><br>
> > <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>
<a class="moz-txt-link-rfc2396E" href="mailto:squid-users@lists.squid-cache.org"><mailto:squid-users@lists.squid-cache.org></a><br>
><br>
> > <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
><br>
><br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>
<a class="moz-txt-link-rfc2396E" href="mailto:squid-users@lists.squid-cache.org"><mailto:squid-users@lists.squid-cache.org></a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
><br>
><br>
><br>
><br>
> -- <br>
> Best regards,<br>
> Odhiambo WASHINGTON,<br>
> Nairobi,KE<br>
> +254 7 3200 0004/+254 7 2274 3223<br>
> "Oh, the cruft."</span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJXGNa7AAoJENNXIZxhPexGQw0H+QG5jXWboYFaClEOOwwMJ3Vl
<br>
KUI6h4pnzRrcSEkMNMu0bBRytqGVXzplK5cl2U4T+scDWWpCj3pgcb1i8wITtwze
<br>
nEhvCeG9Xq6BZujvIKvQ32pe64EIl/tjstbpxxMdGLprSFre5mUXKd1NG5JghD0E
<br>
7oWYvA/hNwo/rpevzxUzU9Z+FOmgRYJ+JEGThGa86Qe+bE3B2Kxt6RAVAUbRfBcY
<br>
M/xJBX9wgeBgxncYG0IFtbJEG12X2j9Y4KXIOoh3nTpinOi7nbACF2ryr2H7z+GT
<br>
pFuNWiSnf5eSz3lEdAv+GHPZb9Fg1noD8Mxq8+P83d4BwA/L2ba/DJIweVTSEpQ=
<br>
=asuL
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>