<div dir="ltr"><span style="font-size:12.8px">Hello,</span><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Having about 100% CPU usage after about an hour running. We operate Squid v 3.5 on multiple nodes. We range from 10 users, up through 200 on various nodes. We recently updated from 3.3 to 3.5 and I've been unable to contain the core usage of Squid. I attempted to get multiple Squid workers resulted in both cores getting pegged on our small servers. </div><div style="font-size:12.8px"><br></div><div><span style="font-size:12.8px">Dual core Intel(R) Celeron(R) M processor 1.50GHz</span><br></div><div><span style="font-size:12.8px">4GB RAM</span></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Here's the config we're currently running:</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div># Managed by Chef</div><div># Changes will be overwritten</div><div><br></div><div># Crazy debug</div><div>#debug_options ALL,0 11,5 20,5 17,5 23,5 26,5 28,5 44,5 55,5 61,5 78,5 83,5</div><div><br></div><div># Debug ACL issues</div><div>#debug_options ALL,1 28,4</div><div><br></div><div># Debug ACL issues full access</div><div>#debug_options ALL,1 28,2 28,9</div><div><br></div><div># Setup our local networks ACLs</div><div>acl VPN_Net src <a href="http://10.1.2.0/24" target="_blank">10.1.2.0/24</a></div><div>acl No_Auth_Net src <a href="http://10.10.1.0/24" target="_blank">10.10.1.0/24</a></div><div>acl Android_Server src <a href="http://10.10.1.1/32" target="_blank">10.10.1.1/32</a></div><div><br></div><div>acl SSL_ports port 443</div><div>acl Safe_ports port 80 # http</div><div>acl Safe_ports port 443 # https</div><div>acl CONNECT method CONNECT</div><div><br></div><div># Custom acl for Telmate-controlled sites</div><div>acl telmate_domains dstdomain .<a href="http://telmate.com/" target="_blank">telmate.com</a> .telmate.cc</div><div>request_header_add ****************************</div><div>request_header_add **********************</div><div><br></div><div>#</div><div># Content filtering</div><div>#</div><div>icap_enable on</div><div><br></div><div># unlimited icap failure</div><div>icap_service_failure_limit -1</div><div>icap_retry allow all</div><div>icap_send_client_ip on</div><div>icap_retry_limit -1</div><div><br></div><div>icap_service service_req reqmod_precache bypass=0 icap://<a href="http://127.0.0.1:1344/request" target="_blank">127.0.0.1:1344/request</a></div><div>adaptation_access service_req allow VPN_Net !CONNECT</div><div><br></div><div>icap_service service_resp respmod_precache bypass=0 icap://<a href="http://127.0.0.1:1344/response" target="_blank">127.0.0.1:1344/response</a></div><div>adaptation_access service_resp allow VPN_Net</div><div><br></div><div># Only allow cachemgr access from Android Server</div><div>http_access allow Android_Server manager</div><div>http_access deny manager</div><div><br></div><div># Deny requests to ports we don't allow</div><div>http_access deny !Safe_ports</div><div><br></div><div># Deny CONNECT to other than secure SSL ports</div><div>http_access deny CONNECT !SSL_ports</div><div><br></div><div># URL Filtering</div><div><br></div><div># acl No_Auth_Whitelist dstdomain "/etc/squid3/approved-sites.<wbr>squid"</div><div>acl No_Auth_Whitelist dstdomain "/etc/squid3/no-auth-approved-<wbr>sites.squid"</div><div><br></div><div># dedicated, no exception URL blacklist managed by chef only</div><div>acl blacklist-urls url_regex "/etc/squid3/blacklist-urls.<wbr>squid"</div><div>http_access deny blacklist-urls</div><div><br></div><div># Allow localhost access in case of misconfigured application</div><div>http_access allow localhost</div><div><br></div><div># Allow No_Auth_Net access to only the No auth whitelist</div><div>http_access allow No_Auth_Whitelist No_Auth_Net</div><div><br></div><div># CONNECT method requests only have an IP address, allow all SSL CONNECT handshakes</div><div>http_access allow No_Auth_Net CONNECT</div><div><br></div><div># Allow VPN_Net to anything as ICAP will be consulted for approval</div><div>http_access allow VPN_Net</div><div><br></div><div># Default catch all to deny access not specifically granted</div><div>http_access deny all</div><div><br></div><div><br></div><div># Squid proxy interception config</div><div>http_port <a href="http://10.10.1.1:3128/" target="_blank">10.10.1.1:3128</a></div><div>http_port <a href="http://10.10.1.1:3126/" target="_blank">10.10.1.1:3126</a> intercept</div><div>https_port <a href="http://10.10.1.1:3127/" target="_blank">10.10.1.1:3127</a> intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=<wbr>4MB cert=/etc/squid3/telmate-gk-<wbr>CA.pem</div><div><br></div><div># Proxy public hiding, don't tell site we are using a proxy</div><div>via off</div><div>forwarded_for off</div><div><br></div><div># ssl-bump goodies</div><div>always_direct allow all</div><div>ssl_bump server-first all</div><div><br></div><div># the following two options are unsafe and not always necessary:</div><div>sslproxy_cert_error allow all</div><div>sslproxy_flags DONT_VERIFY_PEER</div><div><br></div><div># Prepare ssl_db: Done in Chef</div><div># /usr/lib/squid3/ssl_crtd3 -c -s /var/spool/squid3/ssl_db -M 4MB</div><div># chown -R proxy:proxy /var/spool/squid3/ssl_db</div><div>sslcrtd_program /usr/lib/squid3/ssl_crtd3 -s /var/spool/squid3/ssl_db -M 4MB</div><div>sslcrtd_children 32 startup=5 idle=1</div><div><br></div><div># Shutdown Squid after 2 seconds to flush current connections, default is 10</div><div>shutdown_lifetime 2 seconds</div><div><br></div><div># Leave coredumps in the cache dir</div><div>coredump_dir /var/spool/squid3</div><div><br></div><div># Object size and lifetime settings</div><div>cache_mem 256 MB</div><div>maximum_object_size 1024 MB</div><div>range_offset_limit 200 MB</div><div>quick_abort_min -1</div><div>read_ahead_gap 50 MB</div><div><br></div><div># cache the health_check to give poor snap a break :(</div><div>refresh_pattern ^https://*************/health_<wbr>check 10 80% 30 override-expire override-lastmod ignore-reload ignore-no-store ignore-must-revalidate ignore-private ignore-auth store-stale</div><div><br></div><div>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0</div><div>refresh_pattern -i \.(iso|avi|wav|mp3|mp4|mpeg|<wbr>swf|flv|x-flv|mpg|wma|ogg|wmv|<wbr>asx|asf)$ 260000 90% 260009 override-expire</div><div>refresh_pattern -i zip$ 432000 100% 864000 override-expire</div><div>refresh_pattern . 0 20% 4320</div><div><br></div><div># Logging</div><div># Following logformat WITH request headers, VERY chatty, debug only</div><div># logformat squid %tl %5trms %>a %Ss/%03>Hs %<st %rm %>ru %mt %>ha</div><div>logformat squid-full %tl %5trms %>a %Ss/%03>Hs %<st %rm %>ru %mt</div><div>logformat squid %tl %5trms %>a %Ss/%03>Hs %<st %rm %ru %mt</div><div># Log query params for telmate traffic only</div><div>access_log daemon:/var/log/squid3/<wbr>telmate.log squid-full telmate_domains</div><div>access_log daemon:/var/log/squid3/access.<wbr>log squid</div><div><br></div><div># Cache_dir must be after maximum_object_size</div><div>cache_dir rock /var/spool/squid3 51200</div></div><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font color="#000000" face="sans-serif" style="text-align:-webkit-auto"><big style="margin:0px;padding:0px;border:0px rgb(225,225,225);font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;line-height:inherit;vertical-align:baseline"><b style="margin:0px;padding:0px;border:0px rgb(225,225,225);font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;line-height:inherit;vertical-align:baseline;color:rgb(45,92,136)">Michael Gibson</b></big></font></div><div><font color="#000000" face="sans-serif" style="text-align:-webkit-auto"><big style="margin:0px;padding:0px;border:0px rgb(225,225,225);font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;line-height:inherit;vertical-align:baseline"><b style="margin:0px;padding:0px;border:0px rgb(225,225,225);font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;line-height:inherit;vertical-align:baseline;color:rgb(45,92,136)">Linux Systems Administrator</b></big></font></div><div dir="ltr"><font color="#999999" face="sans-serif" style="text-align:-webkit-auto">655 Montgomery Street, 18th Floor<br>San Francisco, CA 94111<br>Email<span style="margin:0px;padding:0px;border:0px rgb(225,225,225);font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;line-height:inherit;vertical-align:baseline"> </span><a href="mailto:gibson@telmate.com" style="margin:0px;padding:0px;border:0px rgb(225,225,225);font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;line-height:inherit;vertical-align:baseline;outline:0px;max-width:100%;color:rgb(45,92,136)" target="_blank">gibson@telmate.com</a><br>Office<span style="margin:0px;padding:0px;border:0px rgb(225,225,225);font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;line-height:inherit;vertical-align:baseline"> </span><a value="+(415) 300-4321" style="margin:0px;padding:0px;border:0px rgb(225,225,225);font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;line-height:inherit;vertical-align:baseline;outline:0px;max-width:100%;color:rgb(38,98,148)">(415) 300-4015 </a><a href="http://www.telmate.com/" style="margin:0px;padding:0px;border:0px rgb(225,225,225);font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;line-height:inherit;vertical-align:baseline;outline:0px;max-width:100%;color:rgb(38,98,148)" target="_blank">www.Telmate.com</a> | <a href="http://www.gettingout.com/" style="margin:0px;padding:0px;border:0px rgb(225,225,225);font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;line-height:inherit;vertical-align:baseline;outline:0px;max-width:100%;color:rgb(38,98,148)" target="_blank">www.GettingOut.com</a> | <a href="https://www.facebook.com/pages/Gettingout/494201843984720" style="margin:0px;padding:0px;border:0px rgb(225,225,225);font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;line-height:inherit;vertical-align:baseline;outline:0px;max-width:100%;color:rgb(38,98,148)" target="_blank">GettingOut Facebook</a></font><font color="#999999" face="sans-serif" style="text-align:-webkit-auto"><br clear="all"><br clear="all"></font><a href="http://www.telmate.com/" style="margin:0px;padding:0px;border:0px rgb(225,225,225);font-family:"open sans",helveticaneue,"helvetica neue",helvetica,arial,sans-serif;line-height:11.6875px;vertical-align:baseline;outline:0px;max-width:100%;color:rgb(38,98,148)" target="_blank"><img src="http://www.telmate.com/media/images/logos/telmate_100x25.png" width="100" height="25" alt="Telmate" border="0" style="margin: 0px; padding: 0px; border: none rgb(225, 225, 225); font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; vertical-align: baseline; display: inline-block; max-width: 100%; height: auto;"></a><br></div></div></div></div></div></div></div></div></div></div></div></div>
</div>