<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">W dniu 18.05.2017 o 14:48, erdosain9
pisze:<br>
</div>
<blockquote type="cite"
cite="mid:1495111693229-4682457.post@n4.nabble.com">
<pre wrap="">Hi.
Where i can find documentation for the opcion on squidclient, many of them
are self-explanatory but for example this:
[root@squid ~]# squidclient mgr:external_acl
HTTP/1.1 200 OK
Server: squid/3.5.20
Mime-Version: 1.0
Date: Thu, 18 May 2017 12:40:54 GMT
Content-Type: text/plain;charset=utf-8
Expires: Thu, 18 May 2017 12:40:54 GMT
Last-Modified: Thu, 18 May 2017 12:40:54 GMT
X-Cache: MISS from squid.xxxxxxx.lan
X-Cache-Lookup: MISS from squid.xxxxxxx.lan:3128
Connection: close
External ACL Statistics: i-full
Cache size: 13
program: /usr/lib64/squid/ext_kerberos_ldap_group_acl
number active: 5 of 5 (0 shutting down)
requests sent: 48
replies received: 48
queue length: 0
avg service time: 11 msec
ID # FD PID # Requests # Replies Flags Time Offset
Request
6 23 2134 48 48 0.011 0 (none)
7 25 2135 0 0 0.000 0 (none)
8 27 2136 0 0 0.000 0 (none)
9 29 2137 0 0 0.000 0 (none)
10 31 2138 0 0 0.000 0 (none)
Flags key:
B = BUSY
W = WRITING
C = CLOSING
S = SHUTDOWN PENDING
External ACL Statistics: i-limitado
Cache size: 29
program: /usr/lib64/squid/ext_kerberos_ldap_group_acl
number active: 5 of 5 (0 shutting down)
requests sent: 110
replies received: 110
queue length: 0
avg service time: 101 msec
ID # FD PID # Requests # Replies Flags Time Offset
Request
11 33 2139 110 110 0.014 0 (none)
12 35 2140 0 0 0.000 0 (none)
13 37 2141 0 0 0.000 0 (none)
14 39 2142 0 0 0.000 0 (none)
15 41 2143 0 0 0.000 0 (none)
Flags key:
B = BUSY
W = WRITING
C = CLOSING
S = SHUTDOWN PENDING
External ACL Statistics: i-sinlimite
Cache size: 51
program: /usr/lib64/squid/ext_kerberos_ldap_group_acl
number active: 5 of 5 (0 shutting down)
requests sent: 195
replies received: 195
queue length: 0
avg service time: -1441 msec
ID # FD PID # Requests # Replies Flags Time Offset
Request
16 43 2144 191 191 0.050 0 (none)
17 45 2145 1 1 0.175 0 (none)
18 47 2146 1 1 0.185 0 (none)
19 49 2147 1 1 0.130 0 (none)
20 51 2148 1 1 0.229 0 (none)
Flags key:
B = BUSY
W = WRITING
C = CLOSING
S = SHUTDOWN PENDING
I know that i dont have any user in External ACL Statistics: i-sinlimite...
then why those statistics (with request and replies and 5 of 5).
Thanks to all
--
View this message in context: <a class="moz-txt-link-freetext" href="http://squid-web-proxy-cache.1019090.n4.nabble.com/Documentation-for-squidclient-tp4682457.html">http://squid-web-proxy-cache.1019090.n4.nabble.com/Documentation-for-squidclient-tp4682457.html</a>
Sent from the Squid - Users mailing list archive at Nabble.com.
_______________________________________________
squid-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>
<a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a>
</pre>
</blockquote>
<p><font size="-1">As far as I remember, you have some ldap
group-based ACLs in your config. If any user is trying to access
site listed in that kind of ACL, this helper is checking is user
is in AD group that allows or disallows this action. <br>
</font></p>
<p><font size="-1">You may not have any user in i-sinlimite, but you
DO HAVE this ACL, so squid will always check that group and
find out that the result is negative. If you have no users in
this group and not going to have in near future, analyze your
ACL logic and remove this rule from configuration - this will
make squid faster for sure.</font></p>
<p><font size="-1">Your config is:<br>
</font></p>
<p><font size="-1">===begin conf sample===<br>
</font></p>
<pre wrap="">http_access allow localhost
http_access allow i-sinlimite
http_access allow sin_autenticacion
http_access allow i-limitado #!dominios_denegados
http_access allow i-full #!dominios_denegados
# And finally deny all other access to this proxy
http_access deny all
===end===
You have no user in this group, yet since it is the first rule, EVERY user has to be checked is he/she in <a class="moz-txt-link-abbreviated" href="mailto:i-sinlimite@xxxxxxx.LAN">i-sinlimite@xxxxxxx.LAN</a> group. What for, if group is not used? And it is not used in delay_class either.
When squid knows that user is not allowed by i-sinlimite, next rule (sin_autenticacion) is launched, but this is different, list-based ACL, don't now what is on the list - my guess is that's the list of sites that does not require an authentication. If so, it makes no sense - that kind of rule should be above any ACL that requires authentication.
So, most users will access most sites by rule i-limitado, but before, any user has to be checked by i-sinlimite. Makes no sense, really.
Second thing is that most of these ACLs are doing nothing, since your allow everything (!negation is disabled by # sign). Save some RAM consumed by helpers and reorganize your config.
Stats for i-sinlimite look good, although avg service time: -1441 msec is wrong (don't know why). Since that rule affects every user, delay caused by this hepler is added to every user's connection. As long as requests sent = recieved, there is no disaster anyway - users can browse The internet. Once more, remove that ACL and disable hepler.
IMHO you should build a test squid and do some practical learning how things work.
PS. Post your squid.conf every time; I rememer it from different thread, someone else may not.
</pre>
<pre class="moz-signature" cols="72">--
Greets, Dijx
</pre>
</body>
</html>