<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Amos,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Please find below my squid conf and access logs and memory output in MB. Appreciate any help.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="background:yellow;mso-highlight:yellow">Memory Info:</span><o:p></o:p></p>
<p class="MsoPlainText">[root@******prod ~]# free -m<o:p></o:p></p>
<p class="MsoPlainText"> total used free shared buffers cached<o:p></o:p></p>
<p class="MsoPlainText">Mem: 11845 4194 7651 41 190 1418<o:p></o:p></p>
<p class="MsoPlainText">-/+ buffers/cache: 2585 9260<o:p></o:p></p>
<p class="MsoPlainText">Swap: 25551 408 25143<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="background:yellow;mso-highlight:yellow">Squidconf:</span><o:p></o:p></p>
<p class="MsoPlainText">[root@******prod squid]# more squid.conf<o:p></o:p></p>
<p class="MsoPlainText">#<o:p></o:p></p>
<p class="MsoPlainText"># Recommended minimum configuration:<o:p></o:p></p>
<p class="MsoPlainText">#<o:p></o:p></p>
<p class="MsoPlainText">max_filedesc 4096<o:p></o:p></p>
<p class="MsoPlainText">acl manager proto cache_object<o:p></o:p></p>
<p class="MsoPlainText">visible_hostname ******prod<o:p></o:p></p>
<p class="MsoPlainText">logfile_rotate 10<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">access_log /cache/access.log<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">acl localnet src 172.16.0.0/16<o:p></o:p></p>
<p class="MsoPlainText">acl backoffice_users src 10.136.0.0/13<o:p></o:p></p>
<p class="MsoPlainText">acl h****_backoffice_users src 10.142.0.0/15<o:p></o:p></p>
<p class="MsoPlainText">acl re****_users src 10.128.0.0/13<o:p></o:p></p>
<p class="MsoPlainText">acl hcity_r*****_users src 10.134.0.0/15<o:p></o:p></p>
<p class="MsoPlainText">acl par**** url_regex par****<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">acl SSL_ports port 443<o:p></o:p></p>
<p class="MsoPlainText">acl Safe_ports port 80 # http<o:p></o:p></p>
<p class="MsoPlainText">#acl Safe_ports port 21 # ftp<o:p></o:p></p>
<p class="MsoPlainText">acl Safe_ports port 443 # https<o:p></o:p></p>
<p class="MsoPlainText">#acl Safe_ports port 70 # gopher<o:p></o:p></p>
<p class="MsoPlainText">#acl Safe_ports port 210 # wais<o:p></o:p></p>
<p class="MsoPlainText">#acl Safe_ports port 1025-65535 # unregistered ports<o:p></o:p></p>
<p class="MsoPlainText">#acl Safe_ports port 280 # http-mgmt<o:p></o:p></p>
<p class="MsoPlainText">#acl Safe_ports port 488 # gss-http<o:p></o:p></p>
<p class="MsoPlainText">#acl Safe_ports port 591 # filemaker<o:p></o:p></p>
<p class="MsoPlainText">#acl Safe_ports port 777 # multiling http<o:p></o:p></p>
<p class="MsoPlainText">acl CONNECT method CONNECT<o:p></o:p></p>
<p class="MsoPlainText">acl backoffice_allowed_sites url_regex "/etc/squid/backoffice_allowed_sites"<o:p></o:p></p>
<p class="MsoPlainText">acl h***_backoffice_allowed_sites url_regex "/etc/squid/backoffice_allowed_sites"<o:p></o:p></p>
<p class="MsoPlainText">acl backoffice_blocked_sites url_regex "/etc/squid/backoffice_blocklist"<o:p></o:p></p>
<p class="MsoPlainText">acl h***_backoffice_blocked_sites url_regex "/etc/squid/backoffice_blocklist"<o:p></o:p></p>
<p class="MsoPlainText">acl re****_allowed_sites url_regex "/etc/squid/re****_allowed_sites"<o:p></o:p></p>
<p class="MsoPlainText">acl h****_reg****_allowed_sites url_regex "/etc/squid/h***_reg*****_allowed_sites"<o:p></o:p></p>
<p class="MsoPlainText">#<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">http_access allow localnet reg***_allowed_sites<o:p></o:p></p>
<p class="MsoPlainText">http_access deny backoffice_users backoffice_blocked_sites<o:p></o:p></p>
<p class="MsoPlainText">http_access deny h***_backoffice_users backoffice_blocked_sites<o:p></o:p></p>
<p class="MsoPlainText">http_access allow backoffice_users backoffice_allowed_sites<o:p></o:p></p>
<p class="MsoPlainText">http_access allow h***_backoffice_users backoffice_allowed_sites<o:p></o:p></p>
<p class="MsoPlainText">http_access allow reg****_users reg****_allowed_sites<o:p></o:p></p>
<p class="MsoPlainText">http_access allow h***_reg****_users h***_reg****_allowed_sites<o:p></o:p></p>
<p class="MsoPlainText">no_cache deny par****<o:p></o:p></p>
<p class="MsoPlainText">http_access deny all<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">#http_access allow manager localhost<o:p></o:p></p>
<p class="MsoPlainText">#http_access deny manager<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"># Deny requests to certain unsafe ports<o:p></o:p></p>
<p class="MsoPlainText">http_access deny !Safe_ports<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"># Deny CONNECT to other than secure SSL ports<o:p></o:p></p>
<p class="MsoPlainText">#http_access deny CONNECT !SSL_ports<o:p></o:p></p>
<p class="MsoPlainText">http_access allow CONNECT SSL_ports<o:p></o:p></p>
<p class="MsoPlainText"># We strongly recommend the following be uncommented to protect innocent<o:p></o:p></p>
<p class="MsoPlainText"># web applications running on the proxy server who think the only<o:p></o:p></p>
<p class="MsoPlainText"># one who can access services on "localhost" is a local user<o:p></o:p></p>
<p class="MsoPlainText">http_access deny to_localhost<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"># Example rule allowing access from your local networks.<o:p></o:p></p>
<p class="MsoPlainText"># Adapt localnet in the ACL section to list your (internal) IP networks<o:p></o:p></p>
<p class="MsoPlainText"># from where browsing should be allowed<o:p></o:p></p>
<p class="MsoPlainText">#http_access allow localnet<o:p></o:p></p>
<p class="MsoPlainText">http_access allow localhost<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"># And finally deny all other access to this proxy<o:p></o:p></p>
<p class="MsoPlainText">http_access deny all<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"># Squid normally listens to port 3128<o:p></o:p></p>
<p class="MsoPlainText">http_port 3128 ssl-bump \<o:p></o:p></p>
<p class="MsoPlainText">key=/etc/squid/pc****sslcerts/pc*****prod.pkey \<o:p></o:p></p>
<p class="MsoPlainText">cert=/etc/squid/pc******sslcerts/pc*****prod.crt \<o:p></o:p></p>
<p class="MsoPlainText">generate-host-certificates=on dynamic_cert_mem_cache_size=4MB<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">acl step1 at_step SslBump1<o:p></o:p></p>
<p class="MsoPlainText">ssl_bump peek step1<o:p></o:p></p>
<p class="MsoPlainText">#ssl_bump bump all<o:p></o:p></p>
<p class="MsoPlainText">ssl_bump bump backoffice_users !localnet !h***_backoffice_users !reg****_users !h***_reg***_users !par***<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">#sslproxy_capath /etc/ssl/certs<o:p></o:p></p>
<p class="MsoPlainText">sslproxy_cert_error allow all<o:p></o:p></p>
<p class="MsoPlainText">always_direct allow all<o:p></o:p></p>
<p class="MsoPlainText">sslproxy_flags DONT_VERIFY_PEER<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB sslcrtd_children 8 startup=1 idle=1<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"># Uncomment and adjust the following to add a disk cache directory.<o:p></o:p></p>
<p class="MsoPlainText">#cache_dir ufs /cache/squid 10000 16 256<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"># Leave coredumps in the first cache dir<o:p></o:p></p>
<p class="MsoPlainText">#rdescoredump_dir /var/spool/squid<o:p></o:p></p>
<p class="MsoPlainText">#coredump_dir /var/log/squid/squid<o:p></o:p></p>
<p class="MsoPlainText">coredump_dir /cache/squid<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"># Add any of your own refresh_pattern entries above these.<o:p></o:p></p>
<p class="MsoPlainText">refresh_pattern ^ftp: 1440 20% 10080<o:p></o:p></p>
<p class="MsoPlainText">refresh_pattern ^gopher: 1440 0% 1440<o:p></o:p></p>
<p class="MsoPlainText">refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<o:p></o:p></p>
<p class="MsoPlainText">refresh_pattern . 0 20% 4320<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">#url_rewrite_access allow all<o:p></o:p></p>
<p class="MsoPlainText">#url_rewrite_program /usr/bin/squidGuard -c /etc/squid/squidguard.conf<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Accesslogs:<o:p></o:p></p>
<p class="MsoPlainText">1502424001.504 0 10.138.142.6 TCP_DENIED/403 4175 GET http://update.scansoft.com/GetCertificate.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.533 329 10.140.230.6 TAG_NONE/200 0 CONNECT watson.telemetry.microsoft.com:443 - HIER_DIRECT/65.55.252.202 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.543 0 10.141.80.6 TCP_DENIED/403 4167 GET http://update.scansoft.com/Version.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.546 331 10.140.230.6 TAG_NONE/200 0 CONNECT watson.telemetry.microsoft.com:443 - HIER_DIRECT/65.55.252.202 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.551 29923 10.130.27.24 TCP_MISS_ABORTED/000 0 GET http://pc-sep.pcwhq.par****.net:8014/secars/secars.dll? - HIER_DIRECT/10.1.2.35 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.571 0 10.141.108.6 TCP_DENIED/403 4269 GET http://update.scansoft.com/GetMessages.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.572 0 10.138.142.6 TCP_DENIED/403 4175 GET http://update.scansoft.com/GetCertificate.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.579 0 10.140.167.6 TCP_DENIED/403 4168 GET http://update.scansoft.com/Version.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.590 27992 10.140.248.7 TCP_MISS_ABORTED/000 0 GET http://pc-sep.pcwhq.par*****.net:8014/secars/secars.dll? - HIER_DIRECT/10.1.2.35 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.631 0 10.141.108.6 TCP_DENIED/403 4269 GET http://update.scansoft.com/GetMessages.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.643 0 10.138.142.6 TCP_DENIED/403 4175 GET http://update.scansoft.com/GetCertificate.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.646 0 10.136.76.7 TCP_MISS_ABORTED/000 0 POST https://watson.telemetry.microsoft.com/Telemetry.Request - HIER_DIRECT/65.55.252.202 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.654 29864 10.133.222.25 TCP_MISS_ABORTED/000 0 GET http://10.1.2.35:8014/secars/secars.dll? - HIER_DIRECT/10.1.2.35 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.670 1 10.140.167.6 TCP_DENIED/403 4168 GET http://update.scansoft.com/Version.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.676 0 10.141.215.6 TCP_DENIED/403 3998 OPTIONS http://172.16.4.19/PrintQueue/completed/ - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.678 29927 10.132.157.21 TCP_MISS_ABORTED/000 0 GET http://10.1.2.35:8014/secars/secars.dll? - HIER_DIRECT/10.1.2.35 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.688 0 10.141.108.6 TCP_DENIED/403 4269 GET http://update.scansoft.com/GetMessages.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.700 363 10.136.171.6 TAG_NONE/200 0 CONNECT watson.telemetry.microsoft.com:443 - HIER_DIRECT/65.55.252.202 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.702 365 10.138.31.10 TAG_NONE/200 0 CONNECT ent-shasta-rrs.symantec.com:443 - HIER_DIRECT/104.40.50.196 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.716 0 10.138.142.6 TCP_DENIED/403 4175 GET http://update.scansoft.com/GetCertificate.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.756 0 10.141.108.6 TCP_DENIED/403 4269 GET http://update.scansoft.com/GetMessages.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.782 0 10.140.230.6 TCP_MISS_ABORTED/000 0 POST https://watson.telemetry.microsoft.com/Telemetry.Request - HIER_DIRECT/65.55.252.202 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.782 0 10.140.230.6 TCP_MISS_ABORTED/000 0 POST https://watson.telemetry.microsoft.com/Telemetry.Request - HIER_DIRECT/65.55.252.202 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.787 29983 10.132.141.21 TCP_MISS_ABORTED/000 0 GET http://pc-sep.pcwhq.par***.net:8014/secars/secars.dll? - HIER_DIRECT/10.1.2.35 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.792 2 10.138.142.6 TCP_DENIED/403 4175 GET http://update.scansoft.com/GetCertificate.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.792 29928 10.128.101.24 TCP_MISS_ABORTED/000 0 GET http://pc-sep.pcwhq.par****.net:8014/secars/secars.dll? - HIER_DIRECT/10.1.2.35 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.815 0 10.141.108.6 TCP_DENIED/403 4269 GET http://update.scansoft.com/GetMessages.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.841 0 10.141.160.6 TCP_DENIED/403 4168 GET http://update.scansoft.com/Version.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.843 0 10.141.215.6 TCP_DENIED/403 3998 OPTIONS http://172.16.4.19/PrintQueue/completed/ - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.873 0 10.141.108.6 TCP_DENIED/403 4269 GET http://update.scansoft.com/GetMessages.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.892 29805 10.141.82.6 TCP_MISS_ABORTED/000 0 GET http://pc-sep.pcwhq.par****.net:8014/secars/secars.dll? - HIER_DIRECT/10.1.2.35 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.907 0 10.141.160.6 TCP_DENIED/403 4168 GET http://update.scansoft.com/Version.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.912 29990 10.128.10.24 TCP_MISS_ABORTED/000 0 GET http://10.1.2.35:8014/secars/secars.dll? - HIER_DIRECT/10.1.2.35 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.927 0 10.136.147.6 TCP_DENIED/403 4168 GET http://update.scansoft.com/Version.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.938 77 10.138.31.10 TCP_MISS/200 514 POST https://ent-shasta-rrs.symantec.com/mrclean? - HIER_DIRECT/104.40.50.196 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.946 29949 10.130.45.23 TCP_MISS_ABORTED/000 0 GET http://pc-sep.pcwhq.par*****.net:8014/secars/secars.dll? - HIER_DIRECT/10.1.2.35 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.974 0 10.141.160.6 TCP_DENIED/403 4168 GET http://update.scansoft.com/Version.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424001.976 28002 10.136.84.6 TCP_MISS_ABORTED/000 0 GET http://pc-sep.pcwhq.par****.net:8014/secars/secars.dll? - HIER_DIRECT/10.1.2.35 -<o:p></o:p></p>
<p class="MsoPlainText">1502424001.997 0 10.136.171.6 TCP_MISS_ABORTED/000 0 POST https://watson.telemetry.microsoft.com/Telemetry.Request - HIER_DIRECT/65.55.252.202 -<o:p></o:p></p>
<p class="MsoPlainText">1502424002.003 1 10.136.147.6 TCP_DENIED/403 4168 GET http://update.scansoft.com/Version.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText">1502424002.013 0 10.138.33.6 TCP_DENIED/403 4268 GET http://update.scansoft.com/GetMessages.asp? - HIER_NONE/- text/html<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="background:yellow;mso-highlight:yellow">Cachelog errors I am seeing daily:</span><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Error negotiating SSL connection on FD 26: error:140A1175:SSL routines:SSL_BYTES_TO_CIPHER_LIST:inappropriate fallback (1/-1)<o:p></o:p></p>
<p class="MsoPlainText">Error negotiating SSL connection on FD 1175: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown (1/0)<o:p></o:p></p>
<p class="MsoPlainText">2017/08/02 09:01:02 kid1| Error negotiating SSL on FD 989: error:00000000:lib(0):func(0):reason(0) (5/-1/104) ##Very rare i found few not frequently<o:p></o:p></p>
<p class="MsoPlainText">2017/08/02 09:01:43 kid1| Queue overload, rejecting # too many times<o:p></o:p></p>
<p class="MsoPlainText">2017/08/02 09:01:45 kid1| Error negotiating SSL connection on FD 1749: (104) Connection reset by peer ## too many times<o:p></o:p></p>
<p class="MsoPlainText">2017/08/02 10:12:58 kid1| WARNING: Closing client connection due to lifetime timeout ## only one<o:p></o:p></p>
<p class="MsoPlainText">2017/08/07 22:37:56 kid1| comm_open: socket failure: (24) Too many open files<o:p></o:p></p>
<p class="MsoPlainText">2017/08/07 22:39:37 kid1| WARNING: Error Pages Missing Language: en<o:p></o:p></p>
<p class="MsoPlainText">2017/08/07 22:39:37 kid1| '/usr/share/squid/errors/en-us/ERR_DNS_FAIL': (24) Too many open files<o:p></o:p></p>
<p class="MsoPlainText">2017/08/07 22:39:37 kid1| WARNING: Error Pages Missing Language: en-us<o:p></o:p></p>
<p class="MsoPlainText">2017/08/07 22:01:42 kid1| WARNING: All 32/32 ssl_crtd processes are busy.<o:p></o:p></p>
<p class="MsoPlainText">2017/08/07 22:01:42 kid1| WARNING: 32 pending requests queued<o:p></o:p></p>
<p class="MsoPlainText">2017/08/07 22:01:42 kid1| WARNING: Consider increasing the number of ssl_crtd processes in your config file.<o:p></o:p></p>
<p class="MsoPlainText">2017/08/11 00:58:56 kid1| WARNING: Closing client connection due to lifetime timeout<o:p></o:p></p>
<p class="MsoPlainText">2017/08/09 12:55:45 kid1| WARNING! Your cache is running out of filedescriptors<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks,<o:p></o:p></p>
<p class="MsoPlainText">Naresh<o:p></o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: squid-users [mailto:squid-users-bounces@lists.squid-cache.org] On Behalf Of Amos Jeffries<br>
Sent: Friday, August 11, 2017 12:51 AM<br>
To: squid-users@lists.squid-cache.org<br>
Subject: Re: [squid-users] Crash: every 19 hours: kernel: Out of memory: Kill process (squid)</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On 11/08/17 06:36, Cherukuri, Naresh wrote:<o:p></o:p></p>
<p class="MsoPlainText">> Eliezer,<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> I cannot say by client or network. But, for sure I can say we have around 7000 computers using squid as a proxy.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">FYI: that number means peak load may be as high as 70K RPS (~100 req/client), a quad-core machine might be able to handle that but the<o:p></o:p></p>
<p class="MsoPlainText">2.13 GHz CPU speed makes me doubtful. I'd plan for up to 4 machines of this type to be built in the medium-long term.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> From: Cherukuri, Naresh<o:p></o:p></p>
<p class="MsoPlainText">> Sent: Thursday, August 10, 2017 16:27<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> No this a physical box and we are using only for squid. We have 4
<o:p></o:p></p>
<p class="MsoPlainText">> cpu's and<o:p></o:p></p>
<p class="MsoPlainText">> 16 cores. Please find below for reference Accesslogs : redirected to
<o:p></o:p></p>
<p class="MsoPlainText">> /cache/squid<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">NP: I don't see any access logs details in your post. Just CPU specs and disk FS mappings.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> -----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">> From: Cherukuri, Naresh<o:p></o:p></p>
<p class="MsoPlainText">> Sent: Thursday, August 10, 2017 16:03<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Hello Eliezer,<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> We are using OS "Redhat 7" and squid version 3.5.20.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> As of now we are not using any cache, we already commented out. You want me try using cache by uncommenting the following line.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> # Uncomment and adjust the following to add a disk cache directory.<o:p></o:p></p>
<p class="MsoPlainText">> #cache_dir ufs /cache/squid 10000 16 256<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">No, suggestion was for the default memory-only cache. Which means no
<o:p></o:p></p>
<p class="MsoPlainText">cache_mem or cache_dir entries in your squid.conf (letting Squid use its
<o:p></o:p></p>
<p class="MsoPlainText">defaults). It should still be caching, just much less.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> From: squid-users On Behalf Of Cherukuri, Naresh<o:p></o:p></p>
<p class="MsoPlainText">> Sent: Tuesday, August 8, 2017 16:28<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Hello,<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> I am new to squid. I am getting a problem every 19 hours squid takes all RAM memory, then started taking swap in 20 minutes my swap is full. Then server side (OOM) is activating and killing all squid child's then finally killing squid
parent. Can someone help me how to address this problem?<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">FYI: My brief understanding of the OOM is that when the sum total of all
<o:p></o:p></p>
<p class="MsoPlainText">processes on the machine start consuming too mush RAM it kills off the
<o:p></o:p></p>
<p class="MsoPlainText">largest user. So it may be that Squid is using some large (but
<o:p></o:p></p>
<p class="MsoPlainText">reasonable) amount of RAM and something else entirely pushes it over the
<o:p></o:p></p>
<p class="MsoPlainText">edge - OOM just killing Squid because it has the most memory at that time.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">So, if you have any record of the machines memory usage by process over
<o:p></o:p></p>
<p class="MsoPlainText">time it would be good to know for certain whether it is Squid alone, or
<o:p></o:p></p>
<p class="MsoPlainText">squid + something else that is the problem. Something along the lines of
<o:p></o:p></p>
<p class="MsoPlainText">a log processor that kicks in once a day and uses lots of RAM briefly
<o:p></o:p></p>
<p class="MsoPlainText">may exist.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> Why every 19 hours my memory is going to full?<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> How much Ram do I need for following squid version?<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Squid Cache: Version 3.5.20<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> total used free shared buffers cached<o:p></o:p></p>
<p class="MsoPlainText">> Mem: 11845 2713 9132 14 71 1641 -/+ buffers/cache: 1000 10845<o:p></o:p></p>
<p class="MsoPlainText">> Swap: 25551 421 25130<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The biggest problem I see here is that there are no units. These could
<o:p></o:p></p>
<p class="MsoPlainText">be KB or GB for all we know.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Please clarify that missing info.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">FWIW: Squid with some minimal tuning runs fine on embeded devices with
<o:p></o:p></p>
<p class="MsoPlainText">32MB of RAM and has not had a memory leak in a long time. So it is
<o:p></o:p></p>
<p class="MsoPlainText">usually a matter of some feature misconfigured. That said there is an
<o:p></o:p></p>
<p class="MsoPlainText">issue with OpenSSL objects that can look like a memory leak in 3.x if
<o:p></o:p></p>
<p class="MsoPlainText">one is not careful.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">To see if anything is misconfigured please post your squid.conf (without
<o:p></o:p></p>
<p class="MsoPlainText">the #commented out lines) so we can review it for problems.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Cheers<o:p></o:p></p>
<p class="MsoPlainText">Amos<o:p></o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">squid-users mailing list<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:squid-users@lists.squid-cache.org"><span style="color:windowtext;text-decoration:none">squid-users@lists.squid-cache.org</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="http://lists.squid-cache.org/listinfo/squid-users"><span style="color:windowtext;text-decoration:none">http://lists.squid-cache.org/listinfo/squid-users</span></a><o:p></o:p></p>
</div>
</body>
</html>