<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:2.0cm 42.5pt 2.0cm 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>I cron those for memory, try it.<br>0 */1 * * * root /usr/sbin/sysctl -w vm.drop_caches=3<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>0 */1 * * * root /bin/sync && /bin/echo 3 | /usr/bin/tee /proc/sys/vm/drop_cache<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=RU style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span lang=RU style='font-size:11.0pt;font-family:"Calibri",sans-serif'> squid-users [mailto:squid-users-bounces@lists.squid-cache.org] <b>On Behalf Of </b>minh hung d? hoang<br><b>Sent:</b> Wednesday, February 7, 2018 9:35 AM<br><b>To:</b> squid-users@lists.squid-cache.org<br><b>Subject:</b> [squid-users] 3.5.20 run out of my memory.<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><div><div><p class=MsoNormal>Dear all, i use squid 3.5.20 on ubuntu14 in TPROXY mode.<o:p></o:p></p></div><p class=MsoNormal>With basic config in squid.conf, but squid is run out of my server's memory.<o:p></o:p></p></div><p class=MsoNormal>Here is my configure option :<br><br>'--prefix=/usr' '--includedir=/usr/include' '--infodir=/usr/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--libexecdir=/usr/lib/squid' '--srcdir=.' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--mandir=/usr/share/man' '--enable-inline' '--enable-async-io=24' '--enable-storeio=ufs,aufs,diskd,rock' '--enable-removal-policies=lru,heap' '--enable-gnuregex' '--enable-delay-pools' '--enable-cache-digests' '--enable-underscores' '--enable-icap-client' '--enable-follow-x-forwarded-for' '--enable-eui' '--enable-esi' '--enable-icmp' '--enable-zph-qos' '--enable-http-violations' '--enable-ssl-crtd' '--enable-linux-netfilter' '--enable-ltdl-install' '--enable-ltdl-convenience' '--enable-x-accelerator-vary' '--disable-maintainer-mode' '--disable-dependency-tracking' '--disable-silent-rules' '--disable-translation' '--disable-ipv6' '--disable-ident-lookups' '--with-swapdir=/var/spool/squid' '--with-logdir=/var/log/squid' '--with-pidfile=/var/run/squid.pid' '--with-aufs-threads=24' '--with-filedescriptors=65536' '--with-large-files' '--with-maxfd=65536' '--with-openssl' '--with-default-user=proxy' '--with-included-ltdl'<br>--------------------------------------<br><br clear=all><o:p></o:p></p><div><div><div><p class=MsoNormal>And i apply this patch before compile for disabling host forgery checks :<br><br>+diff -ur squid-3.5.20-orig/src/client_side_request.cc squid-3.5.20/src/client_side_request.cc<br>+--- squid-3.5.20-orig/src/client_side_request.cc 2016-07-01 13:37:50.000000000 +0200<br>++++ squid-3.5.20/src/client_side_request.cc 2017-03-10 16:48:08.920084072 +0100<br>+@@ -530,6 +530,10 @@<br>+ }<br>+ debugs(85, 3, HERE << "validate IP " << clientConn->local << " non-match from Host: IP " << ia->in_addrs[i]);<br>+ }<br>++ // disable fogery check. See <a href="https://code.nethesis.it/Nethesis/dev/issues/5088">https://code.nethesis.it/Nethesis/dev/issues/5088</a><br>++ http->request->flags.hostVerified = true;<br>++ http->doCallouts();<br>++ return;<br>+ }<br>+ debugs(85, 3, HERE << "FAIL: validate IP " << clientConn->local << " possible from Host:");<br>+ hostHeaderVerifyFailed("local IP", "any domain IP");<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>And here is my squid.conf ( i don't post my http_access for clearly view :()<br><br>###############################################################################<br># Squid normally listens to port 3128<br>###############################################################################<br><br>https_port 3130 tproxy ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl/e1f19c0494badc8dc14e8c4c56a8b97a.dyn<br>http_port 3129 tproxy<br>http_port 3128<br><br>###############################################################################<br># squid ssl_bump option<br>###############################################################################<br>acl step1 at_step SslBump1<br>acl block ssl::server_name "/etc/squid/block_domain.txt"<br>ssl_bump peek step1<br>ssl_bump terminate block<br>ssl_bump splice all<br>sslproxy_options NO_SSLv2,NO_SSLv3,No_Compression<br>sslproxy_cipher ALL:!SSLv2:!SSLv3:!ADH:!DSS:!MD5:!EXP:!DES:!PSK:!SRP:!RC4:!IDEA:!SEED:!aNULL:!eNULL<br>sslproxy_cert_error deny all<br>sslproxy_foreign_intermediate_certs /etc/squid/intermediate_ca.pem<br><br>sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/squid/ssl_db -M 4MB<br>sslcrtd_children 8 startup=1 idle=1<br><br>###############################################################################<br>## LOGFILE OPTIONS<br>###############################################################################<br><br>mime_table /etc/squid/mime.conf<br>pid_filename /var/run/squid.pid<br><br>include /etc/squid/logging.conf<br>###############################################################################<br>## OPTIONS FOR TROUBLESHOOTING<br>###############################################################################<br><br>coredump_dir /var/spool/squid<br>debug_options ALL,1<br>cache_effective_user squid<br>cache_effective_group squid<br>###############################################################################<br>## PERSISTENT CONNECTION HANDLING<br>###############################################################################<br> <br>detect_broken_pconn off<br>client_persistent_connections off<br>server_persistent_connections on<br><br>###############################################################################<br>## ERROR PAGE OPTIONS<br>###############################################################################<br>error_directory /usr/share/squid/errors/en<br>error_log_languages off<br><br>###############################################################################<br>## DNS OPTIONS<br>###############################################################################<br>check_hostnames off<br>hosts_file /etc/hosts<br>connect_retries 2<br>ipcache_low 90<br>ipcache_size 5024 # Maximum number of DNS IP cache entries.<br>fqdncache_size 3024 # Maximum number of FQDN cache entries.<br>pipeline_prefetch 100<br><br>###############################################################################<br>## MISCELLANEOUS<br>###############################################################################<br><br>max_filedescriptors 65536<br><br>------------------------------------------------------------------------<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>The problem is my squid spent alot of memory. I have about 200 user, and my server is 4gb dram with 8gb swap dram but not enough !<br> total used free shared buffers cached<br>Mem: 3.8G 3.4G 503M 736K 181M 1.7G<br>-/+ buffers/cache: 1.5G 2.4G<br>Swap: 8.1G 9.3M 8.1G<o:p></o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>There is any issue with my squid ?? How can i fix it ?<o:p></o:p></p></div><div><p class=MsoNormal>I have attach files for detail (squid.conf and squid-3.5.20-ssl-forgery.patch)<br><br>-- <o:p></o:p></p><div><div><div><div><div><div><div><p class=MsoNormal>Thanks & Best Regards,<br>--------------<o:p></o:p></p></div><p class=MsoNormal>Đỗ Hoàng Minh Hưng<o:p></o:p></p></div><p class=MsoNormal>Gmail : <a href="mailto:hoangminhung@gmail.com" target="_blank">hoangminhung@gmail.com</a><o:p></o:p></p></div><p class=MsoNormal>SĐT : 01234454115<o:p></o:p></p></div></div></div></div></div></div></div></div></div></body></html>