<div dir="ltr"><div>thanks Alex</div><div><br></div><div>seems like one client (it shows the ip) is trying to get to this site but i havnt added it to my white list, so thats why its getting blocked<br></div><div><br></div><div><a href="http://events.gfe.nvidia.com">events.gfe.nvidia.com</a></div><div><br></div><div>thanks a bunch alex, your awesome<br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 30 Jun 2021 at 17:09, Alex Rousskov <<a href="mailto:rousskov@measurement-factory.com">rousskov@measurement-factory.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 6/30/21 11:48 AM, robert k Wild wrote:<br>
<br>
> How do I enable all 9 debugging to find out what client ip it is thats<br>
> sending all these tls errors.<br>
<br>
0. Start Squid if necessary.<br>
<br>
1. Locate your Squid log file or equivalent. In this example, we will<br>
call it cache.log.<br>
<br>
2. Run "tail -f cache.log > partial-cache.log" in background or another<br>
terminal. This will start appending new debugging to the<br>
partial-cache.log file.<br>
<br>
3. Run "squid -k debug" to enable ALL,9 debugging.<br>
<br>
4. Wait a few seconds.<br>
<br>
5. Run "squid -k debug" to disable ALL,9 debugging.<br>
<br>
6. Kill the "tail" command in step 2.<br>
<br>
7. Check that partial-cache.log contains at least one "Error negotiating<br>
SSL connection" entry. If not, go to step 2 and repeat. Perhaps give<br>
Squid a few extra seconds this time.<br>
<br>
8. Analyze the resulting partial-cache.log (or share it with those who<br>
are willing to analyze it for you, compressing it if needed). Please<br>
note that this debugging log may contain sensitive information such as<br>
user names and passwords.<br>
<br>
<br>
HTH,<br>
<br>
Alex.<br>
<br>
<br>
> On Wed, 30 Jun 2021, 16:16 Alex Rousskov wrote:<br>
> <br>
> On 6/30/21 6:41 AM, robert k Wild wrote:<br>
> <br>
> > never really noticed this as i rarely "tail -f" the cache log but im<br>
> > noticing these lines like every second<br>
> <br>
> > 2021/06/30 11:39:13 kid1| Error negotiating SSL connection on FD 266:<br>
> > error:00000001:lib(0):func(0):reason(1) (1/-1)<br>
> > 2021/06/30 11:39:13 kid1| Error negotiating SSL connection on FD 270:<br>
> > error:00000001:lib(0):func(0):reason(1) (1/-1)<br>
> > 2021/06/30 11:39:13 kid1| Error negotiating SSL connection on FD 285:<br>
> > error:00000001:lib(0):func(0):reason(1) (1/0)<br>
> <br>
> > is this something to be worried about<br>
> <br>
> IMHO, you should worry about two things, at least:<br>
> <br>
> 1) The fact that you did not know about Squid complaints, especially<br>
> frequent ones. I do not think that constantly watching "tail -f" is the<br>
> answer here, but something in your Squid administration approach should<br>
> change to prevent similar lack of problem awareness in the future.<br>
> <br>
> 2) The fact that your Squid is complaining about something every second.<br>
> If the actual problem behind these errors does not deserve your<br>
> attention, then Squid should not be logging it at level 1 (and you<br>
> should complain that it does). Otherwise, the problem itself should be<br>
> addressed.<br>
> <br>
> As for the error itself, it looks like your Squid cannot negotiate TLS<br>
> with some client(s). I do not know whether it is Squid's fault or the<br>
> client's. Enabling "ALL,9" debugging for a few seconds should be<br>
> sufficient to identify the client (at least by its IP address), which<br>
> may be enough to understand why the negotiation fails (or to give you<br>
> enough information to collect more details for triage).<br>
> <br>
> <br>
> HTH,<br>
> <br>
> Alex.<br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
> <mailto:<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a>><br>
> <a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
> <<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a>><br>
> <br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr">Regards, <br><br>Robert K Wild.<br></div></div>