<div dir="ltr"><div><div>I have squid 5.3 running on amazon linux 2 and it was running fine for some weeks until it suddenly stopped working yesterday on our production server and caused outage. I have set it to auto-restart for now. But if someone could review my squid.conf file and see if there is something wrong?<br></div>This is the error I saw<br>===<br>2022/04/06 00:45:31| FATAL: xcalloc: Unable to allocate 1 blocks of 68431 bytes!<br>
current master transaction: master27687315<br>
2022/04/06 00:45:31| Squid Cache (Version 5.3): Terminated abnormally.<br>
current master transaction: master27687315<br>===<br></div><div>squid.conf</div><div>---<br>[ec2-user@ip-172-24-9-143 ~]$ sudo cat /usr/local/squid/etc/squid.conf<br>#<br># Recommended minimum configuration:<br>#<br><br># Example rule allowing access from your local networks.<br># Adapt to list your (internal) IP networks from where browsing<br># should be allowed<br>acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN)<br>acl localnet src <a href="http://10.0.0.0/8">10.0.0.0/8</a> # RFC 1918 local private network (LAN)<br>acl localnet src <a href="http://100.64.0.0/10">100.64.0.0/10</a> # RFC 6598 shared address space (CGN)<br>acl localnet src <a href="http://169.254.0.0/16">169.254.0.0/16</a> # RFC 3927 link-local (directly plugged) machines<br>acl localnet src <a href="http://172.16.0.0/12">172.16.0.0/12</a> # RFC 1918 local private network (LAN)<br>acl localnet src <a href="http://192.168.0.0/16">192.168.0.0/16</a> # RFC 1918 local private network (LAN)<br>acl localnet src fc00::/7 # RFC 4193 local private network range<br>acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines<br><br>acl SSL_ports port 443<br>acl Safe_ports port 80 # http<br>acl Safe_ports port 21 # ftp<br>acl Safe_ports port 443 # https<br>acl Safe_ports port 70 # gopher<br>acl Safe_ports port 210 # wais<br>acl Safe_ports port 1025-65535 # unregistered ports<br>acl Safe_ports port 280 # http-mgmt<br>acl Safe_ports port 488 # gss-http<br>acl Safe_ports port 591 # filemaker<br>acl Safe_ports port 777 # multiling http<br><br>server_idle_pconn_timeout 60 minute<br>connect_timeout 60 minute<br>read_timeout 60 minute<br>write_timeout 60 minute<br>request_timeout 60 minute<br><br>#<br># Recommended minimum Access Permission configuration:<br>#<br># Deny requests to certain unsafe ports<br>http_access deny !Safe_ports<br><br># Deny CONNECT to other than secure SSL ports<br>http_access deny CONNECT !SSL_ports<br><br># Only allow cachemgr access from localhost<br>#http_access allow localhost manager<br>http_access deny manager<br><br># We strongly recommend the following be uncommented to protect innocent<br># web applications running on the proxy server who think the only<br># one who can access services on "localhost" is a local user<br>#http_access deny to_localhost<br><br>#<br># INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS<br>#<br><br># Filter HTTPS requests based on the whitelist <br>acl allowed_https_sites ssl::server_name .<a href="http://pypi.org">pypi.org</a> .<a href="http://pythonhosted.org">pythonhosted.org</a> .<a href="http://tfhub.dev">tfhub.dev</a> .<a href="http://gstatic.com">gstatic.com</a> .<a href="http://googleapis.com">googleapis.com</a><br>acl allowed_https_sites ssl::server_name .<a href="http://veevasourcedev.com">veevasourcedev.com</a> .<a href="http://veevasource.com">veevasource.com</a> .<a href="http://google.com">google.com</a><br>acl allowed_https_sites ssl::server_name .<a href="http://amazonaws.com">amazonaws.com</a><br><br># Example rule allowing access from your local networks.<br># Adapt localnet in the ACL section to list your (internal) IP networks<br># from where browsing should be allowed<br>#http_access allow localnet<br>#http_access allow localhost<br><br># And finally deny all other access to this proxy<br>#http_access deny all<br><br># Squid normally listens to port 3128<br>http_port 3128<br>https_port 3130 intercept ssl-bump cert=/usr/local/squid/ssl_cert/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=256MB<br>http_access allow SSL_ports<br>sslcrtd_program /usr/local/squid/libexec/security_file_certgen -s /usr/local/squid/var/lib/ssl_db -M 256MB<br>#sslcrtd_children 3 startup=1 idle=1<br>#tls_outgoing_options options=NO_SSLv3<br><br>acl step1 at_step SslBump1<br>acl step2 at_step SslBump2<br>acl step3 at_step SslBump3<br>##ssl_bump peek step1 all <br>ssl_bump peek step1<br>ssl_bump peek step2 allowed_https_sites<br>##ssl_bump splice step3 allowed_https_sites<br>ssl_bump splice step3 allowed_https_sites<br>#ssl_bump bump all<br>ssl_bump terminate step2 all<br>#ssl_bump bump all<br>#http_access allow allowed_https_sites<br>http_access deny all<br><br># Uncomment and adjust the following to add a disk cache directory.<br>#cache_dir ufs /usr/local/squid/var/cache/squid 100 16 256<br><br># Leave coredumps in the first cache dir<br>coredump_dir /usr/local/squid/var/cache/squid<br><br>#<br># Add any of your own refresh_pattern entries above these.<br>#<br>refresh_pattern ^ftp: 1440 20% 10080<br>refresh_pattern ^gopher: 1440 0% 1440<br>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>refresh_pattern . 0 20% 4320<br><br>logformat custom %tg rep_time==%1tr %>a %Ss/%03>Hs %<st %[un %Sh/%<a %mt -- %ssl::bump_mode %ssl::>sni server==> %ssl::<cert_subject err=%ssl::<cert_errors %ssl::<negotiated_version %ssl::<received_supported_version %ssl::<received_hello_version %ssl::<negotiated_version <br>access_log /usr/local/squid/var/logs/access.log custom<br>debug_options ALL, 2, rotate=1<br>forwarded_for delete<br>via off</div></div>