<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi team, <o:p></o:p></p>
<p class="MsoNormal">We are using squid service deployed as a KVM VM on SLES 15 Sp5 os image.
<o:p></o:p></p>
<p class="MsoNormal">We are using squid. Rpm: <b>squid-5.7-150400.3.20.1.x86_64<o:p></o:p></b></p>
<p class="MsoNormal"><b><o:p> </o:p></b></p>
<p class="MsoNormal">We are seeing too many 503 errors with this version of squid.
<o:p></o:p></p>
<p class="MsoNormal">This is the squid configuration file. Pls review it and let us know if issues.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We are performing squid scale testing, where every secs there will be 200+requests reaching the squid and squid is spitting out 500/503 errors.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Squid.conf:<o:p></o:p></p>
<p>gl-pcesreblr-squidproxy03:/var/log/squid # cat /etc/squid/squid.conf<br>
# Recommended minimum configuration:<br>
acl localnet src 172.28.1.0/24<br>
acl localnet src 172.28.4.0/24<br>
acl localnet src 172.28.0.0/24<br>
acl localnet src 172.28.0.12/32<br>
connect_timeout 120 seconds<br>
connect_retries 10<br>
#debug_options ALL,5<br>
#connect_retries_delay 5 seconds<br>
acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN)<br>
acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN)<br>
acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN)<br>
acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines<br>
acl localnet src 172.28.11.0/24<br>
#acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN)<br>
#acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN)<br>
#acl localnet src fc00::/7 # RFC 4193 local private network range<br>
#acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>acl blocksites url_regex "/etc/squid/blocksites"<br>
http_access deny blocksites<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>debug_options ALL,7<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>acl SSL_ports port 443<br>
acl SSL_ports port 8071<br>
acl SSL_ports port 11052<br>
acl Safe_ports port 80 # http<br>
acl Safe_ports port 21 # ftp<br>
acl Safe_ports port 443 # https<br>
acl Safe_ports port 70 # gopher<br>
acl Safe_ports port 210 # wais<br>
acl Safe_ports port 1025-65535 # unregistered ports<br>
acl Safe_ports port 280 # http-mgmt<br>
acl Safe_ports port 488 # gss-http<br>
acl Safe_ports port 591 # filemaker<br>
acl Safe_ports port 777 # multiling http<br>
acl Safe_ports port 53 # pdns<br>
acl Safe_ports port 5300 # pdns<br>
acl Safe_ports port 123 #NTP<br>
acl Safe_ports port 8071<br>
acl Safe_ports port 11052 # pdns web server<br>
acl Safe_ports port 514 # rsyslog<br>
acl CONNECT method CONNECT<br>
acl SSL_ports port 8053<br>
acl Safe_ports port 8053<br>
acl SSL_ports port 3002<br>
acl Safe_ports port 3002<br>
acl SSL_ports port 3006<br>
acl Safe_ports port 3006<br>
acl SSL_ports port 8203<br>
acl Safe_ports port 8203<br>
acl SSL_ports port 8204<br>
acl Safe_ports port 8204<br>
acl SSL_ports port 8071<br>
acl Safe_ports port 8071<br>
acl Safe_ports port 8200<br>
acl SSL_ports port 8099<br>
acl Safe_ports port 8099<br>
tcp_outgoing_address 20.20.30.5<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>#<br>
# Recommended minimum Access Permission configuration:<br>
#<br>
# Deny requests to certain unsafe ports<br>
http_access deny !Safe_ports<o:p></o:p></p>
<p> <o:p></o:p></p>
<p># Deny CONNECT to other than secure SSL ports<br>
http_access deny CONNECT !SSL_ports<o:p></o:p></p>
<p> <o:p></o:p></p>
<p># Only allow cachemgr access from localhost<br>
http_access allow localhost manager<br>
http_access deny manager<o:p></o:p></p>
<p> <o:p></o:p></p>
<p># We strongly recommend the following be uncommented to protect innocent<br>
# web applications running on the proxy server who think the only<br>
# one who can access services on "localhost" is a local user<br>
#http_access deny to_localhost<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>#<br>
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS<br>
#<o:p></o:p></p>
<p> <o:p></o:p></p>
<p># Example rule allowing access from your local networks.<br>
# Adapt localnet in the ACL section to list your (internal) IP networks<br>
# from where browsing should be allowed<br>
http_access allow localnet<br>
http_access allow localhost<o:p></o:p></p>
<p> <o:p></o:p></p>
<p># And finally deny all other access to this proxy<br>
#http_access deny all<br>
#http_access allow all<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>cache_peer proxy-in.its.hpecorp.net parent 443 0 no-query no-delay default<br>
#cache_peer 16.242.46.11 parent 8080 0 no-query default<br>
#cache_peer 10.132.100.29 parent 3128 0 no-query default<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>acl parent_proxy src all<br>
http_access allow parent_proxy<br>
never_direct allow parent_proxy<o:p></o:p></p>
<p> <o:p></o:p></p>
<p># Squid normally listens to port 3128<br>
http_port 3128<o:p></o:p></p>
<p> <o:p></o:p></p>
<p># Leave coredumps in the first cache dir<br>
coredump_dir /var/cache/squid<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>#<br>
# Add any of your own refresh_pattern entries above these.<br>
#<br>
refresh_pattern ^ftp: 1440 20% 10080<br>
refresh_pattern ^gopher: 1440 0% 1440<br>
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>
refresh_pattern . 0 20% 4320<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>dns_nameservers 172.28.0.121 16.110.135.52<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>max_filedescriptors 3200<br>
cache_dir ufs /var/cache/squid 8192 16 256<br>
cache_mem 2096 MB<br>
cache_swap_high 95<br>
cache_swap_low 90<br>
ftp_passive on<br>
maximum_object_size 4096 MB<br>
memory_replacement_policy lru<br>
minimum_object_size 0 KB<o:p></o:p></p>
<p> <o:p></o:p></p>
<p># Recommended minimum configuration:<br>
acl localnet src 172.28.4.0/24<br>
acl localnet src 172.28.0.0/24<br>
acl localnet src 172.28.1.0/24 # OOBM Network outbound access<br>
#acl HOGAN dst hogan.nimblestorage.com<br>
acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 “this” network (LAN)<br>
acl blocksites url_regex “/etc/squid/blocksites”<br>
http_access deny blocksites<br>
acl SSL_ports port 443<br>
acl SSL_ports port 8071<br>
acl SSL_ports port 11052<br>
acl SSL_ports port 8200<br>
acl SSL_ports port 8282<br>
acl Safe_ports port 8282<br>
#acl HOGAN_port port 2222 # hogan.nimblestorage.com:2222 SSH support tunnel<br>
# Example rule allowing access from your local networks.<br>
# Adapt localnet in the ACL section to list your (internal) IP networks<br>
# from where browsing should be allowed<br>
acl localnet src 172.16.117.0/24<br>
http_access allow localnet<br>
http_access allow localhost<br>
#http_access allow HOGAN HOGAN_port<br>
acl localnet src 20.20.30.0/21<br>
acl parent_proxy_exclude dst 20.20.30.0/21<br>
acl parent_proxy_exclude_ST0100 dst 20.20.30.222/22<br>
always_direct allow parent_proxy_exclude_ST0100<br>
acl servicenet dst 172.28.4.0/24<br>
always_direct allow parent_proxy_exclude<br>
always_direct allow servicenet<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Logs:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 1,5| CodeContext.cc(60) Entering: master1604<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,3| Read.cc(148) HandleRead: FD 756, size 65535, retval 206, errno 0<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,3| IoCallback.cc(112) finish: called for conn3875 local=20.20.30.5:50937 remote=10.120.125.146:443 FIRSTUP_PARENT FD 756 flags=1 (0, 0)<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,4| AsyncCall.cc(97) ScheduleCall: IoCallback.cc(131) will call TunnelBlindCopyReadHandler(conn3875 local=20.20.30.5:50937 remote=10.120.125.146:443 FIRSTUP_PARENT FD 756 flags=1, data=0x557f30aec0a8, size=206,
buf=0x557f30d277a0) [call131521]<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 1,7| CodeContext.cc(70) Leaving: master1604<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 1,5| CodeContext.cc(60) Entering: master1604<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,4| AsyncCallQueue.cc(59) fireNext: entering TunnelBlindCopyReadHandler(conn3875 local=20.20.30.5:50937 remote=10.120.125.146:443 FIRSTUP_PARENT FD 756 flags=1, data=0x557f30aec0a8, size=206, buf=0x557f30d277a0)<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,4| AsyncCall.cc(42) make: make call TunnelBlindCopyReadHandler [call131521]<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 26,3| tunnel.cc(526) ReadServer: conn3875 local=20.20.30.5:50937 remote=10.120.125.146:443 FIRSTUP_PARENT FD 756 flags=1<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 26,3| tunnel.cc(534) readServer: conn3875 local=20.20.30.5:50937 remote=10.120.125.146:443 FIRSTUP_PARENT FD 756 flags=1, read 206 bytes, err=0<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 26,3| tunnel.cc(486) bytesIn: len=0 + count=206<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 26,3| tunnel.cc(603) keepGoingAfterRead: from={conn3875 local=20.20.30.5:50937 remote=10.120.125.146:443 FIRSTUP_PARENT FD 756 flags=1}, to={conn3867 local=20.20.30.2:3128 remote=20.20.31.153:49724 FD 753 flags=1}<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,4| AsyncCall.cc(30) AsyncCall: The AsyncCall tunnelTimeout constructed, this=0x557f30a20410 [call132703]<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,3| comm.cc(571) commSetConnTimeout: conn3875 local=20.20.30.5:50937 remote=10.120.125.146:443 FIRSTUP_PARENT FD 756 flags=1 timeout 900<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,4| AsyncCall.cc(30) AsyncCall: The AsyncCall tunnelTimeout constructed, this=0x557f2ebd3660 [call132704]<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,3| comm.cc(571) commSetConnTimeout: conn3867 local=20.20.30.2:3128 remote=20.20.31.153:49724 FD 753 flags=1 timeout 900<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 26,3| tunnel.cc(646) copy: Schedule Write<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,5| AsyncCall.cc(30) AsyncCall: The AsyncCall TunnelBlindCopyWriteHandler constructed, this=0x557f2ef09120 [call132705]<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,5| Write.cc(37) Write: conn3867 local=20.20.30.2:3128 remote=20.20.31.153:49724 FD 753 flags=1: sz 206: asynCall 0x557f2ef09120*2<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,5| ModEpoll.cc(118) SetSelect: FD 753, type=2, handler=1, client_data=0x7f766627b060, timeout=0<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,4| AsyncCallQueue.cc(61) fireNext: leaving TunnelBlindCopyReadHandler(conn3875 local=20.20.30.5:50937 remote=10.120.125.146:443 FIRSTUP_PARENT FD 756 flags=1, data=0x557f30aec0a8, size=206, buf=0x557f30d277a0)<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 1,7| CodeContext.cc(70) Leaving: master1604<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 1,5| CodeContext.cc(60) Entering: master87<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,5| comm.cc(1633) checkTimeouts: checkTimeouts: FD 45 Expired<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,5| comm.cc(1636) checkTimeouts: checkTimeouts: FD 45: Call timeout handler<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,4| AsyncCall.cc(97) ScheduleCall: comm.cc(1639) will call Comm::ConnOpener::timeout(conn85 local=20.20.30.5 remote=10.120.125.146:443 FIRSTUP_PARENT flags=1, data=0x557f2c68ec48) [call419]<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 1,7| CodeContext.cc(70) Leaving: master87<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 1,5| CodeContext.cc(60) Entering: master138<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,5| comm.cc(1633) checkTimeouts: checkTimeouts: FD 91 Expired<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,5| comm.cc(1636) checkTimeouts: checkTimeouts: FD 91: Call timeout handler<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,4| AsyncCall.cc(97) ScheduleCall: comm.cc(1639) will call Comm::ConnOpener::timeout(conn213 local=20.20.30.5 remote=10.120.125.146:443 FIRSTUP_PARENT flags=1, data=0x557f2c9750e8) [call1148]<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 1,7| CodeContext.cc(70) Leaving: master138<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 1,5| CodeContext.cc(60) Entering: master1604<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.000 kid1| 5,5| Write.cc(69) HandleWrite: conn3867 local=20.20.30.2:3128 remote=20.20.31.153:49724 FD 753 flags=1: off 0, sz 206.<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,5| Write.cc(89) HandleWrite: write() returns 206<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,3| IoCallback.cc(112) finish: called for conn3867 local=20.20.30.2:3128 remote=20.20.31.153:49724 FD 753 flags=1 (0, 0)<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,5| AsyncCall.cc(97) ScheduleCall: IoCallback.cc(131) will call TunnelBlindCopyWriteHandler(conn3867 local=20.20.30.2:3128 remote=20.20.31.153:49724 FD 753 flags=1, data=0x557f30aec0a8, size=206, buf=0x557f30d277a0)
[call132705]<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 1,7| CodeContext.cc(70) Leaving: master1604<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 1,5| CodeContext.cc(60) Entering: master87<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,4| AsyncCallQueue.cc(59) fireNext: entering Comm::ConnOpener::timeout(conn85 local=20.20.30.5 remote=10.120.125.146:443 FIRSTUP_PARENT flags=1, data=0x557f2c68ec48)<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,4| AsyncCall.cc(42) make: make call Comm::ConnOpener::timeout [call419]<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,4| AsyncJob.cc(124) callStart: Comm::ConnOpener status in: [ job76]<o:p></o:p></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">2024/03/05 22:42:57.001 kid1| 5,5| ConnOpener.cc(467) timeout: conn85 local=20.20.30.5 remote=10.120.125.146:443 FIRSTUP_PARENT flags=1: * - ERR took too long to receive response.</span><o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 48,5| AsyncCall.cc(97) ScheduleCall: ConnOpener.cc(160) will call HappyConnOpener::notePrimeConnectDone(conn85 local=20.20.30.5 remote=10.120.125.146:443 FIRSTUP_PARENT flags=1, errno=110, flag=-4, data=0x557f2c68e278)
[call403]<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 93,5| AsyncJob.cc(85) mustStop: Comm::ConnOpener will stop, reason: Comm::ConnOpener::timeout<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 93,5| AsyncJob.cc(140) callEnd: Comm::ConnOpener::timeout(conn85 local=20.20.30.5 remote=10.120.125.146:443 FIRSTUP_PARENT flags=1, data=0x557f2c68ec48) ends job [Stopped, reason:Comm::ConnOpener::timeout job76]<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,4| ConnOpener.cc(176) cleanFd: ; temp FD 45<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,5| ModEpoll.cc(118) SetSelect: FD 45, type=2, handler=0, client_data=0, timeout=0<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,5| comm.cc(1048) comm_remove_close_handler: comm_remove_close_handler: FD 45, AsyncCall=0x557f2c68ecd0*2<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,4| AsyncCall.cc(60) cancel: will not call Comm::ConnOpener::earlyAbort [call418] because comm_remove_close_handler<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,3| comm.cc(877) _comm_close: start closing FD 45 by ConnOpener.cc:233<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,3| comm.cc(558) commUnsetFdTimeout: Remove timeout for FD 45<o:p></o:p></p>
<p class="MsoNormal">2024/03/05 22:42:57.001 kid1| 5,5| comm.cc(739) commCallCloseHandlers: commCallCloseHandlers: FD 45<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>