<!DOCTYPE html>
<html data-lt-installed="true">
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body style="padding-bottom: 1px;">
<p>Hi</p>
<p>Sometimes my users complains that the internet navigation thought
Squid is very slow.</p>
<p>After checking the access.log, I can see a lot of ABORTED
messages like this</p>
<p>1715537802.589 2 10.103.12.94 NONE_NONE_ABORTED/200 0
CONNECT api.telegram.org:443 - HIER_NONE/-:- -
mac="00:00:00:00:00:00" accessrule:%20global_whitelist%0D%0A
exterr="ERR_CLIENT_GONE|WITH_CLIENT"</p>
<p>1715537183.180 99993 172.16.31.205 TCP_MISS_ABORTED/000 0 POST
<a class="moz-txt-link-freetext" href="http://pjcpd-dlpend01.hlbank.my/GECommunicationWS.asmx">http://pjcpd-dlpend01.hlbank.my/GECommunicationWS.asmx</a> -
HIER_NONE/-:- - mac="00:00:00:00:00:00"
accessrule:%20global_whitelist%0D%0A
exterr="ERR_CLIENT_GONE|WITH_CLIENT"<br>
</p>
<p>I have imported the access.log into my ELK machine and I can see
that during the time that the users complained about the slowness
there is a huge spike of NONE_ABORTED messages.</p>
<p><a class="moz-txt-link-freetext" href="https://i.postimg.cc/6QR79GWk/6e727e86-de3d-4f3b-bd9e-04c04052ca2e.jpg">https://i.postimg.cc/6QR79GWk/6e727e86-de3d-4f3b-bd9e-04c04052ca2e.jpg</a></p>
<p>Now my question is:<br>
1. What can cause this kind of issue? It's a squid server issue,
network (firewall, switch, router, …), or client?<br>
2. Why the number of NONE_ABORTED requests is almost 4 time more
than normal request? <br>
</p>
<p>Best regards<br>
</p>
</body>
<lt-container></lt-container>
</html>