[squid-users] New Squid 3.5 reconfigure causes service down

[Alex Rousskov]

On 10/05/2017 10:44 AM, Nicola Ferrari (#554252) wrote:
> On 05/10/2017 18:25, Alex Rousskov wrote:
>> The "couple of minutes" part might be related to your upgrade and, if
>> so, you may be able to avoid such delays. For list readers not familiar
>> with Debian releases, which _Squid_ version are you upgrading from?

> I was running squid 3.4 on top of Debian 8 (jessie)
> I upgraded to squid 3.5 on top of Debian 9 (stretch)

>> I suggest to start by figuring our what Squid is doing during those
>> "couple of minutes" if you have not already.
> 
> What I notice by checking cache.log is that it stops for a while on
> 
> helperOpenServers: Starting 1/60 'ntlm_auth' processes
> 2017/10/05 11:36:06 kid1| Starting new ntlmauthenticator helpers...
> 
> This was not a usual behaviour on Squid 3.4;

The next task is to figure out what changed related to that line (i.e.,
to starting ntlmauthenticator helpers). Here are a few things you may
want to check: Do you start the same number of helpers as before? Does
starting a single helper take longer in v3.5 than in v3.4? Does Squid
v3.5 consume a lot more RAM before it tries to start that helper than
Squid v3.4 consumed? Does Squid v3.5 helper itself consume a lot more
RAM than Squid v3.4 helper?

Something must have changed. If you can pinpoint that change, it is
likely that you can reverse or work around it. Since we probably do not
know what that change is, have no access to your server, and no free
time to investigate, you have to narrow the suspects down yourself.


> Just for testing purposes, I would try my config on a new clean install

That is a good initial test as well. And remember that you are not
looking for something that broke or does not work. You are looking for
something that works differently. And your initial focus should be on
things that affect helper startup (i.e., fork() and exec() system
calls): process size, number of processes, etc. Commands like strace can
help you measure delays down to a single system call level if needed.


Good luck,

Alex.