[squid-users] Squid "suspending ICAP service for too many failures"

[Alex Rousskov]

On 1/27/21 11:01 AM, Andrea Venturoli wrote:

>> 2021/01/04 14:24:24 kid1| suspending ICAP service for too many failures
>> 2021/01/04 14:24:24 kid1| essential ICAP service is suspended:
>> icap://127.0.0.1:1344/squidclamav [down,susp,fail11]

> This happens usually once a day, always at the same time.
> AFAIK there's no particular job running on the server at that time; I
> analyzed squid.log to see whether some client accesses something
> specific at that hour of the day, but came up empty.

Unfortunately, Squid ICAP client does not log some of the failures at
debugging level 0 or 1.


> Any suggestion on what to do to investigate this?

Enable ICAP debugging and study cache.log for relevant messages,
especially just before the "suspending ICAP service" message shown above.

    debug_options ALL,1 93,7

Debugging will produce a lot of irrelevant to you cache.log lines If
necessary, you can enable debugging an hour (or even a minute!) before
the regular failure. This will allow you to detail the last failure (at
least). It is possible that all the 11 failures are the same.


HTH,

Alex.