[squid-users] Squid 3-5 CPU optimization and best practise .

Thu Apr 7 04:35:50 UTC 2022

Hello Amos ,

Config file is based on IP auth and user/pass auth .
But I want to minimize the CPU hit of my config file as much as possible .

Version : Squid 5.3

###############################################################################################

squid.conf

acl RDP-Domain-controller src 77.90.230.0/24 77.90.228.0/24 77.90.225.0/24 77.90.210.0/24 77.90.193.0/24 77.90.145.0/24 77.90.112.0/24 88.21.95.0/24 88.21.94.0/24 88.21.76.0/24 88.21.75.0/24 88.21.72.0/24 88.21.36.0/24 88.21.34.0/24 88.21.199.0/24 88.21.193.0/24 88.21.192.0/24 88.21.137.0/24 88.21.135.0/24 88.21.132.0/24 88.21.131.0/24 88.21.129.0/24 88.21.128.0/24 88.21.126.0/24 88.21.121.0/24 88.21.120.0/24 88.108.9.0/24 88.108.45.0/24
http_access allow RDP-Domain-controller

acl googleaccess dstdomain .google.com .google.ad .google.ae .google.com.af .google.com.ag .google.com.ai .google.al .google.am .google.co.ao .google.com.ar .google.as .google.at .google.com.au .google.az .google.ba .google.com.bd .google.be .google.bf .google.bg .google.com.bh .google.bi .google.bj .google.com.bn .google.com.bo .google.com.br .google.bs .google.bt .google.co.bw .google.by .google.com.bz .google.ca .google.cd .google.cf .google.cg .google.ch .google.ci .google.co.ck .google.cl .google.cm .google.cn .google.com.co .google.co.cr .google.com.cu .google.cv .google.com.cy .google.cz .google.de .google.dj .google.dk .google.dm .google.com.do .google.dz

acl FTP proto FTP
http_access deny FTP
http_access deny manager
#################################
acl URN proto URN
http_access deny URN
###########################
#############################################################
visible_hostname squid
###################################
# Lockdown Procedures
auth_param basic program /lib/squid/basic_ncsa_auth /etc/squid/squid_user
acl ncsa_users proxy_auth REQUIRED
auth_param basic children 50
auth_param basic realm login squid Login
http_access deny ncsa_users googleaccess
http_access allow ncsa_users
auth_param basic casesensitive on
#########################################
cache_effective_user squid
cache_effective_group squid
##############
server_persistent_connections off
client_persistent_connections off
cache deny all
###############################################
http_port  66.4.223.238:45000 name=45000
http_port  66.4.223.238:45001 name=45001
http_port  66.4.223.238:45002 name=45002
http_port  66.4.223.238:45003 name=45003
#########
acl user45000 myportname 45000
acl user45001 myportname 45001
acl user45002 myportname 45002
acl user45003 myportname 45003
#############
tcp_outgoing_address 2a0f:3fc6:f1f1:459e:ba16:10cc:3d9f:6d8f user45000
tcp_outgoing_address 2a0f:3fc6:f1f1:459e:ca27:f465:986e:6dfc user45001
tcp_outgoing_address 2a0f:3fc6:f1f1:459e:27de:fec7:49fc:3113 user45002
tcp_outgoing_address 2a0f:3fc6:f1f1:459e:698a:d044:d39e:ffe7 user45003
tcp_outgoing_address 2a0f:3fc6:f1f1:459e:bc96:9e75:6653:76ac user45004

From: squid-users <squid-users-bounces at lists.squid-cache.org> on behalf of Amos Jeffries <squid3 at treenet.co.nz>
Date: Friday, April 1, 2022 at 1:51 AM
To: squid-users at lists.squid-cache.org <squid-users at lists.squid-cache.org>
Subject: Re: [squid-users] Squid 3-5 CPU optimization and best practise .
FYI; CPU in Squid is primarily consumed by two things:

1) parsing and processing HTTP message headers.

The only thing you can do about this is detect and reject unwanted
traffic as early as possible.

Your OS firewall is obviously the early line of defense. Preventing
unwanted network ranges from reaching Squid listening ports saves Squid
from spending CPU cycles looking up details about those unwanted clients.

Then for clients who are potentially valid the default http_access rules
reject dangerous traffic quickly and efficiently. Make sure any custom
http_access rules are listed *after* those ones. Then see (2).

2) processing access controls (ACL checks).

To optimize this needs attention to what order ACLs are tested in versus
how complex they are to process.

How many CPU cycles are consumed managing any resources they or other
processes they trigger is also important.

If you want a free optimization review please post your full squid.conf
(just without the documentation comments and empty lines). Then we can
point out any performance tricks you may not yet be using.

Beyond those two you are getting into "advanced admin" levels of
performance optimization. Where YMMV, Alex has mentioned. Every network
is different so none of us can say a specific thing to do that will be
better for you.

HTH
Amos
_______________________________________________
squid-users mailing list
squid-users at lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20220407/4f4c7210/attachment.htm>