[squid-users] How to fix the error error:transaction-end-before-headers in access log

[Eliezer Croitoru]

Hey,

In the case of health checks it's possible to write these in a way that will not result with this error line.
In case we would have the L4 balancer vendor we might be able to suggest on the right way to health check squid.

A nice example in haproxy can be seen at:
https://www.serverlab.ca/tutorials/linux/network-services/how-to-configure-haproxy-health-checks/

The next line should be good enough to understand:
	option httpchk HEAD /squid-internal-static/icons/SN.png HTTP/1.1\r\nHost:\ proxy-host-or-ip\r\n

Another option is:
	option httpchk HEAD /squid-internal-mgr/menu HTTP/1.1\r\nHost:\ proxy-host-or-ip\r\n

Which will require couple manager ACLs to make sure only the LB will have access to the internal mgr pages.

Hope This Helps,
Eliezer

----
Eliezer Croitoru
NgTech, Tech Support
Mobile: +972-5-28704261
Email: ngtech1ltd at gmail.com

-----Original Message-----
From: squid-users <squid-users-bounces at lists.squid-cache.org> On Behalf Of Alex Rousskov
Sent: Thursday, January 20, 2022 19:40
To: squid-users at lists.squid-cache.org
Subject: Re: [squid-users] How to fix the error error:transaction-end-before-headers in access log

On 1/20/22 2:42 AM, Matus UHLAR - fantomas wrote:
> On 20.01.22 07:04, Hg Mi wrote:
>> We currently using squid 4.13 on ubuntu 18.04,  the following error
>> generates really frequently in the access.log.
>>
>> error:transaction-end-before-headers
> 
> it means that either client or server closed connection before

In most cases, this means the client opened a TCP connection to a Squid
listening port and then closed it without sending the HTTP headers. To
figure out who is at fault, you need to figure out who is making these
connections to Squid and why they are closing them without sending HTTP
headers (if that is what they are actually doing).

Bugs notwithstanding, server closures should not lead to
transaction-end-before-headers records.

>> Is this a bug in squid4?  or it was misconfigured in my environment?
> 
> most likely your environment. don't you have any content filter in front of
> your proxy?

... or anything that would "probe" or "health check" Squid http_port or
https_port at TCP level.


HTH,

Alex.
_______________________________________________
squid-users mailing list
squid-users at lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users