[squid-users] Squid Proxy timing out 500/503 errors

Wed Mar 6 07:37:29 UTC 2024

On 6/03/24 07:23, M, Anitha (CSS) wrote:
> Hi team,
> 
> We are using squid service deployed as a KVM VM on SLES 15 Sp5 os image.
> 
> We are using squid. Rpm: *squid-5.7-150400.3.20.1.x86_64*
> 
> **
> 
> We are seeing too many 503 errors with this version of squid.
> 
> This is the squid configuration file. Pls review it and let us know if 
> issues.
> 

It appears that your configuration file consists of at least 2 different 
configuration files appended to each other.

Please start by running "squid -k parse" and fixing all the warnings it 
should produce.

> We are performing squid scale testing, where every secs there will be 
> 200+requests reaching the squid and squid is spitting out 500/503 errors.
> 

FYI: you have restricted Squid to no more than 3200 filedescriptors. 
That is rather low. I recommend at least 64K.

> Squid.conf:
> 
> gl-pcesreblr-squidproxy03:/var/log/squid # cat /etc/squid/squid.conf
> # Recommended minimum configuration:
> acl localnet src 172.28.1.0/24
> acl localnet src 172.28.4.0/24
> acl localnet src 172.28.0.0/24
> acl localnet src 172.28.0.12/32
> connect_timeout 120 seconds
> connect_retries 10
> #debug_options ALL,5
> #connect_retries_delay 5 seconds
> acl localnet src 0.0.0.1-0.255.255.255  # RFC 1122 "this" network (LAN)
> acl localnet src 10.0.0.0/8             # RFC 1918 local private network 
> (LAN)
> acl localnet src 100.64.0.0/10          # RFC 6598 shared address space 
> (CGN)
> acl localnet src 169.254.0.0/16         # RFC 3927 link-local (directly 
> plugged) machines
> acl localnet src 172.28.11.0/24
> #acl localnet src 172.16.0.0/12         # RFC 1918 local private network 
> (LAN)
> #acl localnet src 192.168.0.0/16                # RFC 1918 local private 
> network (LAN)
> #acl localnet src fc00::/7              # RFC 4193 local private network 
> range
> #acl localnet src fe80::/10             # RFC 4291 link-local (directly 
> plugged) machines
> 
> acl blocksites url_regex "/etc/squid/blocksites"
> http_access deny blocksites
> 
> debug_options ALL,7
> 
> acl SSL_ports port 443
> acl SSL_ports port 8071
> acl SSL_ports port 11052
> acl Safe_ports port 80          # http
> acl Safe_ports port 21          # ftp
> acl Safe_ports port 443         # https
> acl Safe_ports port 70          # gopher
> acl Safe_ports port 210         # wais
> acl Safe_ports port 1025-65535  # unregistered ports
> acl Safe_ports port 280         # http-mgmt
> acl Safe_ports port 488         # gss-http
> acl Safe_ports port 591         # filemaker
> acl Safe_ports port 777         # multiling http
> acl Safe_ports port 53          # pdns
> acl Safe_ports port 5300        # pdns
> acl Safe_ports port 123     #NTP
> acl Safe_ports port 8071
> acl Safe_ports port 11052       # pdns web server
> acl Safe_ports port 514         # rsyslog
> acl CONNECT method CONNECT
> acl SSL_ports port 8053
> acl Safe_ports port 8053
> acl SSL_ports port 3002
> acl Safe_ports port 3002
> acl SSL_ports port 3006
> acl Safe_ports port 3006
> acl SSL_ports port 8203
> acl Safe_ports port 8203
> acl SSL_ports port 8204
> acl Safe_ports port 8204
> acl SSL_ports port 8071
> acl Safe_ports port 8071
> acl Safe_ports port 8200
> acl SSL_ports port 8099
> acl Safe_ports port 8099
> tcp_outgoing_address 20.20.30.5
> 
> #
> # Recommended minimum Access Permission configuration:
> #
> # Deny requests to certain unsafe ports
> http_access deny !Safe_ports
> 
> # Deny CONNECT to other than secure SSL ports
> http_access deny CONNECT !SSL_ports
> 
> # Only allow cachemgr access from localhost
> http_access allow localhost manager
> http_access deny manager
> 
> # We strongly recommend the following be uncommented to protect innocent
> # web applications running on the proxy server who think the only
> # one who can access services on "localhost" is a local user
> #http_access deny to_localhost
> 
> #
> # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
> #

Please notice what the above line says.

> 
> # Example rule allowing access from your local networks.
> # Adapt localnet in the ACL section to list your (internal) IP networks
> # from where browsing should be allowed
> http_access allow localnet
> http_access allow localhost
> 
> # And finally deny all other access to this proxy
> #http_access deny all
> #http_access allow all
> 
> cache_peer proxy-in.its.hpecorp.net parent 443 0 no-query no-delay default

... so a server listening for plain-text HTTP on port 443. That is a bit 
broken. At least consider enabling TLS/SSL on connections to this peer 
so Squid can send it HTTPS traffic.

> #cache_peer 16.242.46.11 parent 8080 0 no-query default
> #cache_peer 10.132.100.29 parent 3128 0 no-query default
> 
> acl parent_proxy src all
> http_access allow parent_proxy

The above two lines are identical to:
   http_access allow all

... no http_access lines following this one will ever have any effects.

> never_direct allow parent_proxy

Likewise same as:
   never_direct allow all

... however you have always_direct rules later that override this.

> 
> # Squid normally listens to port 3128
> http_port 3128
> 
> # Leave coredumps in the first cache dir
> coredump_dir /var/cache/squid
> 
> #
> # Add any of your own refresh_pattern entries above these.
> #
> refresh_pattern ^ftp:           1440    20%     10080
> refresh_pattern ^gopher:        1440    0%      1440
> refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
> refresh_pattern .               0       20%     4320
> 
> dns_nameservers 172.28.0.121 16.110.135.52
> 
> max_filedescriptors 3200
> cache_dir ufs /var/cache/squid 8192 16 256
> cache_mem 2096 MB
> cache_swap_high 95
> cache_swap_low 90
> ftp_passive on
> maximum_object_size 4096 MB
> memory_replacement_policy lru
> minimum_object_size 0 KB
> 

At this point your file just starts repeating rules, with different 
settings. Some of these replace the above settings, some append to the, 
and some have no effect due to earlier rules.

> # Recommended minimum configuration:
> acl localnet src 172.28.4.0/24
> acl localnet src 172.28.0.0/24
> acl localnet src 172.28.1.0/24 # OOBM Network outbound access
> #acl HOGAN dst hogan.nimblestorage.com
> acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 “this” network (LAN)
> acl blocksites url_regex “/etc/squid/blocksites”
> http_access deny blocksites
> acl SSL_ports port 443
> acl SSL_ports port 8071
> acl SSL_ports port 11052
> acl SSL_ports port 8200
> acl SSL_ports port 8282
> acl Safe_ports port 8282
> #acl HOGAN_port port 2222 # hogan.nimblestorage.com:2222 SSH support tunnel
> # Example rule allowing access from your local networks.
> # Adapt localnet in the ACL section to list your (internal) IP networks
> # from where browsing should be allowed
> acl localnet src 172.16.117.0/24
> http_access allow localnet
> http_access allow localhost
> #http_access allow HOGAN HOGAN_port
> acl localnet src 20.20.30.0/21
> acl parent_proxy_exclude dst 20.20.30.0/21
> acl parent_proxy_exclude_ST0100 dst 20.20.30.222/22
> always_direct allow parent_proxy_exclude_ST0100
> acl servicenet dst 172.28.4.0/24
> always_direct allow parent_proxy_exclude
> always_direct allow servicenet
> 

HTH
Amos