[squid-users] Squid + c-icap + SquidClamav + ClamAV

[Alex Rousskov]

On 2024-10-03 11:10, Andrea Venturoli wrote:

 > Out of 10 installations, ... on one it's very frequent.

 > Any idea on what to check or try? ... Any way to get better logs?

Since the problem is frequent on that one host, I recommend privately 
sharing[1] a pointer to compressed debugging cache.log collected while 
the problem was happening. Either set debug_options to ALL,9 or use a 
pair of "squid -k debug" commands to start/stop debugging. More hints at
https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction

It is enough to record one or two problematic cases.

Please make sure to patch your Squid with 6567eac.patch you reference 
below before collecting those logs -- we do not want to analyze a 
known/fixed bug.


HTH,

Alex.

[1]: You can share that sample with me or anybody you trust (who can 
analyze Squid debugging logs and is willing to help you).


> I've got several machines with the following software:
> FreeBSD 13.3, 13.4 or 14.1
> Squid 6.10
> c-icap 0.5.12
> SquidClamav 7.3
> ClamA: 1.3.2
> 
> This combination usually works pretty well, but it occasionally chokes, 
> with the client seeing:
>> ICAP protocol error
>> The system returned: [No Error]
> 
> Out of 10 installations, 7 works perfecly (at least that I know), a 
> couple very seldom have shown this error, but on one it's very frequent.
> 
> 
> 
> I checked the logs:
> _ i think Squid's access log shows a NONE_NONE/500 code at the time of 
> the error: I personally can't get anything useful from this, but maybe 
> someone with better insight can tell?
> _ cache.log does not seem to show anything related;
> _ neither c-icap's, nor ClamAV's logs show anything useful.
> 
> 
> 
> I already applied the following patch:
> https://github.com/measurement-factory/squid/commit/6567eac.patch
> 
> On one host that had always worked perfeclty, but suddenly had started 
> giving this trouble several time per hours, it almost solved (i.e. I 
> think the error was seen once in the latest few months).
> However, it didn't help on the most problematic host.
> 
> 
> 
> Any idea on what to check or try? Any other known bug? Any way to get 
> better logs?
> 
> 
>   bye & Thanks
>      av.
> _______________________________________________
> squid-users mailing list
> squid-users at lists.squid-cache.org
> https://lists.squid-cache.org/listinfo/squid-users