tag:old.nabble.com,2006:forum-22481Nabble - Squid Web Proxy Cache2009-12-07T03:56:14Z<a href="http://www.squid-cache.org/" target="_top" rel="nofollow">Squid</a> is a full-featured Web proxy cache. It is free, open-source software, and the result of many contributions by unpaid (and paid) volunteers .
<br><br>Squid supports proxying and caching of HTTP, FTP, and other URLs; proxying for SSL; cache hierarchies; ICP, HTCP, CARP, Cache Digests; transparent caching; WCCP (Squid v2.3 and above); extensive access controls; HTTP server acceleration; SNMP; caching of DNS lookups.tag:old.nabble.com,2006:post-26676186problem attachments2009-12-07T03:56:14Z2009-12-07T03:56:14Zespoire20Hi
<br><br>I have a small problem I have proxy server installed , i configured squid it's working well .
<br>The issue that i have now when i try to add the attachment file in email on gmail or yahoo i can't added when I take out the proxy from the browser I can add the attachment file
<br><br>if someone can help me i will be thankful
<br><br>many thanks<p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26675913Re: Squid at 100% CPU with 10 minutes period2009-12-07T03:24:48Z2009-12-07T03:24:48ZAmos Jeffries-2fedorischev wrote:
<div class='shrinkable-quote'><br>> В сообщении от Monday 07 December 2009 13:00:22 Amos Jeffries написал(а):
<br>>> fedorischev wrote:
<br>>>> Several days ago I find, that Squid3.0STABLE16 eating CPU time by HTTP
<br>>>> method CONNECT while request is hitting delay pool. I'm looking for the
<br>>>> spare time to post more debugging info on the list.
<br>>>>
<br>>>> WBR.
<br>>> Please try 3.0.STABLE20 and confirm that the problem still exists.
<br>>> There are a few hang and infinite loop errors resolved since *16. Some
<br>>> rather nasty remote DDoS security issues as well.
<br>>>
<br>>> Amos
<br>>
<br>> OK, thank you for tip. I'll try to use 3.0STABLE20 & post the results on the
<br>> list immediately. Now I'm looking for the linux http downloader software,
<br>> that may using CONNECT - for squid testing purposes. Unfortunately - no
<br>> results as yet :)
<br>>
<br>> WBR.
</div><br>I have not tested this, but from a quick check of the code its should work:
<br><br> squidclient -m CONNECT -P file host:port
<br><br>If you create a fake HTTP request and store the request headers in
<br>"file" the above should send a CONNECT request for "host:port" to Squid
<br>then pass the contents of "file" through the tunnel same as a downloader
<br>would.
<br><br>The only difference from a regular CONNECT is that squidclient will add
<br>a Content-Length: header which do not usually go on CONNECT requests due
<br>to their unpredictable nature.
<br><br>Amos
<br>--
<br>Please be using
<br> Current Stable Squid 2.7.STABLE7 or 3.0.STABLE20
<br> Current Beta Squid 3.1.0.15
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26675573Could this be a potential problem? Squid stops working and requires restart to work2009-12-07T02:53:23Z2009-12-07T02:53:23ZAsim Ahmed @ Folio3Hi,
<br><br>I found this in cache.log when i restarted squid after a halt!
<br><br>CPU Usage: 79.074 seconds = 48.851 user + 30.223 sys
<br>Maximum Resident Size: 0 KB
<br>Page faults with physical i/o: 0
<br>Memory usage for squid via mallinfo():
<br> total space in arena: 7452 KB
<br> Ordinary blocks: 7363 KB 285 blks
<br> Small blocks: 0 KB 1 blks
<br> Holding blocks: 14752 KB 94 blks
<br> Free Small blocks: 0 KB
<br> Free Ordinary blocks: 88 KB
<br> Total in use: 22115 KB 297%
<br> Total free: 88 KB 1%
<br><br>--
<br><br>Regards,
<br><br>Asim Ahmed Khan
<br>IT Manager,
<br>Folio3 (Pvt.) Ltd. www.folio3.com
<br>Direct: 92-21-4323721-4 Ext 110
<br>Email: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26675573&i=0" target="_top" rel="nofollow">aahmed@...</a>
<br><br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26675475Re: Squid at 100% CPU with 10 minutes period2009-12-07T02:42:01Z2009-12-07T02:42:01ZfedorischevВ сообщении от Monday 07 December 2009 13:00:22 Amos Jeffries написал(а):
<div class='shrinkable-quote'><br>> fedorischev wrote:
<br>> > Several days ago I find, that Squid3.0STABLE16 eating CPU time by HTTP
<br>> > method CONNECT while request is hitting delay pool. I'm looking for the
<br>> > spare time to post more debugging info on the list.
<br>> >
<br>> > WBR.
<br>>
<br>> Please try 3.0.STABLE20 and confirm that the problem still exists.
<br>> There are a few hang and infinite loop errors resolved since *16. Some
<br>> rather nasty remote DDoS security issues as well.
<br>>
<br>> Amos
</div><br>OK, thank you for tip. I'll try to use 3.0STABLE20 & post the results on the
<br>list immediately. Now I'm looking for the linux http downloader software,
<br>that may using CONNECT - for squid testing purposes. Unfortunately - no
<br>results as yet :)
<br><br>WBR.
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26675041Re: Squid at 100% CPU with 10 minutes period2009-12-07T02:00:22Z2009-12-07T02:00:22ZAmos Jeffries-2fedorischev wrote:
<div class='shrinkable-quote'><br>> В сообщении от Friday 04 December 2009 23:51:28 Guy Bashkansky написал(а):
<br>>> Hi,
<br>>>
<br>>> The problem: on a certain origin content, Squid reaches 100% CPU
<br>>> periodically, every 10 minutes, so the cache service suffers.
<br>>>
<br>>> Any clues where to look? Maybe this problem and its solution are known?
<br>>>
<br>>> The CPU load pattern is something like this, minute-by-minute:
<br>>> 40%, 40%, 60%, 80%, 99%, 99%, 99%, 80%, 60%, 40%, repeat.
<br>>>
<br>>> Thanks,
<br>>> Guy
<br>>
<br>> Several days ago I find, that Squid3.0STABLE16 eating CPU time by HTTP method
<br>> CONNECT while request is hitting delay pool. I'm looking for the spare time
<br>> to post more debugging info on the list.
<br>>
<br>> WBR.
</div><br>Please try 3.0.STABLE20 and confirm that the problem still exists.
<br>There are a few hang and infinite loop errors resolved since *16. Some
<br>rather nasty remote DDoS security issues as well.
<br><br>Amos
<br>--
<br>Please be using
<br> Current Stable Squid 2.7.STABLE7 or 3.0.STABLE20
<br> Current Beta Squid 3.1.0.15
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26674993Re: TCP_Denied for when requesting IP as URL over SSL using squid proxy server.2009-12-07T01:54:39Z2009-12-07T01:54:39ZAmos Jeffries-2kevin band wrote:
<div class='shrinkable-quote'><br>> Hi,
<br>>
<br>> I'm hoping somebody can help me here, because I'm at a loss about what
<br>> to do next.
<br>>
<br>> Basically we have squid running as a proxy server to restrict access
<br>> to just those sites which we've included in our ACL's
<br>> I have noticed recently that it isn't handling HTTPS reqests properly
<br>> if the URL contains an IP address instead of a domain name.
<br>>
<br>> The reason this is a particular problem is that although the users can
<br>> connect to the page using the domain name, something within that
<br>> domain is then forwarding requests to the same web-server using its IP
<br>> address.
<br>> I'm sure I have my ACL's setup correctly because squid will forward
<br>> the request using either URL if I send the requests using HTTP. It
<br>> then times out on the web-server because it only allows https, but at
<br>> least the request is being forwarded to the web-server rather than
<br>> being denied in squid
</div><br>The remote web server(s) is rejecting the connections. Probably because
<br>the SSL certificates require a domain name as part of their
<br>authentication validation.
<br><br>It's probably a broken client browser or maybe the website itself
<br>sending funky page URLs with the raw-IP inside. If you care you need to
<br>find out which and complain to whoever made the broken bits. Squid is
<br>just an innocent middleman here.
<br><div class='shrinkable-quote'><br>>
<br>> Here's an extract from the logs that might explain it better :-
<br>>
<br>> 158.41.4.44 - - [04/Dec/2009:15:56:47 +0000] "GET
<br>> <a href="http://stpaccess.marksandspencer.com/" target="_top" rel="nofollow">http://stpaccess.marksandspencer.com/</a> HTTP/1.1" 504 1024 TCP_MISS:NONE
<br>> 158.41.4.44 - - [04/Dec/2009:15:57:02 +0000] "CONNECT
<br>> stpaccess.marksandspencer.com:443 HTTP/1.0" 200 7783 TCP_MISS:DIRECT
<br>> 158.41.4.44 - - [04/Dec/2009:16:01:53 +0000] "GET
<br>> <a href="http://63.130.82.113/Citrix/MetaFrameXP/default/login.asp" target="_top" rel="nofollow">http://63.130.82.113/Citrix/MetaFrameXP/default/login.asp</a> HTTP/1.1"
<br>> 504 1064 TCP_MISS:NONE
<br>> 158.41.4.44 - - [04/Dec/2009:16:03:13 +0000] "CONNECT
<br>> 63.130.82.113:443 HTTP/1.0" 403 980 TCP_DENIED:NONE
<br>>
<br>>
<br>> And config extracts:
<br>>
<br>> acl SSL_ports port 443 563 444
<br>> acl Safe_ports port 80 8002 23142 5481 5181 5281 5381 5481 5581
<br>> 5400 5500 # http
<br>> acl Safe_ports port 23142 # OPEL project
<br>> acl Safe_ports port 21 # ftp
<br>> acl Safe_ports port 443 444 563 # https, snew#s
<br>>
<br>> acl CONNECT method CONNECT
<br>>
<br>> acl regex_ms dstdom_regex -i "/home/security/regex_marksandspencer.txt"
<br>> acl urlregex_mands url_regex -i
<br>> "/home/security/regex_marksandspencer_ip.txt"
<br>> acl mands_allowed_nets src "/home/security/mands_allowed_nets.txt"
<br>>
<br>> http_access allow manager localhost
<br>> http_access deny manager
<br>> http_access deny !Safe_ports
<br>> http_access deny CONNECT !SSL_ports
<br>>
<br>> http_access allow regex_ms mands_allowed_nets
<br>> http_access allow urlregex_mands mands_allowed_nets
<br>> http_access deny all
<br>>
<br>> There are actually a lot more ACL's than this, but these are the only
<br>> ones I think are relevant
<br>>
<br>> relevant extracts from files linked to ACLs:
<br>> regex_marksandspencer.txt
<br>> .*marksandspencer.*com
<br>>
<br>> regex_marksandspencer_ip.txt
<br>> .*.63.130.82.113
<br>>
<br>>
<br>> Thanks for any help.
<br>>
<br>> Kevin,
</div><br>Kevin, meet dstdomain:
<br><br> acl markandspencer dstdomain .marksandspencer.com 63.130.82.113
<br> http_access allow markandspencer mands_allowed_nets
<br><br>10x or more faster than regex. Matching marksandspencer.com, all
<br>sub-domains and the raw-IP address form.
<br><br>Amos
<br>--
<br>Please be using
<br> Current Stable Squid 2.7.STABLE7 or 3.0.STABLE20
<br> Current Beta Squid 3.1.0.15
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26674781Re: any work arounds for bug 21762009-12-07T01:36:52Z2009-12-07T01:36:52ZAmos Jeffries-2Brett Lymn wrote:
<div class='shrinkable-quote'><br>> On Wed, Dec 02, 2009 at 07:22:57PM +1300, Amos Jeffries wrote:
<br>>> Sorry. I attached it to the bug report.
<br>>>
<br>>
<br>> I manually applied the patch - I couldn't be bothered with patch for a
<br>> simple #if removal. The symptoms have changed. We no longer get an
<br>> auth pop up but at the end of the upload the browser displays:
<br>>
<br>> Bad Request (Invalid Verb)
<br>>
<br>> and the document is not shown in the list. So, the patch made a
<br>> difference but something else is amiss still.
<br>>
</div><br>Strange. I've never see that one before.
<br><br>I think another trace of the request-reply sequence is needed to see if
<br>there is anything different now and what.
<br><br>Amos
<br>--
<br>Please be using
<br> Current Stable Squid 2.7.STABLE7 or 3.0.STABLE20
<br> Current Beta Squid 3.1.0.15
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26674726TCP_Denied for when requesting IP as URL over SSL using squid proxy server.2009-12-07T01:30:14Z2009-12-07T01:30:14Zkevin band-2Hi,
<br><br>I'm hoping somebody can help me here, because I'm at a loss about what
<br>to do next.
<br><br>Basically we have squid running as a proxy server to restrict access
<br>to just those sites which we've included in our ACL's
<br>I have noticed recently that it isn't handling HTTPS reqests properly
<br>if the URL contains an IP address instead of a domain name.
<br><br>The reason this is a particular problem is that although the users can
<br>connect to the page using the domain name, something within that
<br>domain is then forwarding requests to the same web-server using its IP
<br>address.
<br>I'm sure I have my ACL's setup correctly because squid will forward
<br>the request using either URL if I send the requests using HTTP. It
<br>then times out on the web-server because it only allows https, but at
<br>least the request is being forwarded to the web-server rather than
<br>being denied in squid
<br><br>Here's an extract from the logs that might explain it better :-
<br><br> 158.41.4.44 - - [04/Dec/2009:15:56:47 +0000] "GET
<br><a href="http://stpaccess.marksandspencer.com/" target="_top" rel="nofollow">http://stpaccess.marksandspencer.com/</a> HTTP/1.1" 504 1024 TCP_MISS:NONE
<br> 158.41.4.44 - - [04/Dec/2009:15:57:02 +0000] "CONNECT
<br>stpaccess.marksandspencer.com:443 HTTP/1.0" 200 7783 TCP_MISS:DIRECT
<br> 158.41.4.44 - - [04/Dec/2009:16:01:53 +0000] "GET
<br><a href="http://63.130.82.113/Citrix/MetaFrameXP/default/login.asp" target="_top" rel="nofollow">http://63.130.82.113/Citrix/MetaFrameXP/default/login.asp</a> HTTP/1.1"
<br>504 1064 TCP_MISS:NONE
<br> 158.41.4.44 - - [04/Dec/2009:16:03:13 +0000] "CONNECT
<br>63.130.82.113:443 HTTP/1.0" 403 980 TCP_DENIED:NONE
<br><br><br>And config extracts:
<br><br> acl SSL_ports port 443 563 444
<br> acl Safe_ports port 80 8002 23142 5481 5181 5281 5381 5481 5581
<br>5400 5500 # http
<br> acl Safe_ports port 23142 # OPEL project
<br> acl Safe_ports port 21 # ftp
<br> acl Safe_ports port 443 444 563 # https, snew#s
<br><br> acl CONNECT method CONNECT
<br><br> acl regex_ms dstdom_regex -i "/home/security/regex_marksandspencer.txt"
<br> acl urlregex_mands url_regex -i
<br>"/home/security/regex_marksandspencer_ip.txt"
<br> acl mands_allowed_nets src "/home/security/mands_allowed_nets.txt"
<br><br> http_access allow manager localhost
<br> http_access deny manager
<br> http_access deny !Safe_ports
<br> http_access deny CONNECT !SSL_ports
<br><br> http_access allow regex_ms mands_allowed_nets
<br> http_access allow urlregex_mands mands_allowed_nets
<br> http_access deny all
<br><br>There are actually a lot more ACL's than this, but these are the only
<br>ones I think are relevant
<br><br>relevant extracts from files linked to ACLs:
<br> regex_marksandspencer.txt
<br> .*marksandspencer.*com
<br><br> regex_marksandspencer_ip.txt
<br> .*.63.130.82.113
<br><br><br>Thanks for any help.
<br><br>Kevin,
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26674022RE: any work arounds for bug 21762009-12-07T00:21:36Z2009-12-07T00:21:36Zbill.allisonAs the reporter of this bug, apologies Amos for not responding promptly and thanks Brett for doing so - my excuse is pressure of work. It's particularly on my conscience because we so badly need this fix. Today I have a test instance I can use, and I guess the next step, and my contribution, is apply the patch, tcpdump the result, and report back (unless Brett gets there first ;-) )
<br><br>Bill A.
<br><br>-----Original Message-----
<br>From: Brett Lymn [mailto:<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26674022&i=0" target="_top" rel="nofollow">blymn@...</a>]
<br>Sent: 07 December 2009 01:39
<br>To: Amos Jeffries
<br>Cc: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26674022&i=1" target="_top" rel="nofollow">squid-users@...</a>
<br>Subject: Re: [squid-users] any work arounds for bug 2176
<br><br>On Wed, Dec 02, 2009 at 07:22:57PM +1300, Amos Jeffries wrote:
<br>>
<br>> Sorry. I attached it to the bug report.
<br>>
<br><br>I manually applied the patch - I couldn't be bothered with patch for a
<br>simple #if removal. The symptoms have changed. We no longer get an
<br>auth pop up but at the end of the upload the browser displays:
<br><br>Bad Request (Invalid Verb)
<br><br>and the document is not shown in the list. So, the patch made a
<br>difference but something else is amiss still.
<br><br>--
<br>Brett Lymn
<br>"Warning:
<br>The information contained in this email and any attached files is
<br>confidential to BAE Systems Australia. If you are not the intended
<br>recipient, any use, disclosure or copying of this email or any
<br>attachments is expressly prohibited. If you have received this email
<br>in error, please notify us immediately. VIRUS: Every care has been
<br>taken to ensure this email and its attachments are virus free,
<br>however, any loss or damage incurred in using this email is not the
<br>sender's responsibility. It is your responsibility to ensure virus
<br>checks are completed before installing any data sent in this email to
<br>your computer."
<br><br><br><br>--
<br>This message has been scanned for viruses and
<br>dangerous content by MailScanner, and is
<br>believed to be clean.
<br><br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26673696Re: Squid at 100% CPU with 10 minutes period2009-12-06T23:39:39Z2009-12-06T23:39:39ZfedorischevВ сообщении от Friday 04 December 2009 23:51:28 Guy Bashkansky написал(а):
<div class='shrinkable-quote'><br>> Hi,
<br>>
<br>> The problem: on a certain origin content, Squid reaches 100% CPU
<br>> periodically, every 10 minutes, so the cache service suffers.
<br>>
<br>> Any clues where to look? Maybe this problem and its solution are known?
<br>>
<br>> The CPU load pattern is something like this, minute-by-minute:
<br>> 40%, 40%, 60%, 80%, 99%, 99%, 99%, 80%, 60%, 40%, repeat.
<br>>
<br>> Thanks,
<br>> Guy
</div><br>Several days ago I find, that Squid3.0STABLE16 eating CPU time by HTTP method
<br>CONNECT while request is hitting delay pool. I'm looking for the spare time
<br>to post more debugging info on the list.
<br><br>WBR.
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26673547RE: acl proxy_auth problem2009-12-06T23:25:29Z2009-12-06T23:25:29ZGeorg Roelli<br>----------------------------------------
<div class='shrinkable-quote'><br>> From: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26673547&i=0" target="_top" rel="nofollow">roellig@...</a>
<br>> To: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26673547&i=1" target="_top" rel="nofollow">squid-users@...</a>
<br>> Date: Fri, 4 Dec 2009 13:34:12 +0100
<br>> Subject: RE: [squid-users] acl proxy_auth problem
<br>>
<br>>
<br>>
<br>>
<br>> ----------------------------------------
<br>>> Date: Fri, 4 Dec 2009 12:20:34 +1300
<br>>> From: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26673547&i=2" target="_top" rel="nofollow">squid3@...</a>
<br>>> To: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26673547&i=3" target="_top" rel="nofollow">squid-users@...</a>
<br>>> Subject: Re: [squid-users] acl proxy_auth problem
<br>>>
<br>>> Georg Roelli wrote:
<br>>>> ----------------------------------------
<br>>>>> Date: Thu, 3 Dec 2009 10:36:10 +1300
<br>>>>> From: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26673547&i=4" target="_top" rel="nofollow">squid3@...</a>
<br>>>>> To: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26673547&i=5" target="_top" rel="nofollow">squid-users@...</a>
<br>>>>> Subject: Re: [squid-users] acl proxy_auth problem
<br>>>>>
<br>>>>> On Wed, 2 Dec 2009 15:15:15 +0100, Georg Roelli
<br>>>>> wrote:
<br>>>>>> Hello
<br>>>>>>
<br>>>>>> My environment: Ubuntu 8.04 LTS, Squid 2.6.18, Samba 3.0.28a
<br>>>>>>
<br>>>>>> I am looking to find a way to check with an acl if a user is member of a
<br>>>>>> specific ad-group. On my Squid Proxy Server, I have successfully set up
<br>>>>> an
<br>>>>>> SSO authentication with the active directory.
<br>>>>>> This works fine. Among other things:
<br>>>>>>
<br>>>>>> auth_param ntlm program /usr/bin/ntlm_auth
<br>>>>>> --helper-protocol=squid-2.5-ntlmssp
<br>>>>>> --require-membership-of="Domäne\\AD-GroupeA"
<br>>>>>>
<br>>>>>> Now I start with the definition of the acl's. At first I would like to
<br>>>>>> make a badUrls list which is valid for all users to block some sites.
<br>>>>> This
<br>>>>>> list should not be applied to a group of personal computers (host)
<br>>>>> and/or a
<br>>>>>> specific AD group.
<br>>>>>> Here is my approach:
<br>>>>>>
<br>>>>>> acl auth proxy_auth REQUIRED
<br>>>>>> acl badurls url_regex "/data/squid/badurls.txt"
<br>>>>>> acl AllowedClients srcdom_regex -i "/data/squid/allowed_clients.txt"
<br>>>>>> acl AllowedGroups proxy_auth -i Domäne/AD-GroupeB
<br>>>>>>
<br>>>>>> http_access allow auth AllowedClients
<br>>>>>> http_access allow auth AllowedGroups
<br>>>>>> http_access deny badurls
<br>>>>>> http_access allow auth
<br>>>>>> http_access deny all
<br>>>>>>
<br>>>>>> The acl with the badurls list and the acl for the AllowedClients are
<br>>>>>> working fine. But with the acl acl AllowedGroups proxy_auth -i
<br>>>>>> Domäne/AD-GruppeB I have great problems. I don't know how I can make an
<br>>>>> acl
<br>>>>>> who check the membership from an AD-Groupe.
<br>>>>>> I tested many different types of spelling. Unfortunately without
<br>>>>> success.
<br>>>>>> How can I make an acl using ntlm_auth authentication? Is there a better
<br>>>>> and
<br>>>>>> easier way to do this?
<br>>>>>>
<br>>>>>> Thank you for your suggestions.
<br>>>>>>
<br>>>>>> Kind regards.
<br>>>>>>
<br>>>>>
<br>>>>>
<br>>>>> <a href="http://wiki.squid-cache.org/ConfigExamples/Authenticate/NtlmWithGroups" target="_top" rel="nofollow">http://wiki.squid-cache.org/ConfigExamples/Authenticate/NtlmWithGroups</a><br>>>>>
<br>>>>> Amos
<br>>>>
<br>>>> Hello Amos
<br>>>>
<br>>>> Thank you for your note.
<br>>>>
<br>>>> I have try it and after a have modified the lines in
<br>>>>
<br>>>> external_acl_type testForNTGroup %LOGIN /usr/lib/squid/wbinfo_group.pl -d
<br>>>> acl inGroupX external testForNTGroup obmg
<br>>>> http_access allow inGroupX
<br>>>>
<br>>>> I can restart the squid service without problems. Unfortunately the alc does not work.
<br>>>> In a documentation I have found the -d option for wbinfo_group.pl and now I find these messages in the access.log:
<br>>>
<br>>> You means cache.log surely?
<br>>>
<br>>>>
<br>>>> [2009/12/03 13:18:16, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
<br>>>> Got NTLMSSP neg_flags=0xa2088205
<br>>>> Got wag obmg from squid
<br>>>> Could not convert sid S-1-5-21-986273330-1409306274-1541874228-6339 to gid
<br>>>> User: -rog-
<br>>>> Group: -obmg-
<br>>>> SID: -S-1-5-21-986273330-1409306274-1541874228-6339-
<br>>>> GID: --
<br>>>> Sending ERR to squid
<br>>>>
<br>>>> Do you have any other ideas what dies message exactly means?
<br>>>
<br>>> They means the user "rog" exists but was not a registered member of
<br>>> group "obmg".
<br>>>
<br>>> Look in the registry (I think on the domain controller) for
<br>>> "S-1-5-21-986273330-1409306274-1541874228-6339" and see what groups it's
<br>>> a member of.
<br>>>
<br>>> Amos
<br>>> --
<br>>> Please be using
<br>>> Current Stable Squid 2.7.STABLE7 or 3.0.STABLE20
<br>>> Current Beta Squid 3.1.0.15
<br>>
<br>> I’m a little bit confused.
<br>>
<br>> I checked in the active directory which object has the SID S-1-5-21-986273330-1409306274-1541874228-6339. It’s the group obmg in my domain. Also, the user rog is a member of the group obmg. When I repeat the test with another domain user, he is member of obmg, I get the same error.
<br>>
<br>> I think the problem isn’t the membership of the user rog, it’s the fact, that wbinfo_grou.pl can’t generate a UID from the SID of the group.
<br>>
<br>> The error was:
<br>> Could not convert sid S-1-5-21-986273330-1409306274-1541874228-6339 to gid
<br>>
<br>> I made a few tests:
<br>>
<br>> # wbinfo -n obmg
<br>> S-1-5-21-986273330-1409306274-1541874228-6339 Domain Group (2)
<br>>
<br>> # wbinfo -Y S-1-5-21-986273330-1409306274-1541874228-6339
<br>> Could not convert sid S-1-5-21-986273330-1409306274-1541874228-6339 to gid
<br>>
<br>> With another group I get the results:
<br>>
<br>> # wbinfo -n inor
<br>> S-1-5-21-986273330-1409306274-1541874228-1059 Domain Group (2)
<br>>
<br>> # wbinfo -Y S-1-5-21-986273330-1409306274-1541874228-1059
<br>> 10029
<br>>
<br>> When I take the group inor for the acl I get those entries in the cache.log and the access to internet works.
<br>>
<br>> [2009/12/04 13:07:34, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
<br>> Got NTLMSSP neg_flags=0xa2088205
<br>> Got rog inor from squid
<br>> User: -rog-
<br>> Group: -inor-
<br>> SID: -S-1-5-21-986273330-1409306274-1541874228-1059-
<br>> GID: -10029-
<br>> Sending OK to squid
<br>>
<br>> So my next question is, why do I get from one group an UID and from the other not? Any ideas?
<br>>
<br>> G.
</div><br>Good morning
<br>
<br>Has anyone a good idea or a hint for me?
<br>
<br>G.
<br><br>
<br>_________________________________________________________________
<br>Ski-Weltcup: Alle Rennen, alle Resultate und News auf MSN Sport
<br><a href="http://sport.ch.msn.com/skialpin/" target="_top" rel="nofollow">http://sport.ch.msn.com/skialpin/</a><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26673172Re: COSS cache_dir size exceeds largest offset at maximum file size2009-12-06T22:37:49Z2009-12-06T22:37:49ZAmos Jeffries-2Jason Healy wrote:
<div class='shrinkable-quote'><br>> Hello,
<br>>
<br>> I'm trying to set up a large COSS cache_dir. I've used COSS in the
<br>> past, but I've never tried to max out on the size of the file (I'm not
<br>> even sure if this is a good idea...)
<br>>
<br>> When I try to start, squid fails with the following log messages:
<br>>
<br>> 2009/12/05 12:16:00| parse_line: cache_dir coss /squid/small/coss01
<br>> 131072 block-size=8192 max-size=1048576
<br>> maxfullbufs=256
<br>> 2009/12/05 12:16:00| COSS block-size = 8192 bytes
<br>> 2009/12/05 12:16:00| COSS largest file offset = 4194296 KB
<br>> 2009/12/05 12:16:00| COSS cache_dir size = 134217728 KB
<br>> FATAL: COSS cache_dir size exceeds largest offset
<br>>
<br>> I think I'm using the "block-size" param correctly to get to the
<br>> maximum size of 131072MB. However, Squid seems to disagree on the
<br>> maximum file offset.
<br>>
<br>> I've compiled using --with-large-*, so I'm not sure what I'm
<br>> missing here:
</div><br>You have indeed pushed the envelope right out that to the last single
<br>byte of the index maximum boundary.
<br><br>For some reason the safety check that is catching you uses > instead of >=
<br>I'm not sure why. If you want to experiment you could change it manually
<br>and rebuild. Around line 864 of src/fs/coss/store_dir_coss.c.
<br><br>Amos
<br>--
<br>Please be using
<br> Current Stable Squid 2.7.STABLE7 or 3.0.STABLE20
<br> Current Beta Squid 3.1.0.15
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26673041Re: Any work around for bug 28052009-12-06T22:16:19Z2009-12-06T22:16:19ZAmos Jeffries-2sankar m wrote:
<br>> Dear Sir,
<br>>
<br>> Is there any work around for this bug (2805). Every day, I'm receiving
<br>> at least THREE to FIVE queries related to this problem. Could you
<br>> please help me in this.?
<br>>
<br><br>The cause of the bug is still uknown and unreproducible by anyone other
<br>than you.
<br><br>The last comment in the bug tracker details some further information
<br>needed to track it down. Please assist the fix by providing the
<br>mentioned info to those who are trying to fix it.
<br><br>Amos
<br>--
<br>Please be using
<br> Current Stable Squid 2.7.STABLE7 or 3.0.STABLE20
<br> Current Beta Squid 3.1.0.15
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26672677Any work around for bug 28052009-12-06T21:12:04Z2009-12-06T21:12:04Zsankar mDear Sir,
<br><br>Is there any work around for this bug (2805). Every day, I'm receiving
<br>at least THREE to FIVE queries related to this problem. Could you
<br>please help me in this.?
<br><br>Thank you.
<br><br>Regards,
<br>Sankar.M
<br><br><br>---------- Forwarded message ----------
<br>From: sankar m <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26672677&i=0" target="_top" rel="nofollow">debianlinux.ss@...</a>>
<br>Date: Wed, Nov 4, 2009 at 9:28 AM
<br>Subject: Digest Ldap Authentication got failed for some user accounts
<br>To: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26672677&i=1" target="_top" rel="nofollow">squid-users@...</a>
<br><br><br>Dear Sir,
<br><br>As per your previous mail, I have filed a bug report and the link is
<br>provided below,
<br><br><a href="http://bugs.squid-cache.org/show_bug.cgi?id=2805" target="_top" rel="nofollow">http://bugs.squid-cache.org/show_bug.cgi?id=2805</a><br><br>I am still restarting the squid everyday to avoid "Authentication
<br>failed" issue. Please help me in this.
<br><br>I am looking forward to hear from you.
<br><br>Thanks and Regards,
<br>Sankar.M
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26672298Build failed in Hudson: 3.0-i386-Debian-sid #252009-12-06T20:16:13Z2009-12-06T20:16:13Znoc-8See <<a href="http://build.squid-cache.org/job/3.0-i386-Debian-sid/25/" target="_top" rel="nofollow">http://build.squid-cache.org/job/3.0-i386-Debian-sid/25/</a>>
<br><br>------------------------------------------
<br>Started by upstream project "3.0-amd64-CentOS-5.3" build number 33
<br>Building remotely on rio.treenet
<br><a href="http://bzr.squid-cache.org/bzr/squid3/branches/SQUID_3_0" target="_top" rel="nofollow">http://bzr.squid-cache.org/bzr/squid3/branches/SQUID_3_0</a> is permanently redirected to <a href="http://bzr.squid-cache.org/bzr/squid3/branches/SQUID_3_0/" target="_top" rel="nofollow">http://bzr.squid-cache.org/bzr/squid3/branches/SQUID_3_0/</a><br>bzr: ERROR: Invalid http response for <a href="http://bzr.squid-cache.org/bzr/squid3/.bzr/repository/indices/2ac0b245adaec88233f3f214954e0737.tix:" target="_top" rel="nofollow">http://bzr.squid-cache.org/bzr/squid3/.bzr/repository/indices/2ac0b245adaec88233f3f214954e0737.tix:</a> Unable to handle http code 504: Gateway Time-out
<br>ERROR: Failed to pull
<br><br><p>From forum: <a href="http://old.nabble.com/Squid---Development-f22484.html" embed="fixTarget[22484]" target="_top" >Squid - Development</a></p>tag:old.nabble.com,2006:post-26671492COSS cache_dir size exceeds largest offset at maximum file size2009-12-06T17:57:07Z2009-12-06T17:57:07ZJason HealyHello,
<br><br>I'm trying to set up a large COSS cache_dir. I've used COSS in the
<br>past, but I've never tried to max out on the size of the file (I'm not
<br>even sure if this is a good idea...)
<br><br>When I try to start, squid fails with the following log messages:
<br><br>2009/12/05 12:16:00| parse_line: cache_dir coss /squid/small/coss01
<br> 131072 block-size=8192 max-size=1048576
<br> maxfullbufs=256
<br>2009/12/05 12:16:00| COSS block-size = 8192 bytes
<br>2009/12/05 12:16:00| COSS largest file offset = 4194296 KB
<br>2009/12/05 12:16:00| COSS cache_dir size = 134217728 KB
<br>FATAL: COSS cache_dir size exceeds largest offset
<br><br>I think I'm using the "block-size" param correctly to get to the
<br>maximum size of 131072MB. However, Squid seems to disagree on the
<br>maximum file offset.
<br><br>I've compiled using --with-large-*, so I'm not sure what I'm
<br>missing here:
<br><br>`squid -v` says: configure options:
<br> '--prefix=/usr' '--exec_prefix=/usr' '--bindir=/usr/sbin'
<br> '--sbindir=/usr/sbin' '--libexecdir=/usr/lib/squid'
<br> '--sysconfdir=/etc/squid' '--localstatedir=/var/spool/squid'
<br> '--datadir=/usr/share/squid' '--enable-async-io' '--with-pthreads'
<br> '--enable-storeio=ufs,aufs,coss,diskd,null' '--enable-linux-netfilter'
<br> '--enable-arp-acl' '--enable-epoll' '--enable-snmp'
<br> '--enable-removal-policies=lru,heap' '--enable-delay-pools'
<br> '--enable-htcp' '--enable-cache-digests'
<br> '--enable-auth=basic,digest,negotiate'
<br> '--enable-negotiate-auth-helpers=squid_kerb_auth'
<br> '--enable-carp' '--with-large-files' '--with-maxfd=65536'
<br> '--disable-ident-lookups'
<br> '--enable-follow-x-forwarded-for' '--enable-forw-via-db'
<br> '--enable-large-cache-files'
<br> 'sparc-debian-linux' 'build_alias=sparc-debian-linux'
<br> 'host_alias=sparc-debian-linux'
<br> 'target_alias=sparc-debian-linux'
<br> 'CFLAGS=-Wall -g -O2 -pipe -mcpu=niagara' 'LDFLAGS='
<br> 'CPPFLAGS=-O2 -pipe -mcpu=niagara'
<br><br>This is squid-2.7STABLE7 running on Debian Linux kernel 2.6.31
<br>(SMP/64bit) on a SunFire T2000 (niagara1).
<br><br>Thanks,
<br><br>Jason
<br><br>--
<br>Jason Healy | <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26671492&i=0" target="_top" rel="nofollow">jhealy@...</a> | <a href="http://www.logn.net/" target="_top" rel="nofollow">http://www.logn.net/</a><br><br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26671442Re: any work arounds for bug 21762009-12-06T17:38:32Z2009-12-06T17:38:32ZBrett LymnOn Wed, Dec 02, 2009 at 07:22:57PM +1300, Amos Jeffries wrote:
<br>>
<br>> Sorry. I attached it to the bug report.
<br>>
<br><br>I manually applied the patch - I couldn't be bothered with patch for a
<br>simple #if removal. The symptoms have changed. We no longer get an
<br>auth pop up but at the end of the upload the browser displays:
<br><br>Bad Request (Invalid Verb)
<br><br>and the document is not shown in the list. So, the patch made a
<br>difference but something else is amiss still.
<br><br>--
<br>Brett Lymn
<br>"Warning:
<br>The information contained in this email and any attached files is
<br>confidential to BAE Systems Australia. If you are not the intended
<br>recipient, any use, disclosure or copying of this email or any
<br>attachments is expressly prohibited. If you have received this email
<br>in error, please notify us immediately. VIRUS: Every care has been
<br>taken to ensure this email and its attachments are virus free,
<br>however, any loss or damage incurred in using this email is not the
<br>sender's responsibility. It is your responsibility to ensure virus
<br>checks are completed before installing any data sent in this email to
<br>your computer."
<br><br><br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26669439Re: Stable Squid version for windows OS2009-12-06T13:41:02Z2009-12-06T13:41:02ZAmos Jeffries-2On Sun, 6 Dec 2009 22:31:04 +0100, "Source Systems Technical"
<br><<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26669439&i=0" target="_top" rel="nofollow">support@...</a>> wrote:
<br>> Good day,
<br>> Can i use squid-3.0.STABLE20 with Windows OS? If not, which version of
<br>> squid
<br>> is more suitable for any version of windows OS?
<br><br><a href="http://squid.acmeconsulting.it/" target="_top" rel="nofollow">http://squid.acmeconsulting.it/</a><br><br>> Does squid-cache/proxy support two (2) internet connections at the same
<br>> time
<br>> for a local network?
<br><br>Squid supports HTTP over TCP. Whatever support the TCP router for the
<br>network provides is used.
<br><br>Amos
<br><br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26669393Re: Squid failing to open some websites randomly ...2009-12-06T13:38:13Z2009-12-06T13:38:13ZAmos Jeffries-2On Sun, 06 Dec 2009 23:08:28 +0500, "Asim Ahmed @ Folio3"
<br><<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26669393&i=0" target="_top" rel="nofollow">aahmed@...</a>> wrote:
<br>> Hi,
<br>>
<br>> I am facing a wierd problem with my squid setup. I've installed squid on
<br><div class='shrinkable-quote'><br>> a Dual Core machine with 2 GB of RAM and plenty of HDD space available.
<br>>
<br>> Problem: When users try to open different websites (specially on bbc
<br>> domain and on many other sites) they encountered following error: But
<br>> when i try this URL form a different gateway that does not run squid,
<br>> page opens successfully. I am running shorewall on this server for
<br>> NATTING/Firewalling and REDIREC-ting port 80 traffic to squid as
<br>> follows: (squid running on port 4040) and I've opened port 4040 on
<br>> systems firewall.
<br>>
<br>> #ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE
</div>ORIGINAL
<br>> # PORT(S) DEST
<br>> ACCEPT $FW net tcp www
<br>> REDIRECT loc 4040 tcp www -
<br>>
<br><br><br>FWIW, I can't see any reason why it's failing other than a regular old
<br>network connection fail.
<br><br><br>> ERROR
<br>> The requested URL could not be retrieved
<br>>
<br>--------------------------------------------------------------------------------
<div class='shrinkable-quote'><br>> The following error was encountered while trying to retrieve the URL:
<br>> <a href="http://news.bbc.co.uk/1/hi/world/asia-pacific/8397717.stm" target="_top" rel="nofollow">http://news.bbc.co.uk/1/hi/world/asia-pacific/8397717.stm</a><br>>
<br>> Connection to 212.58.226.142 failed.
<br>>
<br>> The system returned: (111) Connection refused
<br>>
<br>> The remote host or network may be down. Please try the request again.
<br>>
<br>> Your cache administrator is root.
<br>>
</div>--------------------------------------------------------------------------------
<div class='shrinkable-quote'><br>> Generated Sun, 06 Dec 2009 17:51:35 GMT by LIANA (squid/3.0.STABLE20)
<br>>
<br>> My squid.conf is as follows:
<br>> ===================
<br>> acl manager proto cache_object
<br>> acl localhost src 127.0.0.1/32
<br>> acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
<br>> acl folio3Network src 192.168.4.0/24
<br>> acl SSL_ports port 443
<br>> acl Safe_ports port 80 # http
<br>> acl Safe_ports port 21 # ftp
<br>> acl Safe_ports port 443 # https
<br>> acl Safe_ports port 70 # gopher
<br>> acl Safe_ports port 210 # wais
<br>> acl Safe_ports port 1025-65535 # unregistered ports
<br>> acl Safe_ports port 280 # http-mgmt
<br>> acl Safe_ports port 488 # gss-http
<br>> acl Safe_ports port 591 # filemaker
<br>> acl Safe_ports port 777 # multiling http
<br>> acl CONNECT method CONNECT
<br>> acl super_users src "/etc/squid/f3_acls/super_users.acl"
<br>> acl gerrys_users src "/etc/squid/f3_acls/gerrys_groups.acl"
<br>> acl netsat_users src "/etc/squid/f3_acls/netsat_groups.acl"
<br>> acl managers src "/etc/squid/f3_acls/managers.acl"
<br>> acl blocked_sites dstdomain "/etc/squid/f3_acls/blocked_sites.acl"
<br>> acl blocked_request_mt req_mime_type -i
<br>> "/etc/squid/f3_acls/blocked_mimetypes.acl"
<br>> acl blocked_reply_mt rep_mime_type -i
<br>> "/etc/squid/f3_acls/blocked_mimetypes.acl"
<br>> acl gaming_sites dstdomain "/etc/squid/f3_acls/gaming_sites.acl"
<br>> acl server_machines src "/etc/squid/f3_acls/server_machines.acl"
<br>> acl working_hours time MTWHF 09:00-12:30
<br>> acl working_hours time MTWHF 14:00-18:30
<br>> acl gaming_hours time MTWHF 21:00-23:59
<br>> acl gaming_hours time MTWHF 01:00-07:00
<br>> http_access allow manager localhost
<br>> http_access deny manager
<br>> http_access deny !Safe_ports
<br>> http_access deny CONNECT !SSL_ports
<br>> http_access allow super_users
<br>> http_access deny working_hours blocked_sites
<br>> http_access deny working_hours blocked_request_mt
<br>> http_access deny !gaming_hours gaming_sites
<br>> http_access allow managers
<br>> http_access allow gerrys_users
<br>> http_access allow server_machines
<br>> http_access allow localhost
<br>> http_access deny all
<br>> http_reply_access deny working_hours blocked_reply_mt
<br>> icp_access allow folio3Network
<br>> icp_access deny all
<br>> htcp_access allow folio3Network
<br>> htcp_access deny all
<br>> http_port 4040 transparent
<br>> hierarchy_stoplist cgi-bin ?
<br>> cache_dir aufs /var/spool/squid 10240 16 256
<br>> access_log /var/log/squid/access.log squid
<br>> refresh_pattern ^ftp: 1440 20% 10080
<br>> refresh_pattern ^gopher: 1440 0% 1440
<br>> refresh_pattern (cgi-bin|\?) 0 0% 0
</div><br>Missing '/'s (/cgi-bin/|\?)
<br><br>> refresh_pattern . 0 20% 4320
<br>> visible_hostname LIANA
<br>> icp_port 3130
<br>> coredump_dir /var/spool/squid
<br>>
<br>> Any idea what might be going wrong? Some times I suspect it could be a
<br>> DNS issue but then why every thing works fine if I turn off squid and
<br>> browse through shorewall only?
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26669318Stable Squid version for windows OS2009-12-06T13:31:04Z2009-12-06T13:31:04ZSource Systems TechnicalGood day,
<br>Can i use squid-3.0.STABLE20 with Windows OS? If not, which version of squid
<br>is more suitable for any version of windows OS?
<br>Does squid-cache/proxy support two (2) internet connections at the same time
<br>for a local network?
<br>Regards,
<br>Yomi.
<br><br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26667434Squid failing to open some websites randomly ...2009-12-06T10:08:28Z2009-12-06T10:08:28ZAsim Ahmed @ Folio3Hi,
<br><br>I am facing a wierd problem with my squid setup. I've installed squid on
<br>a Dual Core machine with 2 GB of RAM and plenty of HDD space available.
<br><br>Problem: When users try to open different websites (specially on bbc
<br>domain and on many other sites) they encountered following error: But
<br>when i try this URL form a different gateway that does not run squid,
<br>page opens successfully. I am running shorewall on this server for
<br>NATTING/Firewalling and REDIREC-ting port 80 traffic to squid as
<br>follows: (squid running on port 4040) and I've opened port 4040 on
<br>systems firewall.
<br><br>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL
<br># PORT(S) DEST
<br>ACCEPT $FW net tcp www
<br>REDIRECT loc 4040 tcp www -
<br><br>ERROR
<br>The requested URL could not be retrieved
<br>--------------------------------------------------------------------------------
<br>The following error was encountered while trying to retrieve the URL:
<br><a href="http://news.bbc.co.uk/1/hi/world/asia-pacific/8397717.stm" target="_top" rel="nofollow">http://news.bbc.co.uk/1/hi/world/asia-pacific/8397717.stm</a><br><br>Connection to 212.58.226.142 failed.
<br><br>The system returned: (111) Connection refused
<br><br>The remote host or network may be down. Please try the request again.
<br><br>Your cache administrator is root.
<br>--------------------------------------------------------------------------------
<br>Generated Sun, 06 Dec 2009 17:51:35 GMT by LIANA (squid/3.0.STABLE20)
<br><br>My squid.conf is as follows:
<br>===================
<br>acl manager proto cache_object
<br>acl localhost src 127.0.0.1/32
<br>acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
<br>acl folio3Network src 192.168.4.0/24
<br>acl SSL_ports port 443
<br>acl Safe_ports port 80 # http
<br>acl Safe_ports port 21 # ftp
<br>acl Safe_ports port 443 # https
<br>acl Safe_ports port 70 # gopher
<br>acl Safe_ports port 210 # wais
<br>acl Safe_ports port 1025-65535 # unregistered ports
<br>acl Safe_ports port 280 # http-mgmt
<br>acl Safe_ports port 488 # gss-http
<br>acl Safe_ports port 591 # filemaker
<br>acl Safe_ports port 777 # multiling http
<br>acl CONNECT method CONNECT
<br>acl super_users src "/etc/squid/f3_acls/super_users.acl"
<br>acl gerrys_users src "/etc/squid/f3_acls/gerrys_groups.acl"
<br>acl netsat_users src "/etc/squid/f3_acls/netsat_groups.acl"
<br>acl managers src "/etc/squid/f3_acls/managers.acl"
<br>acl blocked_sites dstdomain "/etc/squid/f3_acls/blocked_sites.acl"
<br>acl blocked_request_mt req_mime_type -i
<br>"/etc/squid/f3_acls/blocked_mimetypes.acl"
<br>acl blocked_reply_mt rep_mime_type -i
<br>"/etc/squid/f3_acls/blocked_mimetypes.acl"
<br>acl gaming_sites dstdomain "/etc/squid/f3_acls/gaming_sites.acl"
<br>acl server_machines src "/etc/squid/f3_acls/server_machines.acl"
<br>acl working_hours time MTWHF 09:00-12:30
<br>acl working_hours time MTWHF 14:00-18:30
<br>acl gaming_hours time MTWHF 21:00-23:59
<br>acl gaming_hours time MTWHF 01:00-07:00
<br>http_access allow manager localhost
<br>http_access deny manager
<br>http_access deny !Safe_ports
<br>http_access deny CONNECT !SSL_ports
<br>http_access allow super_users
<br>http_access deny working_hours blocked_sites
<br>http_access deny working_hours blocked_request_mt
<br>http_access deny !gaming_hours gaming_sites
<br>http_access allow managers
<br>http_access allow gerrys_users
<br>http_access allow server_machines
<br>http_access allow localhost
<br>http_access deny all
<br>http_reply_access deny working_hours blocked_reply_mt
<br>icp_access allow folio3Network
<br>icp_access deny all
<br>htcp_access allow folio3Network
<br>htcp_access deny all
<br>http_port 4040 transparent
<br>hierarchy_stoplist cgi-bin ?
<br>cache_dir aufs /var/spool/squid 10240 16 256
<br>access_log /var/log/squid/access.log squid
<br>refresh_pattern ^ftp: 1440 20% 10080
<br>refresh_pattern ^gopher: 1440 0% 1440
<br>refresh_pattern (cgi-bin|\?) 0 0% 0
<br>refresh_pattern . 0 20% 4320
<br>visible_hostname LIANA
<br>icp_port 3130
<br>coredump_dir /var/spool/squid
<br><br>Any idea what might be going wrong? Some times I suspect it could be a
<br>DNS issue but then why every thing works fine if I turn off squid and
<br>browse through shorewall only?
<br><br>--
<br><br>Regards,
<br><br>Asim Ahmed Khan
<br>IT Manager,
<br>Folio3 (Pvt.) Ltd. www.folio3.com
<br>Direct: 92-21-4323721-4 Ext 110
<br>Email: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26667434&i=0" target="_top" rel="nofollow">aahmed@...</a>
<br><br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26666804RE: squid ceasing to function when interface goes down2009-12-06T08:59:14Z2009-12-06T08:59:14Ztyler-53<br><div class='shrinkable-quote'><br>> -------- Original Message --------
<br>> Subject: Re: [squid-users] squid ceasing to function when interface
<br>> goes down
<br>> From: Jose Ildefonso Camargo Tolosa <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26666804&i=0" target="_top" rel="nofollow">ildefonso.camargo@...</a>>
<br>> Date: Sun, December 06, 2009 10:44 am
<br>> To: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26666804&i=1" target="_top" rel="nofollow">tyler@...</a>
<br>> Cc: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26666804&i=2" target="_top" rel="nofollow">squid-users@...</a>
<br>>
<br>>
<br>> Hi!
<br>>
<br>> This could come a little "off-topic", but: which VPN are you using? if
<br>> you happen to be using OpenVPN, try adding the option "persist-tun",
<br>> also, there is a chance that you can make squid actually restart when
<br>> the VPN goes down and up again (by using the "down" and "up" options,
<br>> that calls down and up scripts).
<br>>
<br>> Anyway, please keep us informed!
</div>All of those are already done.
<br><br>I've reset the cache. rm -rf /var/cache/squid/* and let it rebuild it.
<br>The cache seemed the only difference between this installation and two
<br>other ones with the same configs that remain stable... If that doesn't
<br>work, I may need to replace the server.
<br><br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26666694Re: squid ceasing to function when interface goes down2009-12-06T08:44:44Z2009-12-06T08:44:44ZJose Ildefonso Camargo TolosaHi!
<br><br>This could come a little "off-topic", but: which VPN are you using? if
<br>you happen to be using OpenVPN, try adding the option "persist-tun",
<br>also, there is a chance that you can make squid actually restart when
<br>the VPN goes down and up again (by using the "down" and "up" options,
<br>that calls down and up scripts).
<br><br>Anyway, please keep us informed!
<br><br>I hope this helps,
<br><br>Ildefonso Camargo
<br><br>On Mon, Dec 7, 2009 at 11:22 AM, <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26666694&i=0" target="_top" rel="nofollow">tyler@...</a>> wrote:
<div class='shrinkable-quote'><br>>
<br>>
<br>>> -------- Original Message --------
<br>>> Subject: Re: [squid-users] squid ceasing to function when interface
<br>>> goes down
<br>>> From: Amos Jeffries <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26666694&i=1" target="_top" rel="nofollow">squid3@...</a>>
<br>>> Date: Sat, December 05, 2009 5:02 pm
<br>>> To: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26666694&i=2" target="_top" rel="nofollow">squid-users@...</a>
<br>>> 1) server_persistent_connections off. This should prevent Squid using
<br>>> any connections to the parent which are possibly hung.
<br>>>
<br>>> 2) Make sure ICMP is built in and going so Squid can actively measure
<br>>> the network link to the parent. This is a simpler up-detection
<br>>> replacement for ICP which you have disabled by using "no-query".
<br>>
<br>>
<br>> I had hoped this had solved the problem, however this morning I woke to
<br>> endless 404's and screaming customers like usual. nothing in cache.log.
<br>> what is going on here!?
<br>>
<br>>
<br></div><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26666147RE: squid ceasing to function when interface goes down2009-12-06T07:52:01Z2009-12-06T07:52:01Ztyler-53<br><div class='shrinkable-quote'><br>> -------- Original Message --------
<br>> Subject: Re: [squid-users] squid ceasing to function when interface
<br>> goes down
<br>> From: Amos Jeffries <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26666147&i=0" target="_top" rel="nofollow">squid3@...</a>>
<br>> Date: Sat, December 05, 2009 5:02 pm
<br>> To: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26666147&i=1" target="_top" rel="nofollow">squid-users@...</a>
<br>> 1) server_persistent_connections off. This should prevent Squid using
<br>> any connections to the parent which are possibly hung.
<br>>
<br>> 2) Make sure ICMP is built in and going so Squid can actively measure
<br>> the network link to the parent. This is a simpler up-detection
<br>> replacement for ICP which you have disabled by using "no-query".
</div><br><br>I had hoped this had solved the problem, however this morning I woke to
<br>endless 404's and screaming customers like usual. nothing in cache.log.
<br> what is going on here!?
<br><br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26666073Squid does not work after origin's server DirectoryIndex change2009-12-06T07:44:37Z2009-12-06T07:44:37ZAdam SquidsI had index.html redirecting to <a href="http://www.domain.com/online/1.html" target="_top" rel="nofollow">http://www.domain.com/online/1.html</a> in
<br>my origin server. Now I changed Apache configs and set DirectoryIndex
<br>to be /online/1.html. When I browse straight to my origin, it works
<br>fine. When I browse via my squid server I get ERR_READ_ERROR 104
<br><br>I assume that in this case, 'connection reset by peer', peer==Apache
<br>origin. How come I can access it when I browse straight to it ? and it
<br>even works perfectly?
<br>What should I look for in cache.log ? I did not find anything aspecially odd :)
<br><br>Many thanks,
<br><br>Adam
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26665614Hudson build is back to normal: 3.1-i386-Debian-sid #482009-12-06T06:44:39Z2009-12-06T06:44:39Znoc-8See <<a href="http://build.squid-cache.org/job/3.1-i386-Debian-sid/48/changes" target="_top" rel="nofollow">http://build.squid-cache.org/job/3.1-i386-Debian-sid/48/changes</a>>
<br><br><br><p>From forum: <a href="http://old.nabble.com/Squid---Development-f22484.html" embed="fixTarget[22484]" target="_top" >Squid - Development</a></p>tag:old.nabble.com,2006:post-26665446squid receives (null) instead of http2009-12-06T06:20:05Z2009-12-06T06:20:05ZArthur TiteicaHi,
<br><br>Recently I see lots of the following in my squid logs
<br><br>1259130624.131 0 89.42.191.44 NONE/400 3172 GET
<br>(null)://example.com/Contab/Rapoarte/Rapoarte_obisnuite.asp?strCategorie=ContPart
<br>- NONE/- text/html
<br><br>1259141404.195 0 89.122.203.185 NONE/400 3200 POST
<br>(null)://example.com/Contab/NoteContabile/NoteContabUpd.asp?op=MODPOZ&NotaContabId=185
<br>- NONE /- text/html
<br><br><br>Squid is: Squid Cache: Version 3.1.0.14-20091120 on Ubuntu Server 9.04
<br>x86 and the clients are Windows mostly with IE8 but also with older IE,
<br>Opera and Firefox.
<br><br>Squid is acting as a reverse proxy in this case and it has worked like
<br>that for at least an year now. Only recently I started seeing these kind
<br>of errors. The client receives the usual squid error and a client
<br>refresh solves it in general.
<br><br>Regards,
<br><br>Arthur
<br><br><br /> <div class="small"><br/><img src="http://old.nabble.com/images/icon_attachment.gif" > <strong>signature.asc</strong> (564 bytes) <a href="http://old.nabble.com/attachment/26665446/0/signature.asc" target="_top">Download Attachment</a></div><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26663753Re: can't compile 3.1.0.152009-12-06T02:47:09Z2009-12-06T02:47:09ZAmos Jeffries-2Landy Landy wrote:
<div class='shrinkable-quote'><br>> I'm trying to upgrade from 3.1.0.14 to 3.1.0.15 but I'm getting an error when compiling:
<br>>
<br>> c MessageRep.cc -fPIC -DPIC -o .libs/MessageRep.o
<br>> cc1plus: warnings being treated as errors
<br>> MessageRep.cc: In member function âlibecap::Name Adaptation::Ecap::FirstLineRep::protocol() constâ:
<br>> MessageRep.cc:120: warning: enumeration value âPROTO_ICYâ not handled in switch
<br>> make[4]: *** [MessageRep.lo] Error 1
<br>> make[4]: Leaving directory `/workingdir/squid-3.1.0.15/src/adaptation/ecap'
<br>> make[3]: *** [all-recursive] Error 1
<br>> make[3]: Leaving directory `/workingdir/squid-3.1.0.15/src/adaptation'
<br>> make[2]: *** [all-recursive] Error 1
<br>> make[2]: Leaving directory `/workingdir/squid-3.1.0.15/src'
<br>> make[1]: *** [all] Error 2
<br>> make[1]: Leaving directory `/workingdir/squid-3.1.0.15/src'
<br>> make: *** [all-recursive] Error 1
<br>>
<br>>
<br>> These are the options I'm using:
<br>> ./configure --prefix=/usr/local/squid \
<br>> --sysconfdir=/etc/squid3.1 \
<br>> --enable-delay-pools \
<br>> --enable-kill-parent-hack \
<br>> --disable-htcp \
<br>> --enable-default-err-language=Spanish \
<br>> --enable-linux-netfilter \
<br>> --disable-ident-lookups \
<br>> --localstatedir=/var/log/squid3.1 \
<br>> --enable-stacktraces \
<br>> --with-default-user=proxy \
<br>> --with-large-files \
<br>> --enable-icap-client \
<br>> --enable-ecap \
<br>> --enable-async-io \
<br>> --enable-storeio="aufs" \
<br>> --enable-removal-policies="heap,lru" \
<br>> --with-maxfd=16384
<br>>
<br>>
<br>> These options worked with 3.1.0.14 don't know why is not compiling 3.1.0.15.
<br>>
</div><br>3.1.0.15 add support for SHOUTcast traffic. eCAP does not have the code
<br>to handle it yet.
<br><br>Band-aid patch just applied to 3.1:
<br><a href="http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-9822.patch" target="_top" rel="nofollow">http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-9822.patch</a><br><br>This should get it building, though I'm not sure of what will happen to
<br>eCAP when ICY passes through it.
<br><br>Amos
<br>--
<br>Please be using
<br> Current Stable Squid 2.7.STABLE7 or 3.0.STABLE20
<br> Current Beta Squid 3.1.0.15
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26663696Re: squid failing every 5 minutes2009-12-06T02:36:27Z2009-12-06T02:36:27ZAmos Jeffries-2Landy Landy wrote:
<div class='shrinkable-quote'><br>> Hello.
<br>>
<br>> I'm reposting about squid stoping and restarting every 5 minutes. I didn't get any more responses about it last time I posted and havent find a solution to the problem.
<br>>
<br>> Here's part of syslog:
<br>>
<br>> Dec 5 21:50:38 optimum-router squid[4769]: Squid Parent: child process 11973 exited due to signal 6 with status 0
<br>> Dec 5 21:50:41 optimum-router squid[4769]: Squid Parent: child process 12061 started
<br>> Dec 5 21:55:35 optimum-router squid[4769]: Squid Parent: child process 12061 exited due to signal 6 with status 0
<br>> Dec 5 21:55:38 optimum-router squid[4769]: Squid Parent: child process 12183 started
<br>> Dec 5 22:00:35 optimum-router squid[4769]: Squid Parent: child process 12183 exited due to signal 6 with status 0
<br>> Dec 5 22:00:38 optimum-router squid[4769]: Squid Parent: child process 12252 started
<br>> Dec 5 22:05:36 optimum-router squid[4769]: Squid Parent: child process 12252 exited due to signal 6 with status 0
<br>> Dec 5 22:05:39 optimum-router squid[4769]: Squid Parent: child process 12313 started
<br>> Dec 5 22:07:58 optimum-router squid[12391]: Squid Parent: child process 12393 started
<br>> Dec 5 22:10:36 optimum-router squid[12391]: Squid Parent: child process 12393 exited due to signal 6 with status 0
<br>> Dec 5 22:10:39 optimum-router squid[12391]: Squid Parent: child process 12522 started
<br>> Dec 5 22:15:41 optimum-router squid[12391]: Squid Parent: child process 12522 exited due to signal 6 with status 0
<br>> Dec 5 22:15:44 optimum-router squid[12391]: Squid Parent: child process 31594 started
<br>> Dec 5 22:20:35 optimum-router squid[12391]: Squid Parent: child process 31594 exited due to signal 6 with status 0
<br>> Dec 5 22:20:38 optimum-router squid[12391]: Squid Parent: child process 5466 started
<br>>
<br>> Dec 5 22:25:36 optimum-router squid[12391]: Squid Parent: child process 5466 exited due to signal 6 with status 0
<br>> Dec 5 22:25:39 optimum-router squid[12391]: Squid Parent: child process 13301 started
<br>>
<br>>
<br>> And here's cache.log
<br>>
<br>> 2009/12/05 22:15:55| IpIntercept.cc(137) NetfilterInterception: NF getsockopt(SO_ORIGINAL_DST) failed on FD 14: (2) No such file or directory
<br>> 2009/12/05 22:15:55| IpIntercept.cc(137) NetfilterInterception: NF getsockopt(SO_ORIGINAL_DST) failed on FD 15: (2) No such file or directory
</div><br>First problem: the above errors are due to non-NATed traffic arriving at
<br>a squid port flagged with "intercept" or "transparent".
<br><br>This is not a safe situation. You should have different ports for NAT
<br>intercepted traffic and normal traffic.
<br><br><div class='shrinkable-quote'><br>> (squid)(death+0x4b)[0x818b8cb]
<br>> [0xb7fb3420]
<br>> /usr/local/lib/ecap_adapter_gzip.so(_ZN7Adapter7Xaction17noteVbContentDoneEb+0x61)[0xb7aba411]
<br>> (squid)(_ZN10Adaptation4Ecap10XactionRep23noteBodyProductionEndedE8RefCountI8BodyPipeE+0x61)[0x81fdd61]
<br>> (squid)(_ZN12UnaryMemFunTI12BodyConsumer8RefCountI8BodyPipeEE6doDialEv+0x48)[0x80f1208]
<br>> (squid)(_ZN9JobDialer4dialER9AsyncCall+0x51)[0x8199661]
<br>> (squid)(_ZN10AsyncCallTI18BodyConsumerDialerE4fireEv+0x18)[0x80f1138]
<br>> (squid)(_ZN9AsyncCall4makeEv+0x17b)[0x819888b]
<br>> (squid)(_ZN14AsyncCallQueue8fireNextEv+0xf9)[0x819b4a9]
<br>> (squid)(_ZN14AsyncCallQueue4fireEv+0x28)[0x819b5a8]
<br>> (squid)(_ZN9EventLoop13dispatchCallsEv+0x13)[0x81096c3]
<br>> (squid)(_ZN9EventLoop7runOnceEv+0xf6)[0x81098b6]
<br>> (squid)(_ZN9EventLoop3runEv+0x28)[0x8109988]
<br>> (squid)(_Z9SquidMainiPPc+0x4b5)[0x8151e75]
<br>> (squid)(main+0x27)[0x81522f7]
<br>> /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xc8)[0xb7cfaea8]
<br>> (squid)(__gxx_personality_v0+0x155)[0x80bd081]
<br>> FATAL: Received Segment Violation...dying.
<br>> 2009/12/05 22:20:35| storeDirWriteCleanLogs: Starting...
<br>>
</div><br>eCAP adapter is crashing when Squid runs it's end-of-object handler.
<br><br>Also, a bug in Squid is causing Squid to fail catching the error and die
<br>itself.
<br><br>Amos
<br>--
<br>Please be using
<br> Current Stable Squid 2.7.STABLE7 or 3.0.STABLE20
<br> Current Beta Squid 3.1.0.15
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26663629Re: Squid at 100% CPU with 10 minutes period2009-12-06T02:25:39Z2009-12-06T02:25:39ZAmos Jeffries-2Guy Bashkansky wrote:
<div class='shrinkable-quote'><br>> Amos, thanks for the links. I've looked at the mailing list and the
<br>> open bugs, and could not find something similar to what I see, with
<br>> the 10 minutes period.
<br>>
<br>> We're using a customized version of Squid 2.4 STABLE6, and it's not in
<br>> my power to upgrade it to any later version... It runs on FreeBSD
<br>> 6.2-RELEASE-p9 amd64 servers.
<br>>
<br>> I know I need some profiling/debugging information to determine where
<br>> CPU spends its cycles, but on these servers most usual tools are
<br>> either absent or not working very well:
<br>> There's no 'oprofile' for FreeBSD, 'pmcstat' fails to run (no lib?),
<br>> 'gprof' does not give info beyond parseConfigFile() even in my custom
<br>> profiling-enabled version with -N, 'gdb' does not recognize debug
<br>> info, and 'strace' is not installed.
<br>>
<br>> I've found 'truss' command to be working and traced system calls made
<br>> by the squid process, trying to recognize some patterns -- noticed
<br>> that during CPU load spike write() sometimes returns EPIPE, 'Broken
<br>> pipe'.
<br>>
<br>> Does my version (2.4 STABLE6) ring any bells?
<br>>
</div><br>Sorry, 2.4 was ancient history when I joined the project. All I know
<br>about it is the list of features added that release.
<br><br>Amos
<br>--
<br>Please be using
<br> Current Stable Squid 2.7.STABLE7 or 3.0.STABLE20
<br> Current Beta Squid 3.1.0.15
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26662298Build failed in Hudson: 3.1-i386-Debian-sid #472009-12-05T20:57:00Z2009-12-05T20:57:00Znoc-8See <<a href="http://build.squid-cache.org/job/3.1-i386-Debian-sid/47/" target="_top" rel="nofollow">http://build.squid-cache.org/job/3.1-i386-Debian-sid/47/</a>>
<br><br>------------------------------------------
<br>Started by upstream project "3.1-amd64-CentOS-5.3" build number 59
<br>Building remotely on rio.treenet
<br><a href="http://bzr.squid-cache.org/bzr/squid3/branches/SQUID_3_1" target="_top" rel="nofollow">http://bzr.squid-cache.org/bzr/squid3/branches/SQUID_3_1</a> is permanently redirected to <a href="http://bzr.squid-cache.org/bzr/squid3/branches/SQUID_3_1/" target="_top" rel="nofollow">http://bzr.squid-cache.org/bzr/squid3/branches/SQUID_3_1/</a><br>bzr: ERROR: Invalid http response for <a href="http://bzr.squid-cache.org/bzr/squid3/branches/SQUID_3_1/.bzr/branch/tags:" target="_top" rel="nofollow">http://bzr.squid-cache.org/bzr/squid3/branches/SQUID_3_1/.bzr/branch/tags:</a> Unable to handle http code 504: Gateway Time-out
<br>ERROR: Failed to pull
<br><br><p>From forum: <a href="http://old.nabble.com/Squid---Development-f22484.html" embed="fixTarget[22484]" target="_top" >Squid - Development</a></p>tag:old.nabble.com,2006:post-26662280Hudson build is back to normal: 3.1-amd64-CentOS-5.3 #592009-12-05T20:51:00Z2009-12-05T20:51:00Znoc-8See <<a href="http://build.squid-cache.org/job/3.1-amd64-CentOS-5.3/59/changes" target="_top" rel="nofollow">http://build.squid-cache.org/job/3.1-amd64-CentOS-5.3/59/changes</a>>
<br><br><br><p>From forum: <a href="http://old.nabble.com/Squid---Development-f22484.html" embed="fixTarget[22484]" target="_top" >Squid - Development</a></p>tag:old.nabble.com,2006:post-26661923can't compile 3.1.0.152009-12-05T19:24:04Z2009-12-05T19:24:04ZLandy LandyI'm trying to upgrade from 3.1.0.14 to 3.1.0.15 but I'm getting an error when compiling:
<br><br>c MessageRep.cc -fPIC -DPIC -o .libs/MessageRep.o
<br>cc1plus: warnings being treated as errors
<br>MessageRep.cc: In member function âlibecap::Name Adaptation::Ecap::FirstLineRep::protocol() constâ:
<br>MessageRep.cc:120: warning: enumeration value âPROTO_ICYâ not handled in switch
<br>make[4]: *** [MessageRep.lo] Error 1
<br>make[4]: Leaving directory `/workingdir/squid-3.1.0.15/src/adaptation/ecap'
<br>make[3]: *** [all-recursive] Error 1
<br>make[3]: Leaving directory `/workingdir/squid-3.1.0.15/src/adaptation'
<br>make[2]: *** [all-recursive] Error 1
<br>make[2]: Leaving directory `/workingdir/squid-3.1.0.15/src'
<br>make[1]: *** [all] Error 2
<br>make[1]: Leaving directory `/workingdir/squid-3.1.0.15/src'
<br>make: *** [all-recursive] Error 1
<br><br><br>These are the options I'm using:
<br>./configure --prefix=/usr/local/squid \
<br>--sysconfdir=/etc/squid3.1 \
<br>--enable-delay-pools \
<br>--enable-kill-parent-hack \
<br>--disable-htcp \
<br>--enable-default-err-language=Spanish \
<br>--enable-linux-netfilter \
<br>--disable-ident-lookups \
<br>--localstatedir=/var/log/squid3.1 \
<br>--enable-stacktraces \
<br>--with-default-user=proxy \
<br>--with-large-files \
<br>--enable-icap-client \
<br>--enable-ecap \
<br>--enable-async-io \
<br>--enable-storeio="aufs" \
<br>--enable-removal-policies="heap,lru" \
<br>--with-maxfd=16384
<br><br><br>These options worked with 3.1.0.14 don't know why is not compiling 3.1.0.15.
<br><br><br><br><br><br><br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26661843Re: Squid at 100% CPU with 10 minutes period2009-12-05T19:06:01Z2009-12-05T19:06:01ZGuy BashkanskyAmos, thanks for the links. I've looked at the mailing list and the
<br>open bugs, and could not find something similar to what I see, with
<br>the 10 minutes period.
<br><br>We're using a customized version of Squid 2.4 STABLE6, and it's not in
<br>my power to upgrade it to any later version... It runs on FreeBSD
<br>6.2-RELEASE-p9 amd64 servers.
<br><br>I know I need some profiling/debugging information to determine where
<br>CPU spends its cycles, but on these servers most usual tools are
<br>either absent or not working very well:
<br>There's no 'oprofile' for FreeBSD, 'pmcstat' fails to run (no lib?),
<br>'gprof' does not give info beyond parseConfigFile() even in my custom
<br>profiling-enabled version with -N, 'gdb' does not recognize debug
<br>info, and 'strace' is not installed.
<br><br>I've found 'truss' command to be working and traced system calls made
<br>by the squid process, trying to recognize some patterns -- noticed
<br>that during CPU load spike write() sometimes returns EPIPE, 'Broken
<br>pipe'.
<br><br>Does my version (2.4 STABLE6) ring any bells?
<br><br><br>On Sat, Dec 5, 2009 at 3:33 AM, Amos Jeffries <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26661843&i=0" target="_top" rel="nofollow">squid3@...</a>> wrote:
<div class='shrinkable-quote'><br>>
<br>> Guy Bashkansky wrote:
<br>>>
<br>>> Amos,
<br>>>
<br>>> Where can I find a list of the solved "Squid uses 100% CPU" bugs? It
<br>>> would help me figure out which one I may be experiencing.
<br>>
<br>> Sorry for being gruff.
<br>>
<br>> The mailing list queries:
<br>> <a href="http://squid.markmail.org/search/?q=squid+uses+100%25+cpu" target="_top" rel="nofollow">http://squid.markmail.org/search/?q=squid+uses+100%25+cpu</a><br>>
<br>> The remaining open bugs mentioning
<br>> <a href="http://bugs.squid-cache.org/buglist.cgi?quicksearch=100%25+CPU" target="_top" rel="nofollow">http://bugs.squid-cache.org/buglist.cgi?quicksearch=100%25+CPU</a><br>>
<br>> The closed ones are hard to find as they have been re-named to say what the actual problems was.
<br>>
<br>>
<br>> Which release and version of squid is this?
<br>>
<br>>>
<br>>> When I attach gdb to the running squid process, it does not find
<br>>> debugging info, despite compiling with -g flag (maybe a gdb setup
<br>>> problem, nm does show symbols).
<br>>>
<br>>> When I try to use gprof for profiling (squid compiled with -pg),
<br>>> squid.gmon contains only the initial configuration functions
<br>>> profiling. I stop squid with -k shutdown signal so it exits normally
<br>>> (which is necessary to produce squid.gmon).
<br>>
<br>> Squid needs to be started with -N to prevent forking a child daemon that does all the actual work. The main process can then be traced.
<br>>
<br>> Amos
<br>> --
<br>> Please be using
<br>> Current Stable Squid 2.7.STABLE7 or 3.0.STABLE20
<br>> Current Beta Squid 3.1.0.15
<br></div><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>tag:old.nabble.com,2006:post-26661683squid failing every 5 minutes2009-12-05T18:29:59Z2009-12-05T18:29:59ZLandy LandyHello.
<br><br>I'm reposting about squid stoping and restarting every 5 minutes. I didn't get any more responses about it last time I posted and havent find a solution to the problem.
<br><br>Here's part of syslog:
<br><br>Dec 5 21:50:38 optimum-router squid[4769]: Squid Parent: child process 11973 exited due to signal 6 with status 0
<br>Dec 5 21:50:41 optimum-router squid[4769]: Squid Parent: child process 12061 started
<br>Dec 5 21:55:35 optimum-router squid[4769]: Squid Parent: child process 12061 exited due to signal 6 with status 0
<br>Dec 5 21:55:38 optimum-router squid[4769]: Squid Parent: child process 12183 started
<br>Dec 5 22:00:35 optimum-router squid[4769]: Squid Parent: child process 12183 exited due to signal 6 with status 0
<br>Dec 5 22:00:38 optimum-router squid[4769]: Squid Parent: child process 12252 started
<br>Dec 5 22:05:36 optimum-router squid[4769]: Squid Parent: child process 12252 exited due to signal 6 with status 0
<br>Dec 5 22:05:39 optimum-router squid[4769]: Squid Parent: child process 12313 started
<br>Dec 5 22:07:58 optimum-router squid[12391]: Squid Parent: child process 12393 started
<br>Dec 5 22:10:36 optimum-router squid[12391]: Squid Parent: child process 12393 exited due to signal 6 with status 0
<br>Dec 5 22:10:39 optimum-router squid[12391]: Squid Parent: child process 12522 started
<br>Dec 5 22:15:41 optimum-router squid[12391]: Squid Parent: child process 12522 exited due to signal 6 with status 0
<br>Dec 5 22:15:44 optimum-router squid[12391]: Squid Parent: child process 31594 started
<br>Dec 5 22:20:35 optimum-router squid[12391]: Squid Parent: child process 31594 exited due to signal 6 with status 0
<br>Dec 5 22:20:38 optimum-router squid[12391]: Squid Parent: child process 5466 started
<br><br>Dec 5 22:25:36 optimum-router squid[12391]: Squid Parent: child process 5466 exited due to signal 6 with status 0
<br>Dec 5 22:25:39 optimum-router squid[12391]: Squid Parent: child process 13301 started
<br><br><br>And here's cache.log
<br><br>2009/12/05 22:15:55| IpIntercept.cc(137) NetfilterInterception: NF getsockopt(SO_ORIGINAL_DST) failed on FD 14: (2) No such file or directory
<br>2009/12/05 22:15:55| IpIntercept.cc(137) NetfilterInterception: NF getsockopt(SO_ORIGINAL_DST) failed on FD 15: (2) No such file or directory
<br>(squid)(death+0x4b)[0x818b8cb]
<br>[0xb7fb3420]
<br>/usr/local/lib/ecap_adapter_gzip.so(_ZN7Adapter7Xaction17noteVbContentDoneEb+0x61)[0xb7aba411]
<br>(squid)(_ZN10Adaptation4Ecap10XactionRep23noteBodyProductionEndedE8RefCountI8BodyPipeE+0x61)[0x81fdd61]
<br>(squid)(_ZN12UnaryMemFunTI12BodyConsumer8RefCountI8BodyPipeEE6doDialEv+0x48)[0x80f1208]
<br>(squid)(_ZN9JobDialer4dialER9AsyncCall+0x51)[0x8199661]
<br>(squid)(_ZN10AsyncCallTI18BodyConsumerDialerE4fireEv+0x18)[0x80f1138]
<br>(squid)(_ZN9AsyncCall4makeEv+0x17b)[0x819888b]
<br>(squid)(_ZN14AsyncCallQueue8fireNextEv+0xf9)[0x819b4a9]
<br>(squid)(_ZN14AsyncCallQueue4fireEv+0x28)[0x819b5a8]
<br>(squid)(_ZN9EventLoop13dispatchCallsEv+0x13)[0x81096c3]
<br>(squid)(_ZN9EventLoop7runOnceEv+0xf6)[0x81098b6]
<br>(squid)(_ZN9EventLoop3runEv+0x28)[0x8109988]
<br>(squid)(_Z9SquidMainiPPc+0x4b5)[0x8151e75]
<br>(squid)(main+0x27)[0x81522f7]
<br>/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xc8)[0xb7cfaea8]
<br>(squid)(__gxx_personality_v0+0x155)[0x80bd081]
<br>FATAL: Received Segment Violation...dying.
<br>2009/12/05 22:20:35| storeDirWriteCleanLogs: Starting...
<br><br><br><br>
<br><p>From forum: <a href="http://old.nabble.com/Squid---Users-f22482.html" embed="fixTarget[22482]" target="_top" >Squid - Users</a></p>