Squid on the blink.
bryan.sant at gmail.com
Thu Dec 29 11:18:58 MST 2005
On 12/28/05, Gabriel Gunderson <gabe at gundy.org> wrote:
> Esteemed Linux hackers,
> I've been using squid with good results at a site for about 6 months.
> Then, all of the sudden, things have gotten real flaky. I've checked
> everything I can think of but the problem persists. I've rewritten the
> rules (or added a rule) to simplify trouble shooting. Basically, if you
> are in the local subnet you *should* be good to visit anything on the
> web using the cache.
> Here is what happens...
> We have about 30 users at any given time. The typical user is Window XP
> Pro with IE. Any one of them (it appears random) may get a time where
> squid stops working for them. We go visit the computer they are working
> at and before we can really do anything squid starts responding again.
> The logs show nothing interesting. The access log in particular shows
> no attempt to access anything (no HITs or MISSes etc.) for that user.
> It *seems* (and I can only say seems) to happen more frequently when
> opening a new browser. That caused me to wonder about ntlm, samba, and
> auth in general but even after shorting out those things the problem
How often does this happen? Often enough that you could realistically
dump things with tcpdump or ethreal and analyze what's really
happening? Could a user run firefox for a day or two and see if the
problem is IE specific? Firefox has a plugin called "Live HTTP
Headers" (search for it on google) that will show you all HTTP
requests and responses -- this may be less messy than a full traffic
dump; I belive IE has something similar.
If iptables or something else is getting in the way, the dumps should
show you this.
More information about the PLUG