Squid on the blink.

[Bryan Sant]

On 12/28/05, Gabriel Gunderson <gabe at gundy.org> wrote:
> Esteemed Linux hackers,
>
> I've been using squid with good results at a site for about 6 months.
> Then, all of the sudden, things have gotten real flaky.  I've checked
> everything I can think of but the problem persists.  I've rewritten the
> rules (or added a rule) to simplify trouble shooting.  Basically, if you
> are in the local subnet you *should* be good to visit anything on the
> web using the cache.
>
> Here is what happens...
> We have about 30 users at any given time.  The typical user is Window XP
> Pro with IE.  Any one of them (it appears random) may get a time where
> squid stops working for them.  We go visit the computer they are working
> at and before we can really do anything squid starts responding again.
> The logs show nothing interesting.  The access log in particular shows
> no attempt to access anything (no HITs or MISSes etc.) for that user.
> It *seems* (and I can only say seems) to happen more frequently when
> opening a new browser.  That caused me to wonder about ntlm, samba, and
> auth in general but even after shorting out those things the problem
> remains.

How often does this happen?  Often enough that you could realistically
dump things with tcpdump or ethreal and analyze what's really
happening?  Could a user run firefox for a day or two and see if the
problem is IE specific?  Firefox has a plugin called "Live HTTP
Headers" (search for it on google) that will show you all HTTP
requests and responses -- this may be less messy than a full traffic
dump; I belive IE has something similar.

If iptables or something else is getting in the way, the dumps should
show you this.

-Bryan