Re: [IPCop-user] bug in relase 2.1.0 or 2.1.1: causes squid high cpu usage

On Sun, 16 Feb 2014 17:10:34 +0000
Eric Oberlander <[email protected]> wrote:

> It may be part of the problem, but it's not the full story. After I changed
> 'transparent' to 'intercept' I still get errors in the sytem>proxy logs,
> and this warning when I run squid -k parse
> WARNING: HTTP requires the use of Via
> and still no actual hits on the cache...
> 
Running: squid -k parse
2014/02/16 18:25:52| Startup: Initializing Authentication Schemes ...
2014/02/16 18:25:52| Startup: Initialized Authentication Scheme 'basic'
2014/02/16 18:25:52| Startup: Initialized Authentication Scheme 'digest'
2014/02/16 18:25:52| Startup: Initialized Authentication Scheme
'negotiate' 2014/02/16 18:25:52| Startup: Initialized Authentication
Scheme 'ntlm' 2014/02/16 18:25:52| Startup: Initialized Authentication.
2014/02/16 18:25:52| Processing Configuration
File: /etc/squid/squid.conf (depth 0) 2014/02/16 18:25:52| Processing:
shutdown_lifetime 5 seconds 2014/02/16 18:25:52| Processing: icp_port 0
2014/02/16 18:25:52| Processing: http_port 192.168.2.1:8080 intercept
2014/02/16 18:25:52| Starting Authentication on port 192.168.2.1:8080
2014/02/16 18:25:52| Disabling Authentication on port 192.168.2.1:8080
(interception enabled) 2014/02/16 18:25:52| Processing:
cache_effective_user squid 2014/02/16 18:25:52| Processing:
cache_effective_group squid 2014/02/16 18:25:52| Processing: umask 022
2014/02/16 18:25:52| Processing: pid_filename /var/run/squid.pid
2014/02/16 18:25:52| Processing: cache_mem 512 MB
2014/02/16 18:25:52| Processing: cache_dir aufs /var/log/cache 61440 16
256 2014/02/16 18:25:52| Processing:
error_directory /usr/lib/squid/errors/en 2014/02/16 18:25:52|
Processing: memory_replacement_policy heap LFUDA 2014/02/16 18:25:52|
Processing: access_log stdio:/var/log/squid/access.log 2014/02/16
18:25:52| Processing: cache_log /var/log/squid/cache.log 2014/02/16
18:25:52| Processing: cache_store_log none 2014/02/16 18:25:52|
Processing: strip_query_terms off 2014/02/16 18:25:52| Processing:
log_mime_hdrs off 2014/02/16 18:25:52| Processing: logfile_rotate 0
2014/02/16 18:25:52| Processing: forwarded_for off
2014/02/16 18:25:52| Processing: via off
2014/02/16 18:25:52| Processing: acl within_timeframe time MTWHFAS
00:00-24:00 2014/02/16 18:25:52| Processing: acl localhost src
127.0.0.0/32 2014/02/16 18:25:52| Processing: acl SSL_ports port 443 #
https 2014/02/16 18:25:52| Processing: acl SSL_ports port 8443 #
alternative https 2014/02/16 18:25:52| Processing: acl Safe_ports port
80 # http 2014/02/16 18:25:52| Processing: acl Safe_ports port 21 # ftp
2014/02/16 18:25:52| Processing: acl Safe_ports port 443 # https
2014/02/16 18:25:52| Processing: acl Safe_ports port 1025-65535 #
unprivileged ports 2014/02/16 18:25:52| Processing: acl Safe_ports port
8080 # Squids port (for icons) 2014/02/16 18:25:52| Processing: acl
IPCop_http  port 81 2014/02/16 18:25:52| Processing: acl IPCop_https
port 8445 2014/02/16 18:25:52| Processing: acl IPCop_ips
dst 192.168.2.1 2014/02/16 18:25:52| Processing: acl
IPCop_networks         src "/var/ipcop/proxy/acls/src_networks.acl"
2014/02/16 18:25:52| Processing: acl IPCop_servers          dst
"/var/ipcop/proxy/acls/src_subnets.acl" 2014/02/16 18:25:52|
Processing: acl IPCop_green_network    src 192.168.2.0/24 2014/02/16
18:25:52| Processing: acl IPCop_green_servers    dst 192.168.2.0/24
2014/02/16 18:25:52| Processing: acl CONNECT method CONNECT 2014/02/16
18:25:52| Processing: http_access allow         localhost 2014/02/16
18:25:52| Processing: http_access allow         IPCop_ips
IPCop_networks IPCop_http 2014/02/16 18:25:52| Processing: http_access
allow CONNECT IPCop_ips IPCop_networks IPCop_https 2014/02/16 18:25:52|
Processing: http_access deny          !Safe_ports 2014/02/16 18:25:52|
Processing: http_access deny  CONNECT !SSL_ports 2014/02/16 18:25:52|
Processing: http_access allow IPCop_networks within_timeframe
2014/02/16 18:25:52| Processing: http_access deny  all 2014/02/16
18:25:52| Processing: request_header_access X-Forwarded-For deny all
2014/02/16 18:25:52| Processing: request_header_access Via deny all
2014/02/16 18:25:52| Processing: httpd_suppress_version_string on
2014/02/16 18:25:52| Processing: maximum_object_size 1048576 KB
2014/02/16 18:25:52| Processing: minimum_object_size 0 KB 2014/02/16
18:25:52| Processing: request_body_max_size 0 KB 2014/02/16 18:25:52|
Processing: reply_body_max_size none all 2014/02/16 18:25:52|
Processing: visible_hostname cache.datanom.net 2014/02/16 18:25:52|
Processing: cache_mgr [email protected] 2014/02/16 18:25:52| WARNING:
HTTP requires the use of Via

Intercept seems to be accepted. However, it looks like a parameter is
missing (Via) maybe that is why we see no hit in the cache.

So therefore making these changes at squid works again:
#http_port <green_ip>:8080 transparent
http_port <green_ip>:8080 intercept
#via off
via on

-- 
Hilsen/Regards
Michael Rasmussen

Get my public GnuPG keys:
michael <at> rasmussen <dot> cc
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xD3C9A00E
mir <at> datanom <dot> net
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE501F51C
mir <at> miras <dot> org
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE3E80917
--------------------------------------------------------------
/usr/games/fortune -es says:
Read terms and conditions.

------------------------------------------------------------------------------
Android apps run on BlackBerry 10
Introducing the new BlackBerry 10.2.1 Runtime for Android apps.
Now with support for Jelly Bean, Bluetooth, Mapview and more.
Get your Android app in front of a whole new audience.  Start now.
http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk

_______________________________________________
IPCop-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ipcop-devel

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iEYEARECAAYFAlMA9wEACgkQVErYVePoCRdGzQCgj+Y4KtFIy3PFSdAm2JYiW/ZL
hukAoJ+96l525/FKPbbBq+thiTgE0B3+
=0F9F
-----END PGP SIGNATURE-----