On 5/12/2012 10:54 p.m., Le Trung, Kien wrote:
> And finally, my squid-configure
>
> #
> # Recommended minimum configuration:
> #
> acl localhost src A.B.C.D/32
> acl purgehost src A.B.C.D/32
> acl to_localhost dst A.B.C.D/32
NP: 127.0.0.1 is not confidential information. Every machine on the
planet has one. If you are defining A.B.C.D to be something other than
127.0.0.1 then adding it to the "to_localhost" ACL is incorrect for what
the to_localhost ACL means - it is there to prevent client requests
looping via the 127.0.0.1 and 0.0.0.0 special "localhost" addresses.
BTW, you are not using to_localhost anyway.
>
> # Example rule allowing access from your local networks.
> # Adapt to list your (internal) IP networks from where browsing
> # should be allowed
> acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
> acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
> acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
> acl localnet src fc00::/7 # RFC 4193 local private network range
> acl localnet src fe80::/10 # RFC 4291 link-local (directly
> plugged) machines
>
> acl Safe_ports port 80 # http
> acl Safe_ports port 81 # http
> acl Safe_ports port 82 # http
You list three ports here. But I only see one http_port line for port 82.
> acl CONNECT method CONNECT
> acl purge method PURGE
>
> acl invalid_urls url_regex ^someregrex
>
> acl valid_urls url_regex ^someregrex
>
> #
> # Recommended minimum Access Permission configuration:
> #
> # Only allow cachemgr access from localhost
> #acl Redirection http_status 302
> #cache allow Redirection
>
> acl RedirectTC url_regex ^needredirect
> http_access deny RedirectTC
> deny_info ERR_REDIRECT_TC RedirectTC
>
> client_persistent_connections on
> connect_timeout 5 seconds
> detect_broken_pconn on
> accept_filter httpready
> accept_filter data
> negative_ttl 120 seconds
> follow_x_forwarded_for allow localhost
>
> http_access allow manager localhost
> http_access allow purge purgehost
> http_access allow purge localhost
You defined purgehost as being one of the entries of localhost. You can
remove the "allow purge purgehost" line entirely.
> http_access deny manager
> http_access deny purge
>
> # Deny requests to certain unsafe ports
> http_access deny !Safe_ports
> http_access deny invalid_urls
> deny_info ERR_INVALID_URLS invalid_urls
> http_access allow valid_urls
Certain requests have unlimited access, depending on a regex pattern
which you have removed. Unless they have matched either of two other
removed regex patterns. These would seem to be rather important details.
> # Deny CONNECT to other than secure SSL ports
> #http_access deny CONNECT !SSL_ports
> http_access deny all
> deny_info ERR_INVALID_URLS all
>
> # We strongly recommend the following be uncommented to protect innocent
> # web applications running on the proxy server who think the only
> # one who can access services on "localhost" is a local user
> #http_access deny to_localhost
>
> #
> # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
> #
>
> # Squid normally listens to port 3128
>
> ### One domain
> cache_effective_user squid
> http_port A.B.C.D:82 accel vhost ignore-cc
>
> cache_peer A1.B1.C1.D1 parent 80 0 no-query originserver name=WEB1 max-conn=25
> cache_peer_domain WEB1 domain1 domain2
>
> cache_peer A2.B2.C2.D2 parent 80 0 no-query originserver name=WEB2
> max-conn=20 round-robin
> cache_peer A3.B3.C3.D3 parent 80 0 no-query originserver name=WEB3
> max-conn=20 round-robin
>
> cache_peer_domain WEB2 domain3 domain4
> cache_peer_domain WEB3 domain4 domain4
>
>
> acl web1 dstdomain domain1 domain2
> acl web2 dstdomain domain3 domain4
> acl web3 dstdomain domain4 domain4
>
> cache_peer_access WEB1 allow web1
> cache_peer_access WEB2 allow web2
> cache_peer_access WEB3 allow web3
>
> cache_peer_access web1 deny all
> cache_peer_access web2 deny all
> cache_peer_access web3 deny all
>
> # from where browsing should be allowed
> http_access allow localnet
> http_access allow localhost
You already put "http_access deny all" above these lines. So these ones
will never be reached.
> # And finally deny all other access to this proxy
> http_access deny all
>
>
> # We recommend you to use at least the following line.
> hierarchy_stoplist cgi-bin ?
hierarchy_stoplist prevents requests matching the regex from reaching
your cache_peers. I think you do not want to use it at all.
> #hierarchy_stoplist \?
> acl CacheType urlpath_regex \? \.css \.gif \.gif\? \.html \.html\?
> \.ico \.jpeg \.jpeg\? \.jpg \.jpg\? \.js \.js\? \.php \.php\? \.png
> \.png\? \.swf \.swf\? \-
> #cache allow CacheType
>
> # Uncomment and adjust the following to add a disk cache directory.
> cache_dir ufs /opt/squid/var/cache 9216 16 256
>
> # Leave coredumps in the first cache dir
> coredump_dir /opt/squid/var/cache
>
> cache_mem 9216 MB
> maximum_object_size_in_memory 1024 KB
> cache_swap_low 30
> cache_swap_high 50
You have 9GB of disk cache and 9GB of memory cache. Whenever they fill
to 4.5GB of data Squid will schedule ~2GB of data to be purged.
You can achieve the equivalent by setting these to the defaults and
changing your cache size to 5GB instead of 9GB.
> strip_query_terms off
> logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st
> "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
> #access_log none
> cache_store_log none
> access_log stdio:/opt/squid/var/logs/access.log combined
> cache_log /opt/squid/var/logs/cache.log
> #cache_swap_log /var/log/squid/swap.state
> #maximum_object_size 10 MB
> #quick_abort_min 0 KB
> #quick_abort_max 0 KB
> #memory_replacement_policy lru
> #cache_replacement_policy heap LFUDA
> #store_dir_select_algorithm round-robin
> #cache_dir null /tmp
>
> # Add any of your own refresh_pattern entries above these.
> #refresh_pattern ^ftp: 1440 20% 10080
> #refresh_pattern ^gopher: 1440 0% 1440
> refresh_pattern -i (^someregrex) ...
> refresh_pattern -i (/cgi-bin/) 0 0% 0
> refresh_pattern . 0 20% 4320
>
>
> On Wed, Dec 5, 2012 at 3:52 PM, Eliezer Croitoru <eliezer_at_ngtech.co.il> wrote:
>> Hey Trung Kien,
>>
>> We will need more data to try helping you with the problem.
>> If you can share the configure options of squid build and squid.conf it will
>> give us a good look on why it may could be happening.
>>
>> If you can describe more about you infrastructure it will help.
>>
>> Note that this is a public list so remove any identifying and confidential
>> data from squid.conf.
>>
>> Best Regards,
>> Eliezer
>>
>>
>>
>> On 12/5/2012 9:59 AM, Le Trung, Kien wrote:
>>> Hi,
>>>
>>> Today, I built version 3.1.22, then started squid with or without
>>> accept_filter directive in squid's configuration file and in both case
>>> I got NO 500 MISS in the access log.
>>>
>>> Moreover, the speed when access new links faster (not cached) than
>>> version 3.2.3.
>>>
>>>
>>> Best Regards,
>>> Trung Kien
>>
>> --
>> Eliezer Croitoru
>> https://www1.ngtech.co.il
>> sip:ngtech_at_sip2sip.info
>> IT consulting for Nonprofit organizations
>> eliezer <at> ngtech.co.il
>
>
Received on Wed Dec 05 2012 - 10:52:28 MST
This archive was generated by hypermail 2.2.0 : Wed Dec 05 2012 - 12:00:03 MST