On Wed, 30 Mar 2005, dwi amk wrote:
What I don't understand that is that it happens recently, I never experience like this before. If Henrik said this not DNS related at all, then I suspect it's worm or something alike.
Could be a worm. Could also be one of your users doing something slightly differently, or using a "download accelerator" or the like.
If so how to prevent something like this happening, I put in ACL all things around how to deny or even tcp_reset worm,spam or alike that i found from searching.
You can use access.log and cachemgr to try to identify what requests are causing this problem.
As I said, if the problem is due to some requests building up in Squid then you should see them logged in access.log when your restart Squid after detecting the problem, easily identifiable by
a) Log timestamp at the time Squid was shut down. b) Very long response time
Regards Henrik
