On Monday 29 August 2005 23:46, John R. Van Lanen, Network Operations - TCCSA wrote: > Start debug level 1 in squid.conf, The problem about strace, is squid will > start another process, that new process it the one that it can't find and then > dies. This happens in milli seconds. No time to enter the command or know > which process will it be. Squid from what I see always starts two processes, a > main and another. The other is the one it can't find therefore making squid > die. > > Example > squid dead but pid file exists > squid: ERROR Could not send signal 0 to process 5530: (3) No such > process, man strace (you need -f option). > This process was generated seconds before it attempts to send signal 0 to the > process. > > Could not possiblely do a trace before it happens. > > Sorry if this is confusing but it's confusing me. I know other people run squid > with more users than I do on more limited machines. > > > The squid cache has reached it size limit and is being rebuilt to > > compensate... Interesting. My squid runs for months without restarts. My squid.conf (see attached) has: cache_dir ufs /var/cache/squid-2 512 32 32 for 0.5 Gb cache size. > > You could load squid in debug mode. There are a few debug mode options > > available for you... > > Just use squid -? to get a list of options. -- vda
#Access control list definitions #Examples: #acl myexample dst_as 1241 #acl password proxy_auth REQUIRED #acl fileupload req_mime_type -i ^multipart/form-data$ #acl javascript rep_mime_type -i ^application/x-javascript$ # acl all src 0.0.0.0/0 acl intranet src 172.16.0.0/12 acl intranet src 195.66.192.167 acl intranet src 195.66.192.168 acl intranet src 195.66.192.169 acl intranet src 195.66.192.170 acl intranet src 195.66.192.171 acl intranet src 1.0.0.0/8 acl localhost src 127.0.0.1/32 acl to_intranet dst 172.16.0.0/12 acl to_intranet dst 1.0.0.0/8 acl to_localhost dst 127.0.0.1/32 acl manager proto cache_object acl SSL_ports port 443 563 #acl Safe_ports port 80 # http #acl Safe_ports port 21 # ftp #acl Safe_ports port 443 563 # https, snews #acl Safe_ports port 70 # gopher #acl Safe_ports port 210 # wais #acl Safe_ports port 1025-65535 # unregistered ports #acl Safe_ports port 280 # http-mgmt #acl Safe_ports port 488 # gss-http #acl Safe_ports port 591 # filemaker #acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT acl query urlpath_regex cgi-bin \? # Keep this file in sync across all peers # Do NOT ban these acl no_ads_regex url_regex -i http://top\.list\.ru/counter\?id=607643;t=211 acl no_ads_regex url_regex -i /banner\.html*$ # TODO: why is this blocked acl no_ads_regex url_regex -i ^http://welcome\.hp\.com:*[0123456789]*/ # Ban these acl ads_regex url_regex -i [./]banners*[./?] acl ads_regex url_regex -i [./]bannerserver[./?] acl ads_regex url_regex -i [./]bannerbank[./?] acl ads_regex url_regex -i [./]bannerfarm[./?] acl ads_regex url_regex -i \.linkexchange\.ru:*[0123456789]*/ acl ads_regex url_regex -i [./]adv[./?] acl ads_regex url_regex -i /count.*\? #counter# acl ads_regex url_regex -i /cnt\.cgi\? #counter# acl ads_regex url_regex -i /ping.*\? #ping# acl ads_regex url_regex -i /ad/adframe\.php\? acl ads_regex url_regex -i [./]adserver acl ads_regex url_regex -i /phpAdsNew.*/ad.*\.php\? acl ads_regex url_regex -i /adsystem.*/ad.*\.php\? acl ads_regex url_regex -i /adjs\.php\? acl ads_regex url_regex -i /adlog\.php\? acl ads_regex url_regex -i /ADSAdClient[0123456789]*\.dll\? acl ads_regex url_regex -i ads/adstream_lx\.cgi/ acl ads_regex url_regex -i ^http://ar\.atwola\.com:*[0123456789]*/ acl ads_regex url_regex -i ^http://ads*[0123456789]*\. #http_ad# acl ads_regex url_regex -i ^http://bs\.yandex\.ru:*[0123456789]*/count/ acl ads_regex url_regex -i ^http://c\.bigmir\.net:*[0123456789]*/\? #counter#acl ads_regex url_regex -i ^http://counter\.rambler\.ru:*[0123456789]*/top100\.cnt\? acl ads_regex url_regex -i ^http://images\.rambler\.ru:*[0123456789]*/upl/partners/.*gif acl ads_regex url_regex -i ^http://images\.rambler\.ru:*[0123456789]*/upl/clients/.*gif #counter#acl ads_regex url_regex -i ^http://top\.list\.ru:*[0123456789]*/counter\? acl ads_regex url_regex -i ^http://u[0123456789\.]*\.spylog\.com:*[0123456789]*/cnt\? #counter#acl ads_regex url_regex -i ^http://www\.ilk[0123456789]*\.com:*[0123456789]*/counter/count[0123456789]*\.php\? acl ads_regex url_regex -i ^http://engine\.awaps\.net:*[0123456789]*/[0123456789/.]*gif.* acl ads_regex url_regex -i ^http://bbn\.img\.com\.ua:*[0123456789]*/[0123456789/.]*\.gif acl ads_regex url_regex -i ^http://bbn\.img\.com\.ua:*[0123456789]*/[0123456789/.]*\.jpe*g acl ads_regex url_regex -i ^http://bbn\.img\.com\.ua:*[0123456789]*/[0123456789/.]*\.swf acl ads_regex url_regex -i ^http://web\.icq\.com:*[0123456789]*/client/ate/ad-handler/ acl ads_regex url_regex -i ^http://.*\.abn\.com\.ua:*[0123456789]*/iframe\? acl ads_regex url_regex -i ^http://62.118.249.36:*[0123456789]*/images/[0123456789/]*\.gif acl ads_regex url_regex -i ^http://www\.ad\.tomshardware\.com:*[0123456789]*/cgi-bin/bd\.m\? #http_ad#acl ads_regex url_regex -i ^http://ad\.doubleclick\.net:*[0123456789]*/ad./ acl ads_regex url_regex -i ^http://pagead2\.googlesyndication\.com:*[0123456789]*/pagead/ads\? acl ads_regex url_regex -i ^http://www\.yadro\.ru:*[0123456789]*/cgi-bin/show\? acl ads_regex url_regex -i ^http://counter\.yadro\.ru:*[0123456789]*/hit acl ads_regex url_regex -i ^http://servedby\.advertising\.com:*[0123456789]*/site acl ads_regex url_regex -i ^http://tbs\.susanin\.com:*[0123456789]*/cgi-bin/tbs/banneri\.cgi\? acl ads_regex url_regex -i ^http://pbnet\.ru/show:*[0123456789]*/show\.pl\? #http_ad#acl ads_regex url_regex -i ^http://ad2\.pamedia\.com:*[0123456789]*\.au/js\.ng/site #http_ad#acl ads_regex url_regex -i ^http://ad2\.pamedia\.com:*[0123456789]*\.au/html\.ng/site acl ads_regex url_regex -i ^http://cdn\.valueclick\.com:*[0123456789]*/ad\.s/ acl ads_regex url_regex -i ^http://us\.a1\.yimg\.com:*[0123456789]*/us\.yimg\.com/a/in/information_usa/.*\.gif acl ads_regex url_regex -i ^http://icqrus\.ru:*[0123456789]*/cgi/icq2k/all_bn\.cgi\? #counter#acl ads_regex url_regex -i ^http://counter\.yadro\.ru:*[0123456789]*/logo\? acl ads_regex url_regex -i ^http://cnt\.one\.ru:*[0123456789]*/cgi-bin/cnt\.cgi\? acl ads_regex url_regex -i ^http://www2.aport.ru:*[0123456789]*/scripts/popup/popup.dll acl ads_regex url_regex -i ^http://topshop-counter\.rambler\.ru:*[0123456789]*/top100\.cnt\? acl ads_regex url_regex -i ^http://[0-9a-z.]*topcto\.ru:*[0123456789]*/cgi-bin/top\.cgi\? #counter#acl ads_regex url_regex -i ^http://findme\.ru:*[0123456789]*/Counter/\? acl ads_regex url_regex -i ^http://br\.gcl\.ru:*[0123456789]*/cgi-bin/br/br[0123456789_]*\.cgi\? acl ads_regex url_regex -i ^http://195\.161\.118\.21/images/[0123456789/]*\.gif acl ads_regex url_regex -i ^http://194\.125\.249\.67:*[0123456789]*/[0123456789/]* acl ads_regex url_regex -i ^http://sle-ent.com.ua:*[0123456789]*/\? acl ads_regex url_regex -i ^http://sle-pvt.com.ua:*[0123456789]*/\? #ping#acl ads_regex url_regex -i ^http://[0-9a-z.]*topping\.od\.ua:*[0123456789]*/cgi-bin/pinger\.cgi\? acl ads_regex url_regex -i ^http://[0-9a-z.]*a-counter\.kiev\.ua:*[0123456789]*/a/ acl ads_regex url_regex -i ^http://im-tub\.yandex\.ru:*[0123456789]*/i\? acl ads_regex url_regex -i ^http://t0\.extreme-dm:*[0123456789]*\.com/0\.gif\? acl ads_regex url_regex -i ^http://www\.yandex\.ru:*[0123456789]*/cycounter\? acl ads_regex url_regex -i ^http://www\.razom\.org\.ua:*[0123456789]*/ads/img/\? acl ads_regex url_regex -i ^http://[0-9a-z.]*huyandex\.com:*[0123456789]*/c_banner\.php\? acl ads_regex url_regex -i ^http://pagead2\.googlesyndication\.com:*[0123456789]*/pagead/show_ads\.js acl ads_regex url_regex -i ^http://www\.clx\.ru:*[0123456789]*/rot\.php? acl ads_regex url_regex -i ^http://s\.clx\.ru:*[0123456789]*/rot\.php\? acl ads_regex url_regex -i ^http://s\.clx\.ru:*[0123456789]*/show\.php\? acl ads_regex url_regex -i ^http://oz\.valueclick\.com:*[0123456789]*/cycle\? acl ads_regex url_regex -i ^http://w[0123456789]*\.hitbox\.com:*[0123456789]*/Hitbox\? acl ads_regex url_regex -i ^http://b[0123456789]*\.abn\.com\.ua:*[0123456789]*/nsimg\? acl ads_regex url_regex -i ^http://www\.burstnet\.com:*[0123456789]*/cgi-bin/ads/ #counter#acl ads_regex url_regex -i ^http://top\.list\.ru:*[0123456789]*/counter\? acl ads_regex url_regex -i ^http://cbn\.com\.ua:*[0123456789]*/bn\.php\? acl ads_regex url_regex -i ^http://www\.kat\.ru:*[0123456789]*/banners_view/view\.php\? acl ads_regex url_regex -i ^http://images.e-se.ru:*[0123456789]*/.*rnd= acl ads_regex url_regex -i ^http://uaportal\.com:*[0123456789]*/r/\?/news/[0123456789] acl ads_regex url_regex -i ^http://s1.adward.ru:*[0123456789]*/\? acl ads_regex url_regex -i ^http://global\.msads\.net:*[0123456789]*/ads/ acl ads_regex url_regex -i ^http://www.*adnet\.ru:*[0123456789]*/cgi-bin/iframe/vivru acl ads_regex url_regex -i ^http://www.*business\.lbn\.ru:*[0123456789]*/cgi-bin/iframe/ acl ads_regex url_regex -i ^http://image\.linkexchange\.com:*[0123456789]*/[0123456789/]*/banner acl ads_regex url_regex -i ^http://rotabanner\.kulichki\.net:*[0123456789]*/cgi-bin/iframe/ acl ads_regex url_regex -i ^http://bx\.metka\.ru:*[0123456789]*/.*\? acl ads_regex url_regex -i ^http://aif\.yadro\.ru:*[0123456789]*/cgi-bin/show\? acl ads_regex url_regex -i ^http://btxt\.abn\.com\.ua:*[0123456789]*/jsframe\? acl ads_regex url_regex -i ^http://direct\.lbe\.ru:*[0123456789]*/cgi-bin/iframe/.*\? acl ads_regex url_regex -i ^http://sj4\.ru:*[0123456789]*/cgi-bin/iframe/.*\? acl ads_regex url_regex -i ^http://engine\.awaps\.net:*[0123456789]*/.*\? acl ads_regex url_regex -i ^http://[a-z0-9]*\.startua\.com:*[0123456789]*/.*\? acl ads_regex url_regex -i ^http://uabanner\.com:*[0123456789]*/bn\.php\? acl ads_regex url_regex -i ^http://www.*adnet\.ru:*[0123456789]*/cgi-bin/iframe/books\? acl ads_regex url_regex -i ^http://server\.iad\.liveperson\.net:*[0123456789]*/hc/ acl ads_regex url_regex -i ^http://.*\.spylog\.com:*[0123456789]*/java/stats\.phtml acl ads_regex url_regex -i ^http://.*\.adnet\.ru:*[0123456789]*/cgi-bin/iframe/ acl ads_regex url_regex -i ^http://rotabanner.*\.ru:*[0123456789]*/cgi-bin/iframe/ acl ads_regex url_regex -i ^http://baner\.ukr\.net:*[0123456789]*/adframe\.php acl ads_regex url_regex -i ^http://amch\.questionmarket\.com:*[0123456789]*/adscgen/sta\.php acl ads_regex url_regex -i ^http://mbn\.com\.ua:*[0123456789]*/cgi-bin/iframe/ acl ads_regex url_regex -i ^http://*.\.mystat-in\.net:*[0123456789]*/ acl ads_regex url_regex -i ^http://r\.mail\.ru:*[0123456789]*/[a-z0-9]*\.jpg$ acl ads_regex url_regex -i ^http://www\.mediacenter\.ru:*[0123456789]*/trans/adv200x100\.phtml\? acl ads_regex url_regex -i ^http://counter\.hotlog\.ru:*[0123456789]*/cgi-bin/hotlog/count\.js acl ads_regex url_regex -i ^http://gbs\.gator\.com:*[0123456789]*/gbs/gbs\.dll\? acl ads_regex url_regex -i ^http://www\.equestrian\.ru:*[0123456789]*/Ads/adframe\.php\? acl ads_regex url_regex -i ^http://d\.clx\.ru:*[0123456789]*/show\.php\? acl ads_regex url_regex -i ^http://bs\.yandex\.ru:*[0123456789]*/show/[0123456789]* acl ads_regex url_regex -i ^http://www\.uaportal\.com:*[0123456789]*/r/\? # To block, or not to block? acl ads_regex url_regex -i ^http://.*download\.windowsupdate\.com:*[0123456789]*/msdownload/update/ # TEST: block .avi .mp? .wmv acl ads_regex url_regex -i \.avi$ acl ads_regex url_regex -i \.mp.$ acl ads_regex url_regex -i \.wmv$ # Not sure that it is spam... #acl ads_regex url_regex -i ^http://www.rambler.ru:*[0123456789]*/knp.gif? #acl ads_regex url_regex -i ^http://kmindex.ru:*[0123456789]*/c/\? #acl ads_regex url_regex -i ^http://kmindex.ru:*[0123456789]*/p/\? #acl ads_regex url_regex -i ^http://reks.com.ua:*[0123456789]*/cgi-bin/s\? #acl ads_regex url_regex -i ^http://wwwomen.ru:*[0123456789]*/php/wi\.php\? #acl ads_regex url_regex -i ^http://top.germany.ru:*[0123456789]*/cgi-bin/links/top\.cgi\? #acl ads_regex url_regex -i ^http://bs.yandex.ru:*[0123456789]*/show/[0123456789] # DONT! This incurs reverse DNS lookup if you supplied numeric IP # (and 5 min (!!!) timeout if that IP does not have reverse DNS set up) #acl ads dstdomain 81.222.128.3 www.linkexchange.ru ad0.bigmir.net bbn.img.com.ua # Usage: port # hostname:port # 1.2.3.4:port http_port 0.0.0.0:9080 # TAG: https_port # Usage: [ip:]port cert=certificate.pem [key=key.pem] [options...] # cert= Path to SSL certificate (PEM format) # key= Path to SSL private key file (PEM format) # if not specified, the certificate file is # assumed to be a combined certificate and # key file # version= The version of SSL/TLS supported # 1 automatic (default) # 2 SSLv2 only # 3 SSLv3 only # 4 TLSv1 only # cipher= Colon separated list of supported ciphers # options= Varions SSL engine options. The most important: # NO_SSLv2 Disallow the use of SSLv2 # NO_SSLv3 Disallow the use of SSLv3 # NO_TLSv1 Disallow the use of TLSv1 # See src/ssl_support.c or OpenSSL documentation # for a more complete list. #https_port 0.0.0.0:443 cert=/var/service/squid/cert.pem key=/var/service/squid/key.pem # Some browsers (especially MSIE) bugs out on SSL shutdown # messages. # ssl_unclean_shutdown off # The port number where Squid sends and receives ICP queries to # and from neighbor caches. Default is 3130. To disable use "0" icp_port 0 # TAG: htcp_port # The port number where Squid sends and receives HTCP queries to # and from neighbor caches. Default is 4827. To disable use "0". # vda:unrecognized: htcp_port 0 # Usage: mcast_groups 239.128.16.128 224.0.1.20 # none # A udp_incoming_address value of 0.0.0.0 indicates that Squid should # listen for UDP messages on all available interfaces. # If udp_outgoing_address is set to 255.255.255.255 (the default) # then it will use the same socket as udp_incoming_address. Only # change this if you want to have ICP queries sent using another # address than where this Squid listens for ICP queries from other # caches. # NOTE, udp_incoming_address and udp_outgoing_address can not # have the same value since they both use port 3130. udp_incoming_address 0.0.0.0 udp_outgoing_address 255.255.255.255 # To specify other caches in a hierarchy, use the format: # # proxy icp # # hostname type port port options # # -------------------- -------- ----- ----- ----------- # cache_peer parent.foo.net parent 3128 3130 [proxy-only] # cache_peer sib1.foo.net sibling 3128 3130 [proxy-only] # cache_peer sib2.foo.net sibling 3128 3130 [proxy-only] # none # sourceforge-book-html/x800.html: # ================================ # default: "Go through this cache for all requests. If it's down, # return an error message to the client (cannot go direct)" # no-query: ignore the given ICP port (leaving the port number out will return # an error), and never attempt to query the cache with ICP # Go only thru TM proxies: ### cache_peer 195.66.200.114 parent 80 3130 default no-query # # SSLed proxies are there ;) #TODO: make it permanent #cache_peer 127.0.0.1 parent 5500 3130 no-query round-robin allow-miss #cache_peer 127.0.0.1 parent 5501 3130 no-query round-robin allow-miss #cache_peer 127.0.0.1 parent 5502 3130 no-query round-robin allow-miss #cache_peer 127.0.0.1 parent 5503 3130 no-query round-robin allow-miss #cache_peer 127.0.0.1 parent 5504 3130 no-query round-robin allow-miss #cache_peer 127.0.0.1 parent 5505 3130 no-query round-robin allow-miss #cache_peer 127.0.0.1 parent 5506 3130 no-query round-robin allow-miss #cache_peer 127.0.0.1 parent 5507 3130 no-query round-robin allow-miss #cache_peer 127.0.0.1 parent 5508 3130 no-query round-robin allow-miss #cache_peer 127.0.0.1 parent 5509 3130 no-query round-robin allow-miss # cache_peer_domain cache-host domain [domain ...] # cache_peer_domain cache-host !domain # none # usage: neighbor_type_domain parent|sibling domain domain ... # EXAMPLE: # cache_peer parent cache.foo.org 3128 3130 # neighbor_type_domain cache.foo.org sibling .com .net # neighbor_type_domain cache.foo.org sibling .au .de # none # Similar to 'cache_peer_domain' but provides more flexibility by # using ACL elements. # cache_peer_access cache-host allow|deny [!]aclname ... ### cache_peer_access 195.66.200.114 deny to_intranet ### cache_peer_access 195.66.200.114 allow all # commented out: NEVER go direct #hierarchy_stoplist cgi-bin ? # Query-type requests should not be cached # commented out: NEVER go direct #no_cache deny query # TAG: always_direct # Usage: always_direct allow|deny [!]aclname ... ### always_direct allow to_intranet # TAG: never_direct # Usage: never_direct allow|deny [!]aclname ... # # Force use of parent caches for everything but intranets ### never_direct deny to_intranet ### never_direct allow all # TAG: header_access # Usage: header_access header_name allow|deny [!]aclname ... # # This option replaces the old 'anonymize_headers' and the # older 'http_anonymizer' option with something that is much # more configurable. This new method creates a list of ACLs # for each header, allowing you very fine-tuned header # mangling. # # Top used headers - candidates to elimination: # 2922 User-Agent # 2916 Host # 2753 Accept-Language (?) # 2737 Connection # 2550 Referer (!) # 2381 Accept-Encoding (?) # 1652 Accept # 940 Cookie # header_access Referer deny all header_access All allow all # icp_query_timeout 0 # maximum_icp_query_timeout 2000 # mcast_icp_query_timeout 2000 # dead_peer_timeout 10 seconds ### #hierarchy_stoplist cgi-bin ? # Query-type requests should not be cached (see ACL defs for 'query') ### #no_cache deny query # 'cache_mem' specifies the ideal amount of memory to be used for: # * In-Transit objects # * Hot Objects # * Negative-Cached objects # cache_mem 8 MB # cache_swap_low 90 # cache_swap_high 95 maximum_object_size 8192 KB # minimum_object_size 0 KB # maximum_object_size_in_memory 8 KB # The size, low-, and high-water marks for the IP cache. # ipcache_size 1024 # ipcache_low 90 # ipcache_high 95 # Maximum number of FQDN cache entries. # fqdncache_size 1024 # lru : Squid's original list based LRU policy # heap GDSF : Greedy-Dual Size Frequency # heap LFUDA: Least Frequently Used with Dynamic Aging # heap LRU : LRU policy implemented using a heap # cache_replacement_policy lru # memory_replacement_policy lru # cache_dir Type Directory-Name Fs-specific-data [options] # # "ufs" is the old well-known Squid storage format # ================================================================== # cache_dir ufs Directory-Name Mbytes L1 L2 [options] # 'Mbytes' is the amount of disk space to use # 'Level-1' is the number of first-level subdirectories # 'Level-2' is the number of second-level subdirectories # vda: ... and files in each second level dir # # "aufs" uses the same storage format as "ufs", utilizing # POSIX-threads to avoid blocking the main Squid process on # disk-I/O. This was formerly known in Squid as async-io. # ================================================================== # cache_dir aufs Directory-Name Mbytes L1 L2 [options] # # "diskd" uses the same storage format as "ufs", utilizing a # separate process to avoid blocking the main Squid process on # disk-I/O. # ================================================================== # cache_dir diskd Directory-Name Mbytes L1 L2 [options] [Q1=n] [Q2=n] # Q1 - if this many messages are in the queues, Squid won't open new files # Q2 - ff this many messages are in the queues, Squid blocks until it recevies some replies # # Common options: # read-only, this cache_dir is read only. # max-size=n, refers to the max object size this storedir supports. # # vda: for 4G data I'd set 4096 64 64, # for 2G: 2048 32 64 # for 1G: 1024 64 32 # for 1/2G: 512 32 32 cache_dir ufs /var/cache/squid-2 512 32 32 #cache_dir ufs /var/cache/squid-2 1500 32 64 # Logs the client request activity. Contains an entry for # every HTTP and ICP queries received. To disable, enter "none". cache_access_log logdir/access.fifo # Cache logging file. This is where general information about # your cache's behavior goes. You can increase the amount of data # logged to this file with the "debug_options" tag below. cache_log logdir/cache.fifo # Logs the activities of the storage manager. Shows which # objects are ejected from the cache, and which objects are # saved and for how long. To disable, enter "none". cache_store_log none #logdir/store.fifo # cache_swap_log #cache_swap_log logdir/swap.fifo # emulate_httpd_log off # Log the destination IP address in the hierarchy log tag when going # direct. Earlier Squid versions logged the hostname here. log_ip_on_direct on # Pathname to Squid's MIME table. mime_table /usr/app/squid-2.5.STABLE10/var/etc/mime.conf # The Cache can record both the request and the response MIME # headers for each HTTP transaction. The headers are encoded # safely and will appear as two bracketed fields at the end of # the access log log_mime_hdrs off # useragent_log # vda:unrecognized: useragent_log ... # referer_log # vda:unrecognized: referer_log ... # pid_filename pid_filename /var/log/service/squid/squid.pid # 22:refresh.c debug_options ALL,2 22,2 33,2 log_fqdn off # A netmask for client addresses in logfiles and cachemgr output. # A netmask of 255.255.255.0 will log all IP's in that range with # the last digit set to '0'. # client_netmask 255.255.255.255 # ftp_user anon@ # ftp_list_width 32 # ftp_passive on # ftp_sanitycheck on # This option is only available if Squid is rebuilt with the # --disable-internal-dns option # Specify the location of the executable for dnslookup process. # cache_dns_program /usr/app/squid-2.5.STABLE10/libexec/dnsserver # dns_children 5 # dns_retransmit_interval 5 seconds # dns_timeout 5 minutes # dns_defnames off # dns_nameservers # none # hosts_file /etc/hosts # diskd_program /usr/app/squid-2.5.STABLE10/libexec/diskd # unlinkd_program /usr/app/squid-2.5.STABLE10/libexec/unlinkd # This option is only available if Squid is rebuilt with the # --enable-icmp option # pinger_program /usr/app/squid-2.5.STABLE10/libexec/pinger # redirect_program # none # redirect_children 5 # By default Squid rewrites any Host: header in redirected # requests. If you are running an accelerator then this may # not be a wanted effect of a redirector. # redirect_rewrites_host_header on # redirector_access # none # TAG: auth_param # This is used to pass parameters to the various authentication # schemes. # format: auth_param scheme parameter [setting] # # auth_param basic program /usr/app/squid-2.5.STABLE10/bin/ncsa_auth /etc/passwd # would tell the basic authentication scheme it's program parameter. # # === Parameters for the basic scheme follow. === # "program" cmdline # Specify the command for the external authenticator. Such a # program reads a line containing "username password" and replies # "OK" or "ERR" in an endless loop. If you use an authenticator, # make sure you have 1 acl of type proxy_auth. # # "children" numberofchildren # The number of authenticator processes to spawn (no default). # auth_param basic children 5 # # "realm" realmstring # Specifies the realm name which is to be reported to the # client for the basic proxy authentication scheme (part of # the text the user will see when prompted their username and # password). # auth_param basic realm Squid proxy-caching web server # # "credentialsttl" timetolive # Specifies how long squid assumes an externally validated # username:password pair is valid for # # === Parameters for the digest scheme follow === # "program" cmdline # "children" numberofchildren # "realm" realmstring # "nonce_garbage_interval" timeinterval # Specifies the interval that nonces that have been issued # to client_agent's are checked for validity. # "nonce_max_duration" timeinterval # Specifies the maximum length of time a given nonce will be # valid for. # "nonce_max_count" number # Specifies the maximum number of times a given nonce can be # used. # "nonce_strictness" on|off # Determines if squid requires increment-by-1 behaviour for # nonce counts (on - the default), or strictly incrementing # (off - for use when useragents generate nonce counts that # occasionally miss 1 (ie, 1,2,4,6)). # # === NTLM scheme options follow === # "program" cmdline # auth_param ntlm program /usr/app/squid-2.5.STABLE10/bin/ntlm_auth # "children" numberofchildren # "max_challenge_reuses" number # The maximum number of times a challenge given by a ntlm # authentication helper can be reused. # 0 means use the challenge only once. # "max_challenge_lifetime" timespan # The maximum time period that a ntlm challenge is reused over. # auth_param ntlm max_challenge_lifetime 2 minutes #Recommended minimum configuration: #auth_param digest program <uncomment and complete this line> #auth_param digest children 5 #auth_param digest realm Squid proxy-caching web server #auth_param digest nonce_garbage_interval 5 minutes #auth_param digest nonce_max_duration 30 minutes #auth_param digest nonce_max_count 50 #auth_param ntlm program <uncomment and complete this line to activate> #auth_param ntlm children 5 #auth_param ntlm max_challenge_reuses 0 #auth_param ntlm max_challenge_lifetime 2 minutes #auth_param basic program <uncomment and complete this line> auth_param basic children 5 auth_param basic realm Squid proxy-caching web server auth_param basic credentialsttl 2 hours # authenticate_cache_garbage_interval 1 hour # authenticate_ttl 1 hour # authenticate_ip_ttl 0 seconds # external_acl_type # none # wais_relay_host # wais_relay_port # wais_relay_port 0 # request_header_max_size 10 KB # request_body_max_size 0 KB # refresh_pattern # NB: refresh calcs fail horribly if your system time is not ok ;) # min/max in in minutes # regex min percent max [options] # # FTP: min fresh time 1 day, max 10 days refresh_pattern ^ftp: 2880 50% 28800 # GOPHER: min fresh time 1 day, max 1 day refresh_pattern ^gopher: 2880 0% 2880 # Images/video refresh_pattern -i [.]jpg$ 2880 50% 2880000 override-lastmod ignore-reload refresh_pattern -i [.]jpeg$ 2880 50% 2880000 override-lastmod ignore-reload refresh_pattern -i [.]gif$ 2880 50% 2880000 override-lastmod ignore-reload refresh_pattern -i [.]png$ 2880 50% 2880000 override-lastmod ignore-reload refresh_pattern -i [.]swf$ 2880 50% 2880000 override-lastmod ignore-reload refresh_pattern -i [.]mp[g123]$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]mpeg$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]avi$ 2880 50% 2880000 override-lastmod reload-into-ims # Data refresh_pattern -i [.]gz$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]tgz$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]bz$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]bz2$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]zip$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]arj$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]rar$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]dat$ 2880 50% 2880000 override-lastmod reload-into-ims # Probably generated content refresh_pattern -i [.]php$ 0 20% 28800 refresh_pattern -i [?] 0 20% 28800 refresh_pattern -i cgi 0 20% 28800 # Probably plain HTML (first one is for http://host.com/dir/dir/ type URLs) refresh_pattern -i /$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]htm$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]html$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]xml$ 2880 50% 2880000 override-lastmod reload-into-ims refresh_pattern -i [.]css$ 2880 50% 2880000 override-lastmod ignore-reload refresh_pattern -i [.]js$ 2880 50% 2880000 override-lastmod ignore-reload # All other refresh_pattern . 0 50% 28800 # If you want retrievals to always continue if they are being # cached then set 'quick_abort_min' to '-1 KB'. quick_abort_min 0 KB quick_abort_max 0 KB quick_abort_pct 90 # negative_ttl 5 minutes # positive_dns_ttl 6 hours # negative_dns_ttl 5 minutes # This is to stop a far ahead range request (lets say start at 17MB) # from making Squid fetch the whole object up to that point before # sending anything to the client. # range_offset_limit 0 KB # connect_timeout 2 minutes # peer_connect_timeout 30 seconds # read_timeout 15 minutes # request_timeout 5 minutes # persistent_request_timeout 1 minute # client_lifetime 1 day # half_closed_clients on # pconn_timeout 120 seconds # ident_timeout 10 seconds # shutdown_lifetime 30 seconds #Recommended minimum configuration: # Only allow cachemgr access from localhost http_access allow manager localhost http_access deny manager # # Deny requests to unknown ports # http_access deny !Safe_ports # Deny CONNECT to other than SSL ports http_access deny CONNECT !SSL_ports http_access deny CONNECT to_localhost # http_access allow no_ads_regex http_access deny ads_regex http_access allow intranet http_access allow localhost http_access deny all http_reply_access allow all icp_access allow all # Use to force your neighbors to use you as a sibling instead of # a parent. For example: # acl localclients src 172.16.0.0/16 # miss_access allow localclients # miss_access deny !localclients # miss_access allow all # Similar to 'cache_peer_domain' but provides more flexibility by # using ACL elements. # cache_peer_access cache-host allow|deny [!]aclname ... # none ident_lookup_access deny all # tcp_outgoing_tos # none # tcp_outgoing_address # none # reply_body_max_size 0 allow all # Email-address of local cache manager who will receive # mail if the cache dies. The default is "webmaster." # cache_mgr webmaster visible_hostname 127.0.0.1 # cache_effective_user # cache_effective_group cache_effective_user squid cache_effective_group daemon # unique_hostname # none # hostname_aliases # none # announce_period 0 # announce_host # announce_file # announce_port # announce_host tracker.ircache.net # announce_port 3131 # TAG: httpd_accel_host # TAG: httpd_accel_port # If you want to run Squid as an httpd accelerator, define the # host name and port number where the real HTTP server is. # If you want IP based virtual host support then specify the # hostname as "virtual". This will make Squid use the IP address # where it accepted the request as hostname in the URL. # If you want virtual port support then specify the port as "0". # NOTE: enabling httpd_accel_host disables proxy-caching and # ICP. If you want these features enabled also, then set # the 'httpd_accel_with_proxy' option. # #Default: httpd_accel_host virtual httpd_accel_port 0 #debug_options ALL,1 33,6 # TAG: httpd_accel_single_host on|off # If you are running Squid as an accelerator and have a single backend # server then set this to on. This causes Squid to forward the request # to this server irregardles of what any redirectors or Host headers # says. # httpd_accel_single_host off # TAG: httpd_accel_with_proxy on|off # If you want to use Squid as both a local httpd accelerator # and as a proxy, change this to 'on'. Note however that your # proxy users may have trouble to reach the accelerated domains # unless their browsers are configured not to use this proxy for # those domains httpd_accel_with_proxy on # TAG: httpd_accel_uses_host_header on|off # HTTP/1.1 requests include a Host: header which is basically the # hostname from the URL. The Host: header is used for domain based # virutal hosts. If your accelerator needs to provide domain based # virtual hosts on the same IP address then you will need to turn this # on. httpd_accel_uses_host_header on dns_testnames localhost # logfile_rotate 10 #Example: # append_domain .yourdomain.com #Default: # none # tcp_recv_bufsize 0 bytes # TAG: err_html_text # none # TAG: deny_info # none # TAG: memory_pools on|off memory_pools off # TAG: memory_pools_limit (bytes) # none # TAG: forwarded_for on|off forwarded_for off # TAG: log_icp_queries on|off # log_icp_queries on # TAG: icp_hit_stale on|off # icp_hit_stale off # TAG: minimum_direct_hops # minimum_direct_hops 4 # TAG: minimum_direct_rtt # minimum_direct_rtt 400 # TAG: cachemgr_passwd # cachemgr_passwd disable all # TAG: store_avg_object_size (kbytes) # store_avg_object_size 13 KB # TAG: store_objects_per_bucket # store_objects_per_bucket 20 # TAG: client_db on|off # client_db off # TAG: netdb_low # TAG: netdb_high # The low and high water marks for the ICMP measurement # database. These are counts, not percents # netdb_low 900 # netdb_high 1000 # TAG: netdb_ping_period # netdb_ping_period 5 minutes # TAG: query_icmp on|off # query_icmp off # TAG: test_reachability on|off # test_reachability off # TAG: buffered_logs on|off # buffered_logs off # TAG: reload_into_ims on|off # When you enable this option, client no-cache or reload # requests will be changed to If-Modified-Since requests. # Doing this VIOLATES the HTTP standard. Enabling this # feature could make you liable for problems which it # causes. # reload_into_ims off # TAG: header_access # Usage: header_access header_name allow|deny [!]aclname ... # For example, to achieve the same behaviour as the old # 'http_anonymizer standard' option, you should use: header_access From deny all header_access Via deny all header_access X-Forwarded-For deny all # TAG: header_replace # Usage: header_replace header_name message # Example: header_replace User-Agent Nutscrape/1.0 (CP/M; 8-bit) # none # TAG: icon_directory # icon_directory /usr/app/squid-2.5.STABLE10/share/icons # TAG: error_directory # error_directory /usr/app/squid-2.5.STABLE10/share/errors/English # TAG: minimum_retry_timeout (seconds) # minimum_retry_timeout 5 seconds # TAG: maximum_single_addr_tries # maximum_single_addr_tries 3 # TAG: snmp_port # By default it listens to port 3401 on the machine. If you don't # wish to use SNMP, set this to "0". # vda:unrecognized: snmp_port 0 # TAG: snmp_access # snmp_access allow|deny [!]aclname ... # vda:unrecognized: snmp_access deny all # TAG: snmp_incoming_address # TAG: snmp_outgoing_address # snmp_incoming_address 0.0.0.0 # snmp_outgoing_address 255.255.255.255 # TAG: as_whois_server # WHOIS server to query for AS numbers. NOTE: AS numbers are # queried only when Squid starts up, not for every request. # as_whois_server whois.ra.net # as_whois_server whois.ra.net # TAG: wccp_router # Use this option to define your WCCP home router for # Squid. Setting the 'wccp_router' to 0.0.0.0 (the default) # disables WCCP. # wccp_router 0.0.0.0 # TAG: wccp_version # According to some users, Cisco IOS 11.2 only supports WCCP # version 3. If you're using that version of IOS, change # this value to 3. # wccp_version 4 # TAG: wccp_incoming_address # TAG: wccp_outgoing_address # wccp_incoming_address 0.0.0.0 # wccp_outgoing_address 255.255.255.255 # TAG: delay_pools # delay_pools 0 # TAG: delay_class # delay_pools 2 # 2 delay pools # delay_class 1 2 # pool 1 is a class 2 pool # delay_class 2 3 # pool 2 is a class 3 pool # TAG: delay_access # none # TAG: delay_parameters # delay_parameters pool aggregate # delay_parameters pool aggregate individual # delay_parameters pool aggregate network individual #delay_parameters 1 -1/-1 8000/8000 #delay_parameters 2 32000/32000 8000/8000 600/64000 # TAG: delay_initial_bucket_level (percent, 0-100) # delay_initial_bucket_level 50 # TAG: incoming_icp_average # TAG: incoming_http_average # TAG: incoming_dns_average # TAG: min_icp_poll_cnt # TAG: min_dns_poll_cnt # TAG: min_http_poll_cnt # Heavy voodoo here. I can't even believe you are reading this. # Are you crazy? Don't even think about adjusting these unless # you understand the algorithms in comm_select.c first! # incoming_icp_average 6 # incoming_http_average 4 # incoming_dns_average 4 # min_icp_poll_cnt 8 # min_dns_poll_cnt 8 # min_http_poll_cnt 8 # TAG: max_open_disk_fds # max_open_disk_fds 0 # TAG: offline_mode # Enable this option and Squid will never try to validate cached # objects. # offline_mode off # TAG: uri_whitespace # uri_whitespace strip # TAG: broken_posts # acl buggy_server url_regex ^http://.... # broken_posts allow buggy_server # TAG: mcast_miss_addr # mcast_miss_addr 255.255.255.255 # TAG: mcast_miss_ttl # mcast_miss_ttl 16 # TAG: mcast_miss_port # mcast_miss_port 3135 # TAG: mcast_miss_encode_key # mcast_miss_encode_key XXXXXXXXXXXXXXXX # TAG: nonhierarchical_direct # nonhierarchical_direct on # TAG: prefer_direct # prefer_direct off # TAG: strip_query_terms # strip_query_terms on # TAG: coredump_dir # Leave coredumps in the first cache dir coredump_dir /var/cache/squid-2 # TAG: redirector_bypass # redirector_bypass off # TAG: ignore_unknown_nameservers # ignore_unknown_nameservers on # TAG: digest_generation # digest_generation on # TAG: digest_bits_per_entry # digest_bits_per_entry 5 # TAG: digest_rebuild_period (seconds) # digest_rebuild_period 1 hour # TAG: digest_rewrite_period (seconds) # digest_rewrite_period 1 hour # TAG: digest_swapout_chunk_size (bytes) # digest_swapout_chunk_size 4096 bytes # TAG: digest_rebuild_chunk_percentage (percent, 0-100) # digest_rebuild_chunk_percentage 10 # TAG: chroot # none # TAG: client_persistent_connections # TAG: server_persistent_connections # client_persistent_connections on # server_persistent_connections on # TAG: pipeline_prefetch # pipeline_prefetch off # TAG: extension_methods # none # TAG: request_entities # request_entities off # TAG: high_response_time_warning (msec) # high_response_time_warning 0 # TAG: high_page_fault_warning # high_page_fault_warning 0 # TAG: high_memory_warning # high_memory_warning 0 # TAG: store_dir_select_algorithm # store_dir_select_algorithm least-load # TAG: forward_log # none # TAG: ie_refresh on|off # ie_refresh off # TAG: vary_ignore_expire on|off # vary_ignore_expire off # TAG: sleep_after_fork (microseconds) # sleep_after_fork 0 # What to log #debug_options ALL,1 22,3 #22,3: log refresh decisions #debug_options ALL,1 33,3 #33,3: hit/miss decision, headers
![http://bbn\.img\.com\.ua:*[0123456789]*/[0123456789/.]*\.gif](http://bbn\.img\.com\.ua:*[0123456789]*/[0123456789/.]*\.gif){kind=link}
![http://62.118.249.36:*[0123456789]*/images/[0123456789/]*\.gif](http://62.118.249.36:*[0123456789]*/images/[0123456789/]*\.gif){kind=link}
![http://us\.a1\.yimg\.com:*[0123456789]*/us\.yimg\.com/a/in/information_usa/.*\.gif](http://us\.a1\.yimg\.com:*[0123456789]*/us\.yimg\.com/a/in/information_usa/.*\.gif){kind=link}
![http://195\.161\.118\.21/images/[0123456789/]*\.gif](http://195\.161\.118\.21/images/[0123456789/]*\.gif){kind=link}
![http://t0\.extreme-dm:*[0123456789]*\.com/0\.gif\](http://t0\.extreme-dm:*[0123456789]*\.com/0\.gif\){kind=link}
![http://r\.mail\.ru:*[0123456789]*/[a-z0-9]*\.jpg$](http://r\.mail\.ru:*[0123456789]*/[a-z0-9]*\.jpg$){kind=link}
![http://www.rambler.ru:*[0123456789]*/knp.gif](http://www.rambler.ru:*[0123456789]*/knp.gif){kind=link}