Re: squid_kerb_auth high CPU usage

["Markus Moeller" <huaraz@xxxxxxxxxxxxxxxx>]

Could you add the following to your squid startup script ?

export KRB5RCACHETYPE=none

This should disable the cache and I don't think it is a big security risk. 
Could you report back if this improves the CPU load ?

Thank you very much
Markus

"Markus Moeller" <huaraz@xxxxxxxxxxxxxxxx> wrote in message 
news:h1ttrg$bek$1@xxxxxxxxxxxxxxxx
> Hi,
>
>  TBH I haven't had yet a chance to do performance  testing of my helper. 
> What you are seeing is the Kerberos replay protection cache. HTTP is the 
> part of the service principal and 501 is the uid of the process. 
> Depending on the request/sec it can be quite a bit as each request will be 
> authenticated.  If I find time I will check which part of the helper is 
> creating the load.
>
> Regards
> Markus
>
> "J.J." <jayjayjay@xxxxxx> wrote in message 
> news:20090624140826.52200@xxxxxxxxxx
> > hi Everybody!
> >
> > i have a problem with authentication helper squid_kerb_auth.
> > It's consuming too much CPU. 15 min Load average from the squid server is 
> > about 5, 5 min average peaks upto 13, see top output
> >
> > top - 13:48:13 up 15:45,  5 users,  load average: 8.23, 6.21, 4.85
> > Tasks: 175 total,   2 running, 173 sleeping,   0 stopped,   0 zombie
> > Cpu(s): 11.0%us, 25.6%sy,  0.0%ni, 45.6%id, 16.3%wa,  0.2%hi,  1.3%si, 
> > 0.0%st
> > Mem:   2073876k total,  2020008k used,    53868k free,   251548k buffers
> > Swap:  2031608k total,      640k used,  2030968k free,  1029856k cached
> >
> > The Cache serves about 350 Users, OS is Fedora 10.
> >
> > From stracing a helper process i saw its opening/writing/reading from and 
> > to "/var/tmp/HTTP_501" , which is a 150-200k file, growing and shrinking 
> > all the time, containing all the Usernames a few times.
> >
> > Kerberos as itself works as intended. I already changed number of helper 
> > childs, did not help.
> >
> > I found no suspicious alerts in the cache log or other system logs, just 
> > high CPU Usage.
> >
> > Does anybody know if this behaviour is OK, or how to debug it?
> >
> > This HTTP_501 file, which contains every Username more than redundant, 
> > also makes me curious, as HTTP 501 is error code for "not implemented"
> >
> > Anybody with Kerberos Config here that can help me with this?
> >
> > Thanks!
> >
> > Regards
> >
> > jay
> >
> >
> > ---krb5.conf
> >
> > [logging]
> > default = SYSLOG:VERBOSE:USER
> >
> > [libdefaults]
> > default_realm = XXXX
> > dns_lookup_realm = false
> > dns_lookup_kdc = false
> > default_keytab_name = FILE:/etc/krb5.keytab
> > clockskew = 300
> >
> > ...
> >
> > [appdefaults]
> > pam =
> > {
> > debug = false
> > ticket_lifetime = 36000
> > renew_lifetime = 36000
> > forwardable = true
> > krb4_convert = false
> > }
> >
> > --
> > GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT!
> > Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01