Search squid archive

Re: squid_kerb_auth high CPU usage

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Could you add the following to your squid startup script ?

export KRB5RCACHETYPE=none

This should disable the cache and I don't think it is a big security risk. Could you report back if this improves the CPU load ?

Thank you very much
Markus

"Markus Moeller" <huaraz@xxxxxxxxxxxxxxxx> wrote in message news:h1ttrg$bek$1@xxxxxxxxxxxxxxxx
Hi,

TBH I haven't had yet a chance to do performance testing of my helper. What you are seeing is the Kerberos replay protection cache. HTTP is the part of the service principal and 501 is the uid of the process. Depending on the request/sec it can be quite a bit as each request will be authenticated. If I find time I will check which part of the helper is creating the load.

Regards
Markus

"J.J." <jayjayjay@xxxxxx> wrote in message news:20090624140826.52200@xxxxxxxxxx
hi Everybody!

i have a problem with authentication helper squid_kerb_auth.
It's consuming too much CPU. 15 min Load average from the squid server is about 5, 5 min average peaks upto 13, see top output

top - 13:48:13 up 15:45,  5 users,  load average: 8.23, 6.21, 4.85
Tasks: 175 total,   2 running, 173 sleeping,   0 stopped,   0 zombie
Cpu(s): 11.0%us, 25.6%sy, 0.0%ni, 45.6%id, 16.3%wa, 0.2%hi, 1.3%si, 0.0%st
Mem:   2073876k total,  2020008k used,    53868k free,   251548k buffers
Swap:  2031608k total,      640k used,  2030968k free,  1029856k cached

The Cache serves about 350 Users, OS is Fedora 10.

From stracing a helper process i saw its opening/writing/reading from and to "/var/tmp/HTTP_501" , which is a 150-200k file, growing and shrinking all the time, containing all the Usernames a few times.

Kerberos as itself works as intended. I already changed number of helper childs, did not help.

I found no suspicious alerts in the cache log or other system logs, just high CPU Usage.

Does anybody know if this behaviour is OK, or how to debug it?

This HTTP_501 file, which contains every Username more than redundant, also makes me curious, as HTTP 501 is error code for "not implemented"

Anybody with Kerberos Config here that can help me with this?

Thanks!

Regards

jay


---krb5.conf

[logging]
default = SYSLOG:VERBOSE:USER

[libdefaults]
default_realm = XXXX
dns_lookup_realm = false
dns_lookup_kdc = false
default_keytab_name = FILE:/etc/krb5.keytab
clockskew = 300

...

[appdefaults]
pam =
{
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}

--
GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT!
Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01







[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux