Search squid archive

Re: Log Files running out disk space

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Nyamul Hassan wrote:
Hi,

One of proxies died down today, because the log files were overwhelming:

-rw-r----- 1 squid squid       61440 Aug 17 16:01 access.log
-rw-r----- 1 squid squid   523366451 Aug 17 02:59 access.log.0
-rw-r----- 1 squid squid   771658231 Aug 17 00:00 access.log.1
-rw-r----- 1 squid squid   562853886 Aug 16 21:00 access.log.2
-rw-r----- 1 squid squid   618221433 Aug 16 18:00 access.log.3
-rw-r----- 1 squid squid   572403480 Aug 16 15:00 access.log.4
-rw-r----- 1 squid squid   379977665 Aug 16 12:00 access.log.5
-rw-r----- 1 squid squid   348474013 Aug 16 09:00 access.log.6
-rw-r----- 1 squid squid   367307983 Aug 16 06:00 access.log.7
-rw-r----- 1 squid squid   663904388 Aug 16 03:00 access.log.8
-rw-r----- 1 squid squid   735110835 Aug 16 00:00 access.log.9
-rw-r----- 1 squid squid 36715761664 Aug 17 16:01 cache.log
-rw-r----- 1 squid squid 14262776941 Aug 17 03:00 cache.log.0
-rw-r----- 1 squid squid      955445 Aug 17 00:00 cache.log.1
-rw-r----- 1 squid squid      748262 Aug 16 21:00 cache.log.2
-rw-r----- 1 squid squid     1069482 Aug 16 18:00 cache.log.3
-rw-r----- 1 squid squid      698758 Aug 16 15:00 cache.log.4
-rw-r----- 1 squid squid      497547 Aug 16 11:59 cache.log.5
-rw-r----- 1 squid squid      271153 Aug 16 08:59 cache.log.6
-rw-r----- 1 squid squid      355351 Aug 16 05:59 cache.log.7
-rw-r----- 1 squid squid      759748 Aug 16 02:59 cache.log.8
-rw-r----- 1 squid squid     1037802 Aug 15 23:59 cache.log.9

As you can see, those "HUGE" cache log files were filled up in less
than 12 hours.  Opening them up, I find they were filled with the
following lines, repeated over and over again:

2010/08/17 02:33:11| comm_accept: FD 28: (22) Invalid argument
2010/08/17 02:33:11| httpAccept: FD 28: accept failure: (22) Invalid argument
2010/08/17 02:33:11| comm_accept: FD 28: (22) Invalid argument
2010/08/17 02:33:11| httpAccept: FD 28: accept failure: (22) Invalid argument
2010/08/17 02:33:11| comm_accept: FD 28: (22) Invalid argument
2010/08/17 02:33:11| httpAccept: FD 28: accept failure: (22) Invalid argument

And, that is the time from when it started.  Is there any way to
determine what is causing this?

Start with the Squid version and what settings your http_port are configured with.

Then we check for what it means. Google locates several requests, strangely around August each year for the last few.

Someone describes it thus: "The problem is however elsewhere, since it somewhere fails to obtain a socket (or has its socket destroyed by the kernel somehow) so that when it calls accept(2) on the socket it's not a socket any more."

Might be a SYN-flood DoS by that description. But your OS security should be catching such a thing before it gets near any internal software like Squid.

Amos
--
Please be using
  Current Stable Squid 2.7.STABLE9 or 3.1.6
  Beta testers wanted for 3.2.0.1


[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux