Search squid archive

RE: Too many queued ntlmauthenticator requests and squid failed

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, 18 Oct 2010 22:54:42 +0000, "Tharanga Abeyseela (RGA)" wrote:
> Hi,
> 
> I tried to start squid in the offpeak time there were only 35 users, but
> still its says Too many queued ntlmauthenticator requests, and terminate
> the squid process.
> 
> My domain is connected to several other domains (trusted domains) can it
> cause this issue ?
> 
> 
> Following are the error messages on log files.
> 
> Squid Parent: child process 15206 exited with status 1
> Oct 18 19:47:29 rapsydprox2 squid[15204]: Squid Parent: child process
> 20806 exited due to signal 15
> 
> 2010/10/18 19:47:10,  2] winbindd/winbindd.c:872(remove_client)
>   final write to client failed: Broken pipe
> [2010/10/18 19:47:10,  0]
> winbindd/winbindd.c:954(winbindd_listen_fde_handler)
>   winbindd: Exceeding 200 client connections, no idle connection found

Ouch. So your problem then is that your Squid receives greater than *200*
concurrent *new* TCP connections (per second or so) with only 35 users.
This is about double the maximum number of concurrent connections modern
web browser make to proxies (4-6).
 * Make sure that your squid.conf has at least
client_persistent_connections and server_persistent_connections turned on.
It might reduce this a little bit.
 * check your squid.conf http_access listing order. Make as many
rejections as possible before testing for auth. This will usually have a
chain reaction down to increased average service times.

Note that squid-3.0 does not have "connection pinning" which is required
to connect to anything on the other side of Squid with NTLM. Connections
*to* Squid with NTLM only required persistent connections.

I really strongly urge you move to 3.1.8. We have done a lot of work to
make connections more persistent since 3.0 was released.


> [2010/10/18 19:47:21,  0]
> winbindd/winbindd.c:954(winbindd_listen_fde_handler)
>   winbindd: Exceeding 200 client connections, no idle connection found
> [2010/10/18 19:47:21,  2] winbindd/winbindd.c:872(remove_client)
>   final write to client failed: Broken pipe
> 
> 
> 5  Oct 18 16:58:37 rapsydprox2 (squid): Too many queued
ntlmauthenticator
> requests
>   976  Oct 18 17:00:23 rapsydprox2 (ntlm_auth): [2010/10/18 17:00:23, 
0]
>   utils/ntlm_au
>   977  Oct 18 17:00:23 rapsydprox2 (ntlm_auth):   could not obtain
winbind
>   domain name!
> Following is my smb.conf
> 
> workgroup = zzz
> realm = zzz.COM
> password server = *
> #netbios name = zzz
> server string = Samba file and print server
> security = ADS
> encrypt passwords = yes
> log level = 2
> log file = /var/log/samba/%m
> max log size = 50
> winbind separator = \.
> #printcap name = cups
> #printing = cups
> ##new
> idmap cache time = 1800
> idmap negative cache time = 300
> winbind cache time = 1800
> ##end new
> idmap uid = 15000-20000
> idmap gid = 15000-20000
> #winbind use default domain = yes
> nt acl support = yes
> map acl inherit = yes
> winbind enum users = yes
> winbind enum groups = yes
> #client ntlmv2 auth = yes
> template homedir = /home/%D/%U
> template shell = /bin/bash
> ldap passwd sync  = yes
> 
> 
> 
> Appreciate your help on this.
> 
> Thanks,
> 
> Tharanga
> 
> 
> -----Original Message-----
> From: Amos Jeffries
> 
> On Mon, 18 Oct 2010 00:50:28 +0000, "Tharanga Abeyseela \(RGA\)" wrote:
>> Hi Guys,
>> 
>> I have been running squid with AD authentication and security group
>> authent= ication for the last 6 months, and suddenly squid failed with
> the
>> following=  message
>> 
>> (squid): Too many queued ntlmauthenticator requests.
> 
> Sign of a sudden burst of people logging in. Or that something caused a
> slightly higher than normal delay in the auth checks. Which multiplies
out
> to fill up the Squid helpers.
> 
>> 
>> Iam using
>> 
>> samba-3.4.8-59.fc12.x86_64
>> samba-winbind-clients-3.4.8-59.fc12.x86_64
>> samba-common-3.4.8-59.fc12.x86_64
>> samba-client-3.4.8-59.fc12.x86_64
>> samba-winbind-devel-3.4.8-59.fc12.x86_64
>> samba-winbind-3.4.8-59.fc12.x86_64
>> Squid Cache: Version 3.0.STABLE24
>> configure options:  '--prefix=3D/usr/local/squid'
>> '--enable-auth=3Dntlm,bas= ic'
>> '--enable-external-acl-helpers=3Dwbinfo_group'
>> 
>> and also iam getting the following error
>> 
>> [2010/10/18 10:28:58,  3] winbindd/winbindd_cm.c:1597(connection_ok)
>>   connection_ok: Connection to  for domain xxx  is not connected
>> 
>> (but if I use the net join command it says joined to domain)
>> 
>> According to my squid report normally there are 700 people connecting
to
>> th= e proxy, but now its says  winbind maximum connection exceeds 200,
> but
>> iam = confusing about that.
>> 
>> Appreciate your help on this.
>> 
>> Best regards,
>> Tharanga
> 
> Two basic design flaws in NTLM:
>  - winbind cannot accept more than ~256 simultaneous stateful logins (ie
> NTLM)
>  - NTLM requires every new TCP connection to perform a full 2-request
> handshake
>    (ie minimum login delays of request+reply+request+reply in HTTP)
> 
> There are two things which each reduce the problem a little. When
combined
> they provide a great improvement in network speed and logins...
> 
>  - upgrade to 3.1.8.
>  - upgrade to Negotiate/Kerberos from NTLM
> 
> 
> Amos


[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux