Hi, I've been running a squid 3.3 live with SSL inspection for over a week, AV scanning with clamav+c-icap work fine until now (about 500k GETS per day). Then users started seen icap errors in their browser:: In the squid logs: essential ICAP service is suspended: icap://127.0.0.1:1344/squidclamav [down,susp,fail11] c-icap was then tuned a bit: - increase the number of processes (now have 90) - set debug=0 (less logs`: they were massive) - exclude large files from scanning and certain media types The system was not that heavily loaded (load bout 0.3, icap getting maybe 20 requests/sec), the above measure did seem to make much difference. Any suggestions for avoiding this? Also, when this happens, squid takes a few minutes to talk to icap again: 15:30:31 kid1| essential ICAP service is suspended: icap://127.0.0.1:1344/squidclamav [down,susp,fail11] 15:33:31 kid1| essential ICAP service is up: icap://127.0.0.1:1344/squidclamav [up] Is there a timeout variable to ask squid to talk to icap much quick again? Squid config: icap_enable on icap_send_client_ip on icap_send_client_username on icap_client_username_encode off icap_client_username_header X-Authenticated-User icap_preview_enable on icap_preview_size 1024 scanned via squidclamav Service via ICAP icap_service service_req reqmod_precache bypass=1 icap://127.0.0.1:1344/squidclamav adaptation_access service_req deny CONNECT adaptation_access service_req allow all icap_service service_resp respmod_precache bypass=0 icap://127.0.0.1:1344/squidclamav adaptation_access service_resp deny CONNECT adaptation_access service_resp allow all Sean
