On 2/05/2014 10:11 a.m., Laz C. Peterson wrote:> Hello Eliezer, > > Yes, the squid instances runs wonderfully. And actually we use standard delay_pools with no problems. Only when introducing client_delay_pools does the problems start. > > Here is the results of “squid -kparse” … Again, this is using Squid 3.3.8 on Ubuntu 14.04. > <snip> > > 2014/05/01 15:08:21| Processing: acl ocr_clinic src 10.3.2-6.101-110/32 > 2014/05/01 15:08:21| Processing: acl ocr_exam src 10.3.2-6.111-120/32 > 2014/05/01 15:08:21| Processing: acl ocr_va src 10.3.2-6.121-130/32 > 2014/05/01 15:08:21| Processing: acl ocr_insurance src 10.3.1.101-10.3.1.110/32 10.3.1.161-10.3.1.170/32 > 2014/05/01 15:08:21| Processing: acl ocr_admin src 10.3.1.121-10.3.1.130/32 > 2014/05/01 15:08:21| Processing: acl ocr_study src 10.3.1.141-142/32 > 2014/05/01 15:08:21| Processing: acl ocr_testing src 10.3.2-6.81-90/32 > 2014/05/01 15:08:21| Processing: acl ocr_doctor_personal src 10.3.1-6.231-240/32 > 2014/05/01 15:08:21| Processing: acl ocr_doctor_systems src 10.3.2-6.131-135/32 > 2014/05/01 15:08:21| Processing: acl ocr_dhcp src 10.3.1-6.201-230/32 These above lines contain invalid IP address ranges. The ACL value format is: start [ '-' end ] [ '/' mask ] Squid parses those using the operating system resolver which accepts them silently and produces: acl ocr_clinic src 10.3.0.2-6.0.0.101 acl ocr_exam src 10.3.0.2-6.0.0.111 acl ocr_va src 10.3.0.2-6.0.0.121 acl ocr_insurance src 10.3.1.101-10.3.1.110/32 10.3.1.161-10.3.1.170/32 acl ocr_admin src 10.3.1.121-10.3.1.130/32 acl ocr_study src 10.3.1.141-0.0.0.142 acl ocr_testing src 10.3.0.2-6.0.0.81 acl ocr_doctor_personal src 10.3.0.1-6.0.0.231 acl ocr_doctor_systems src 10.3.0.2-6.0.0.131 acl ocr_dhcp src 10.3.0.1-6.0.0.201 Similar thing in: acl laz src 10.3.0.1-6.0.0.31 <snip> > 2014/05/01 15:08:21| Processing Configuration File: /etc/squid3/conf.d/ocr/ocr.access (depth 2) > 2014/05/01 15:08:21| Processing: http_access allow ocr_gary all > 2014/05/01 15:08:21| Processing: http_access deny adsites > 2014/05/01 15:08:21| Processing: http_access deny adregex > 2014/05/01 15:08:21| Processing: http_access allow laz all > 2014/05/01 15:08:21| Processing: http_access allow ocr_dhcp all > 2014/05/01 15:08:21| Processing: http_access allow ocr_study all > 2014/05/01 15:08:21| Processing: http_access allow ocr_unrest_comps all > 2014/05/01 15:08:21| Processing: http_access allow ocr_doctor_systems all > 2014/05/01 15:08:21| Processing: http_access allow ocr_doctor_personal all > 2014/05/01 15:08:21| Processing: http_access allow ocr_admin all > 2014/05/01 15:08:21| Processing: http_access allow ocr_chen all > 2014/05/01 15:08:21| Processing: http_access allow paravis all NOTE: appending "all" to the end of allow rules for ACL types other than proxy_auth and external is a useless waste of config loading time and pre-request ACL processing CPU cycles. > 2014/05/01 15:08:21| Processing: http_access allow ocr ocr_audiosites > 2014/05/01 15:08:21| Processing: http_access allow ocr ocr_audio > 2014/05/01 15:08:21| Processing: http_access allow ocr ocr_white > 2014/05/01 15:08:21| Processing: http_access deny ocr all > 2014/05/01 15:08:21| Processing: include /etc/squid3/conf.d/ocr/ocr.dl_bw > 2014/05/01 15:08:21| Processing Configuration File: /etc/squid3/conf.d/ocr/ocr.dl_bw (depth 2) > 2014/05/01 15:08:21| Processing: delay_pools 7 > 2014/05/01 15:08:21| Processing: delay_class 1 3 > 2014/05/01 15:08:21| Processing: delay_access 1 allow ocr_unrest_doc > 2014/05/01 15:08:21| Processing: delay_access 1 allow ocr_chen > 2014/05/01 15:08:21| Processing: delay_access 1 allow ocr_doctor_personal > 2014/05/01 15:08:21| Processing: delay_access 1 allow ocr_doctor_systems > 2014/05/01 15:08:21| Processing: delay_access 1 deny all > 2014/05/01 15:08:21| Processing: delay_parameters 1 2500000/2500000 2500000/2500000 2500000/2500000 > 2014/05/01 15:08:21| Processing: delay_class 2 3 > 2014/05/01 15:08:21| Processing: delay_access 2 allow ocr_gary > 2014/05/01 15:08:21| Processing: delay_access 2 deny all > 2014/05/01 15:08:21| Processing: delay_parameters 2 6200000/6200000 6200000/6200000 6200000/6200000 > 2014/05/01 15:08:21| Processing: delay_class 3 3 > 2014/05/01 15:08:21| Processing: delay_access 3 allow ocr_clinic > 2014/05/01 15:08:21| Processing: delay_access 3 allow ocr_insurance > 2014/05/01 15:08:21| Processing: delay_access 3 allow ocr_testing > 2014/05/01 15:08:21| Processing: delay_access 3 allow ocr_study > 2014/05/01 15:08:21| Processing: delay_access 3 deny all > 2014/05/01 15:08:21| Processing: delay_parameters 3 1050000/1050000 1050000/1050000 1050000/1050000 > 2014/05/01 15:08:21| Processing: delay_class 4 3 > 2014/05/01 15:08:21| Processing: delay_access 4 allow ocr_exam > 2014/05/01 15:08:21| Processing: delay_access 4 allow ocr_va > 2014/05/01 15:08:21| Processing: delay_access 4 deny all > 2014/05/01 15:08:21| Processing: delay_parameters 4 420000/420000 420000/420000 420000/420000 > 2014/05/01 15:08:21| Processing: delay_class 5 3 > 2014/05/01 15:08:21| Processing: delay_access 5 allow ocr_dhcp > 2014/05/01 15:08:21| Processing: delay_access 5 deny all > 2014/05/01 15:08:21| Processing: delay_parameters 5 800000/800000 800000/800000 800000/800000 > 2014/05/01 15:08:21| Processing: delay_class 6 3 > 2014/05/01 15:08:21| Processing: delay_access 6 allow ocr_admin > 2014/05/01 15:08:21| Processing: delay_access 6 deny all > 2014/05/01 15:08:21| Processing: delay_parameters 6 1300000/1300000 1300000/1300000 1300000/1300000 > 2014/05/01 15:08:21| Processing: delay_class 7 3 > 2014/05/01 15:08:21| Processing: delay_access 7 allow paravis > 2014/05/01 15:08:21| Processing: delay_access 7 deny all > 2014/05/01 15:08:21| Processing: delay_parameters 7 6200000/6200000 6200000/6200000 6200000/6200000 > 2014/05/01 15:08:21| Processing: include /etc/squid3/conf.d/ocr/ocr.ul_bw > 2014/05/01 15:08:21| Processing Configuration File: /etc/squid3/conf.d/ocr/ocr.ul_bw (depth 2) > 2014/05/01 15:08:21| Processing: client_delay_pools 1 > 2014/05/01 15:08:21| Processing: client_delay_access 1 allow all > 2014/05/01 15:08:21| Processing: client_delay_access 1 deny all These two above lines contradict each other. The second will never be applied. I also note this is very different from the config you displayed earlier as not working. Although the effects should be identical in both configs. > 2014/05/01 15:08:21| Processing: client_delay_parameters 1 2048 32000 > 2014/05/01 15:08:21| Processing: http_access deny !Safe_ports > 2014/05/01 15:08:21| Processing: http_access deny CONNECT !SSL_ports > 2014/05/01 15:08:21| Processing: http_access allow localhost manager > 2014/05/01 15:08:21| Processing: http_access deny manager This group of 4 http_access above should be up top above your local rules. They exist so that CONNECT and known dangerous non-HTTP protocols do not open security holes through the proxy. > 2014/05/01 15:08:21| Processing: http_access allow localhost > 2014/05/01 15:08:21| Processing: http_access deny all > 2014/05/01 15:08:21| Processing: http_port 3128 > 2014/05/01 15:08:21| Processing: coredump_dir /var/spool/squid3 > 2014/05/01 15:08:21| Processing: refresh_pattern ^ftp: 1440 20% 10080 > 2014/05/01 15:08:21| Processing: refresh_pattern ^gopher: 1440 0% 1440 > 2014/05/01 15:08:21| Processing: refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 > 2014/05/01 15:08:21| Processing: refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880 > 2014/05/01 15:08:21| Processing: refresh_pattern -i \.(gif|png|jpg|jpeg|ico)$ 10080 90% 43200 override-expire ignore-no-store ignore-private > 2014/05/01 15:08:21| Processing: refresh_pattern -i \.(iso|avi|wav|mp3|mp4|mpeg|swf|flv|x-flv)$ 43200 90% 432000 override-expire ignore-no-store ignore-private > 2014/05/01 15:08:21| Processing: refresh_pattern -i \.(deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|tiff)$ 10080 90% 43200 override-expire ignore-no-store ignore-private >From the ACL names it looks like you have a few medical systems behind this proxy? Please take extreme care with the use of ignore-private, ignore-no-store, and override-expire on content to/from those systems. I have seen and heard about medical screwups (wrong prescriptions, wrong diagnosis, and patient record mixups) caused by proxies caching medically relevant information in direct contravention of the cache control headers emitted by medical related software. The .tif* and .bin file formats in particular are used for some medical scan data due to resolution quality. > 2014/05/01 15:08:21| Processing: refresh_pattern -i \.index.(html|htm)$ 0 40% 10080 > 2014/05/01 15:08:21| Processing: refresh_pattern -i \.(html|htm|css|js)$ 1440 40% 40320 > 2014/05/01 15:08:21| Processing: refresh_pattern . 0 40% 40320 > 2014/05/01 15:08:21| WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP > 2014/05/01 15:08:21| WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP > 2014/05/01 15:08:21| WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP > Amos
