Failover does not seem to work properly in case of HTTPS. When the primary parent proxy fails, it takes minutes until the download starts and in some cases it never starts. Is there anything that must be configured specifially in case of HTTPS and timeouts for failover? This is my squid.conf: # ACCESS CONTROLS # ----------------------------------------------------------------------------- # Local Networks acl localnet src 139.2.0.0/16 acl localnet src 193.96.112.0/21 acl localnet src 192.109.216.0/24 acl localnet src 100.1.4.0/22 acl localnet src 10.0.0.0/8 acl localnet src 172.16.0.0/12 acl localnet src 192.168.0.0/16 # mycompany Networks acl to_matnet dst 139.2.0.0/16 acl to_matnet dst 193.96.112.0/21 acl to_matnet dst 192.109.216.0/24 acl to_matnet dst 100.1.4.0/22 acl to_matnet dst 10.0.0.0/8 acl to_matnet dst 172.16.0.0/12 acl to_matnet dst 192.168.0.0/16 # SSL-Ports acl SSL_ports port 443 # https acl SSL_ports port 563 # snews acl SSL_ports port 873 # rsync # Safe-Ports acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl Safe_ports port 631 # cups acl Safe_ports port 873 # rsync acl Safe_ports port 901 # SWAT # HTTPS acl CONNECT method CONNECT http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow manager localhost http_access deny manager http_access allow localnet http_access allow localhost http_access deny all # NETWORK OPTIONS # ----------------------------------------------------------------------------- http_port 3128 # OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM # ----------------------------------------------------------------------------- cache_peer proxy.mycompany.de parent 8080 0 no-digest no-query connect-timeout=5 connect-fail-limit=3 default cache_peer roxy.mycompany.de parent 8080 0 no-digest no-query connect-timeout=5 connect-fail-limit=3 # MEMORY CACHE OPTIONS # ----------------------------------------------------------------------------- maximum_object_size_in_memory 8 MB memory_replacement_policy heap LFUDA cache_mem 256 MB # DISK CACHE OPTIONS # ----------------------------------------------------------------------------- maximum_object_size 10 GB cache_replacement_policy heap GDSF cache_dir ufs /var/cache/squid 88894 16 256 max-size=10737418240 # LOGFILE OPTIONS # ----------------------------------------------------------------------------- access_log daemon:/var/log/squid/access.log squid # OPTIONS FOR TROUBLESHOOTING # ----------------------------------------------------------------------------- cache_log /var/log/squid/cache.log coredump_dir /var/log/squid # OPTIONS FOR TUNING THE CACHE # ----------------------------------------------------------------------------- max_stale 6 days shutdown_lifetime 5 seconds # ADMINISTRATIVE PARAMETERS # ----------------------------------------------------------------------------- visible_hostname proxy.mycompany.com # OPTIONS INFLUENCING REQUEST FORWARDING # ----------------------------------------------------------------------------- always_direct allow to_matnet never_direct allow all # DNS OPTIONS # ----------------------------------------------------------------------------- dns_nameservers 139.2.34.171 dns_nameservers 139.2.34.37 # MISCELLANEOUS # ----------------------------------------------------------------------------- memory_pools off Regards, Jens Gesendet: Mittwoch, 15. März 2017 um 15:38 Uhr Von: "Amos Jeffries" <squid3@xxxxxxxxxxxxx> An: squid-users@xxxxxxxxxxxxxxxxxxxxx Betreff: Re: No failover when default parent proxy fails (Squid 3.5.12) On 15/03/2017 7:06 p.m., Jens Offenbach wrote: > Hi, > I have two parent proxies configured, but Squid seems to stick to the default proxy even when the proxy cannot be reached: > 2017/03/15 06:40:13 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:13 kid1| Detected DEAD Parent: proxy.mycompany.de > 2017/03/15 06:40:13 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:13 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:13 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:13 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:13 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:13 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:43 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:43 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:43 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:43 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:43 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:43 kid1| TCP connection to proxy.mycompany.de/8080 failed > 2017/03/15 06:40:43 kid1| TCP connection to proxy.mycompany.de/8080 failed Appearances can be deceiving at times. This shows that several "a connections were attempted but does not specify if that was the orider they were initiated or not. It also does not indicate whether that was HTTP or probe for ressurected peer. You have disabled the probes though (no-query no-digest) so it is unlikely Squid will ever detect a DEAD peer as coming alive again. This makes me suspect that the "roxy" peer was also detected dead some time earlier. If that has happened then the "FIRST_AVAILABLE" peer selection algorithm will produce no possible routes and Squid falls back to the DEFAULT peer ... which happens to be that one you see in the log and will try that peer until it works again. If you want to see the exact route selection results add this to your squid.conf: debug_options 44,2 Amos _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
