Hi
Sometimes my users complains that the internet
navigation thought Squid is very slow.
After checking the access.log, I can see a lot of
ABORTED messages like this
1715537802.589 2 10.103.12.94
NONE_NONE_ABORTED/200 0 CONNECT api.telegram.org:443 -
HIER_NONE/-:- - mac="00:00:00:00:00:00"
accessrule:%20global_whitelist%0D%0A
exterr="ERR_CLIENT_GONE|WITH_CLIENT"
1715537183.180 99993 172.16.31.205
TCP_MISS_ABORTED/000 0 POST http://pjcpd-dlpend01.hlbank.my/GECommunicationWS.asmx
- HIER_NONE/-:- - mac="00:00:00:00:00:00"
accessrule:%20global_whitelist%0D%0A
exterr="ERR_CLIENT_GONE|WITH_CLIENT"
I have imported the access.log into my ELK machine and
I can see that during the time that the users complained
about the slowness there is a huge spike of NONE_ABORTED
messages.
https://i.postimg.cc/6QR79GWk/6e727e86-de3d-4f3b-bd9e-04c04052ca2e.jpg
Now my question is:
1. What can cause this kind of issue? It's a squid
server issue, network (firewall, switch, router, …), or
client?
2. Why the number of NONE_ABORTED requests is almost 4
time more than normal request?
Best regards