Re: [squid-users] Re: Server crashes

"Lightfoot.Michael" wrote:

> Also check that you don't have a very large number of half-closed
> connections (ie in CLOSE_WAIT or TIME_WAIT.) For some unfathomable
> reason, Solaris sets the tcp_time_wait_interval (tcp_close_wait_interval
> in Solaris 2.6) to 120 seconds by default. Because squid has lots of
> short-lived TCP connections the default causes a huge backlog of
> half-closed connections which will slow down all network traffic. I set
> it to 60 seconds on some machines (Internet or WAN visible) and 30
> seconds on others (LAN only.) I do this in an rc script at startup.

Note: The TCP/IP standard REQUIRES TIME_WAIT to be at least 120 seconds.
There usually is no good reasons to make this much lower.

What you should do is to increase the span of unbound TCP/IP ports used
when applications make TCP connections if this is limited. I don't know
what the default is for Solaris, but on many Linux versions this span is
only about 4K ports which is not sufficient for high rate proxies..

Small math: If you have unbound ports set to 1024-65535 then your TCP/IP
kernel can make more than 500 outgoing TCP connections per second (60000
/ 120) without ever running into problems due to TIME_WAIT sockets
blocking things..

If your OS have problem due to the scheer amount of TIME_WAIT sockets
then you either need more memory, or upgrade your OS. All OS:es
(including Solaris) to my knowledge deals very well with TIME_WAIT these
days.

You should not have very many sockets in CLOSE_WAIT. If you have then
there is most likely an application error. CLOSE_WAIT is seen when the
remote end has closed the connection (or at least it's transmit channel)
but the local application has not yet closed the connection. In the
squid configuration the directive "half_closed_clients on/off" is
related to CLOSE_WAIT sockets.

Regards
Henrik
Received on Tue Nov 26 2002 - 03:29:09 MST