Re: [squid-users] errors-to-log ratio/thresholds for software abort and comm_accept

From: Henrik Nordstrom <[email protected]>
Date: Fri, 25 Apr 2003 21:11:46 +0200

On Friday 25 April 2003 19.42, Adam wrote:

> if there were some tests or other that I could run to confirm
> this or other Solaris specific anomalies as normal behavior,
> I'd be glad to give it a try on my dev box.

Here is a thing you probably can try on your production box:

Use snoop or tcpdump to save a packet trace of traffic received by
Squid on port 3128. Then analyze this traffic to determine if the
comm_accept errors correlates to RST sent by the clients shortly
after (fraction of a second) or during the SYN handshake.

 1. Have tcpdump/snoop running and recording to a file until you have
seen a couple of errors logged in cache.log.

 2. Extract the timestamps of RST packets, and see if there is matches
correlating to the errors logged (there probably is many more RST
packets..)

 3. Extract more detailed traces of the identified sessions by
selecting packets on client IP and port.

> With most of the development and discussion here
> focused around Linux, I'd say the next upgrade cycle (years not
> months away) will be to the x86/Linux platform.

Solaris is not a bad platform, and there is many large Squid
installations running on Solaris.

The primary decision on which platform to run Squid on is to decide
which platform you are most comfortable with. Squid is quite happy
with most choices.

All platforms have their good and bad, and Linux certainly is not
perfect (but improving rapidly).

Regards
Henrik

-- 
Donations welcome if you consider my Free Squid support helpful.
https://www.paypal.com/xclick/business=hno%40squid-cache.org
If you need commercial Squid support or cost effective Squid or
firewall appliances please refer to MARA Systems AB, Sweden
http://www.marasystems.com/, [email protected]
Received on Fri Apr 25 2003 - 13:11:08 MDT

This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 17:15:30 MST