RE: [squid-users] Detected DEAD parent

Hi,

I've kept investigating, but I still haven't found the reason :(
Concerning the reasons you've enounced :
a) they're running

b)no message in cache.log. What's more, when I look in cachemgr the
page General Runtime Info, I always have a large number of free file
descriptor (I've compiled squid with 8192 fd).

c) connectivity on the swith is ok : all proxies have negociated 100
Full Duplex, and when running a ping during 4 hours, I don't have a
single packet loss...

d) i'm trying to see if the backlog is full. Could the child proxies
be the reason of a full backlog on the parent? As each parent are handling
5000 http req/min all relayed from the children (no client connection
directly on a parent), and they also host the autoproxy script for IE...

I'm sorry to bother you with this problem... Thx for your help

        P-E

-----Message d'origine-----
De : Henrik Nordstrom [mailto:hno@squid-cache.org]
Envoy� : vendredi 6 ao�t 2004 12:53
� : SXB6300 Mailing
Cc : Henrik Nordstrom; squid-users@squid-cache.org
Objet : RE: [squid-users] Detected DEAD parent

On Fri, 6 Aug 2004, SXB6300 Mailing wrote:

> RH9 and squid 2.5S1. Too give a little more detail, all the squid proxies (parent
> and child) arrive on the same switch, so I really don't think it's a network issue.

If you see TCP connection failed messages then there is
very few possible causes:

   a) The peer is not running, either due to manual action or unexpected
restart. Seen in cache.log.

   b) The peer is not accepting any new connections due to running out of
filedescriptors. Seen in cache.log.

   c) Network connectivity is poor causing a lot of dropped packets. For
example if full/half duplex negotiation between server and switch is
wrong or bad cables. Usually seen in ping as packet loss but easier to
detect by network testing (netperf or similar).

   d) SYN backlog is full on the peer, possibly from someone SYN flooding
it or if there is very many dialup / wan type clients accessing it (large
latency client<->server). Not easily seen unless it gets very far where
the kernel may warn about a possible SYN flood..

Regards
Henrik
Received on Wed Aug 11 2004 - 00:58:56 MDT