RE: [squid-users] Tcp connection failed problem

Hi Henrik,

I'll investigate today the points you've mentionned and give you
a feedback as soon as I can.

I can already answer some points : I don't think it's a cpu overload
problem, because these messages appear on very different boxes (from
bi-PIII 600 Mhz to PIV Xeon 2.8 Ghz) with sometimes the same amount
of trafic.
I've already made some tcpdump traces on both the child and the parent.
When I get those "tcp connection ... failed" messages, I see the syn
packet on the child, but it doesn't arrive to the parent. So it would
look like packet loss but I'm a bit sceptic 'cause I also get those
messages on a child whose parent is directly on the same network switch.

What ever, thanx for taking time answering me.
Regards,

        Pierre-E

-----Message d'origine-----
De : Henrik Nordstrom [mailto:hno@squid-cache.org]
Envoy� : samedi 5 mars 2005 03:44
� : SXB6300 Mailing
Cc : squid-users@squid-cache.org
Objet : Re: [squid-users] Tcp connection failed problem

On Fri, 4 Mar 2005, SXB6300 Mailing wrote:

> On every child of one level, I get the message : TCP connection to
> parent/8080 failed

This indicates one of two things:

a) The TCP connection to the parent was refused by the parent.

b) The TCP connection to the parent timed out for some reason.

'a' has a number of sub-alternatives

    - parent overloaded, causing it to stop accepting new connections
(logged)

    - parent temporarily overloaded and too low syn backlog setting in your
OS.

    - parent crashed (logged)

    - parent effectively syn-flooded (usually logged in the system logs,
not the cache.log). This is also related to the syn backlog mentioned
above.

    - firewall between the child and the parent rejecting the request for
some reason. Supricingly often this is the case.

'b' is a bit fuzzier and mostly relates to networking and packet loss.

If you are using linux iptables then watch out for conntrack table
limitations. If this is your problem it will be logged in the system logs
(usually /var/log/messages) on the failing server (can be either of the
two).

> I'm quite worried about this problem because I've seen other person
> having this problem but no clue on how to resolve it.

In Squid's eyes it is a basic network failure.

> What's more, I'd like to load balance our internet proxies but with this
> problem, it's not possible. 'Cause that would say configuring only one
> parent proxy on the children (the virtual address), and as we use
> never_direct on the children, during connection failures that would
> result in a "unable to relay" message for the users.

The childs will try a number of times before giving up, and if you give
them more than one parent then changes are increased significantly that
they will succeed. Unless the problem is local to the childs themselves.
(i.e. conntrack table full or similar).

Regards
Henrik
Received on Mon Mar 07 2005 - 00:24:03 MST