On Wed, 30 Mar 2005, dwi amk wrote:
> What I don't understand that is that it happens recently, I never
> experience like this before. If Henrik said this not DNS related at
> all, then I suspect it's worm or something alike.
Could be a worm. Could also be one of your users doing something slightly
differently, or using a "download accelerator" or the like.
> If so how to prevent something like this happening, I put in ACL all
> things around how to deny or even tcp_reset worm,spam or alike that i
> found from searching.
You can use access.log and cachemgr to try to identify what requests are
causing this problem.
As I said, if the problem is due to some requests building up in Squid
then you should see them logged in access.log when your restart Squid
after detecting the problem, easily identifiable by
a) Log timestamp at the time Squid was shut down.
b) Very long response time
Regards
Henrik
Received on Wed Mar 30 2005 - 11:01:45 MST
This archive was generated by hypermail pre-2.1.9 : Fri Apr 01 2005 - 12:00:03 MST