Re: [squid-users] squid server crash

Neil A. Hillard escribi�:
> Hi,
>
> Emilio Casbas wrote:
>> Neil A. Hillard escribi�:
>>> Hi,
>>>
>>> Slacker wrote:
>>>> Emilio Casbas, on 02/23/2007 03:11 PM [GMT+500], wrote :
>>>>> Hi
>>>>>
>>>>> We have two squid servers as reverse proxys in front of our web servers
>>>>> (squid-2.5Stable10). Both have working right for some months, but today
>>>>> We have found the two servers at the same time down, with a kernel
>>>>> panic
>>>>> error on the screen.
>>>>> The last access.log time in the two servers it was at similar hour, and
>>>>> We didn't found any revelance string in access.log.
>>>>>
>>>>> This is the last line before the crash, but We don't think it's
>>>>> related to.
>>>>>
>>>>> cache.log
>>>>> 2007/02/22 22:41:47| parseHttpRequest: Unsupported method
>>>>> 'oors;c=ES;g=a;a=4;s=1;!category=nrm;dcopt=ist;sz=728x90;ptile=1;ord=300386615346895800?'
>>>>>
>>>>>
>>>>> 2007/02/22 22:41:47| clientReadRequest: FD 840 Invalid Request
>>>>>
>>>>> We have looking for strange patterns in the logs machine too, but We
>>>>> didn't found anything.
>>>>>
>>>> Check the sizes of squid logs files if they are >2 G then rotate them
>>>> with squid -k rotate
>>> The op stated that both boxes had kernel panics which tends to point the
>>> finger at the OS and not Squid. If squid can make the OS kernel panic
>>> then the OS needs fixing.
>>>
>>>> 2Gb logs would cause squid to terminate but shouldn't cause a panic.
>>> Was there anything logged in syslog at the time of the panic?
>>>
>>>
>>> Neil.
>>>
>> The last line on messages log before the crash:
>>
>> Feb 22 22:41:47 servercrash squid[21624]: parseHttpRequest: Unsupported
>> method 'oors;c=ES;g=a;a=4;s=1;!category=nrm;dcopt=ist;sz=728x90;pt
>> ile=1;ord=300386615346895800?'
>> Feb 22 22:41:47 servercrash squid[21624]: clientReadRequest: FD 840
>> Invalid Request
>
> No, you need to check syslog (/var/log/messages perhaps) not the squid
> log (that looks like the output of cache.log). The system may have had
> chance to write something to syslog before it panicked but probably not.
> Otherwise you'd have to check the console but it's a bit late for that now!
>
>
> Neil.
>

Yes Neil, the previous line it was from the /var/log/messages log.
Anyway, nothing strange it was on the messages log before the panicked.

BTW It's my first time in 4 years working with squid, I have seen a
behaviour like this one in the squid servers.

On the console it had a tipical kernel message screen with several trace
calls.

We'll take care these days with this servers.

Thanks
Emilio C.
Received on Fri Feb 23 2007 - 05:39:20 MST