[squid-users] help interpreting logs

OK, I need some help interpreting my log files. Squid stopped because my
cache.log file was too big (thanks to a code red node filling it up with
requests to worm.com).

What I don't understand is WHY. I had tons of free inodes and tons
of disk space (both in the squid-cache raid partition and on the
log partition). The cache.log got to about 1.7Gb.

How do I fix it? I don't want to fail next time I get a code red station
going through it.

Box particulars:
768Mb RAM, 700Mhz Athalon, Red Hat 6.2 (Kernel 2.2.14-5.0)
running squid-2.3.STABLE4, five 18Gb u2w scsi disks

All ideas are appreciated (And I just noticed my shortage on file
descriptors, I edited the header file log ago, but apparently I
forgot to recompile the kernel).

- John

-------------
/var/log/messages
-------------
Aug 15 09:05:36 munin squid[26326]: Squid Parent: child process 26327 started
Aug 15 09:05:36 munin (squid): Write failure -- check your disk space and cache.log
Aug 15 09:05:36 munin squid[26326]: Squid Parent: child process 26327 exited with status 1
Aug 15 09:05:39 munin squid[26326]: Squid Parent: child process 26343 started
Aug 15 09:05:39 munin (squid): Write failure -- check your disk space and cache.log
Aug 15 09:05:39 munin squid[26326]: Squid Parent: child process 26343 exited with status 1

-------------
/var/log/squid/cache.log
-------------
2001/08/15 09:05:48| Starting Squid Cache version 2.3.STABLE4 for i686-pc-linux-gnu...
2001/08/15 09:05:48| Process ID 26393
2001/08/15 09:05:48| With 1024 file descriptors available
2001/08/15 09:05:48| DNS Socket created on FD 1
2001/08/15 09:05:48| Adding nameserver 152.13.1.1 from /etc/resolv.conf
2001/08/15 09:05:48| Adding nameserver 152.13.1.20 from /etc/resolv.conf
2001/08/15 09:05:48| Adding nameserver 152.13.1.10 from /etc/resolv.conf
2001/08/15 09:05:48| helperOpenServers: Starting 15 'squid.krb.auth' processes
2001/08/15 09:05:48| Unlinkd is disabled
2001/08/15 09:05:48| Swap maxSize 43008000 KB, estimated 3308307 objects
2001/08/15 09:05:48| Target number of buckets: 66166
2001/08/15 09:05:48| Using 131072 Store buckets
2001/08/15 09:05:48| Max Mem size: 131072 KB
2001/08/15 09:05:48| Max Swap size: 43008000 KB
2001/08/15 09:05:48| Using LFUDA disk replacement policy
2001/08/15 09:05:48| Rebuilding storage in /var/spool/squid (DIRTY)
2001/08/15 09:05:48| Set Current Directory to /var/spool/squid
2001/08/15 09:05:48| diskHandleWrite: FD 18: disk write error: (27) File too large
FATAL: Write failure -- check your disk space and cache.log
Squid Cache (Version 2.3.STABLE4): Terminated abnormally.
CPU Usage: 0.070 seconds = 0.020 user + 0.050 sys
Maximum Resident Size: 0 KB
Page faults with physical i/o: 303
Memory usage for squid via mallinfo():
        total space in arena: 2219 KB
        Ordinary blocks: 2206 KB 3 blks
        Small blocks: 0 KB 0 blks
        Holding blocks: 692 KB 2 blks
        Free Small blocks: 0 KB
        Free Ordinary blocks: 13 KB
        Total in use: 2898 KB 131%
        Total free: 13 KB 1%
============
Received on Mon Aug 20 2001 - 10:40:26 MDT