Re: [squid-users] help interpreting logs

John C. Gale wrote:

>>>log partition). The cache.log got to about 1.7Gb.
>>>
>>Sure it wasn't 2GB? Just a thought...
>>
>
> What difference would this make? I'm pretty sure about it being 1.7Gb,
> but I can uncompress it to find out if you think that is important.

Linux 2.2 does not support files larger than 2GB, and will return a disk
full error on the file if it does.

>>Upgrade your kernel to 2.2.16+, there are known issues
>>
>
> I won't argue, but is that related to the problem?

Nope. Just a security suggestion.

>>Edit the file /etc/logrotate.d/squid, and change the 'weekly' line to
>>read 'daily'.
>>
>
> This will certainly treat the symptoms, but will it address the disease?
> I remain ignorant as to what the problem is.

The problem is your log file probably grew too large for your
filesystem. (I'm just guessing, and it may be another problem.)

It depends on whether you actually see enough traffic to generate a 2GB
log file in under a week. The recent Code Red worm problem has led to
much larger cache logs for many of our clients (and in fact I just
assisted a client this morning with tracking down which of his clients
were infected and getting them straightened out--as well as increasing
the frequency of log rotations so as not to ever shutdown Squid again
due to excessive log size).

Log rotation on a heavily loaded cache probably should happen daily.
Red Hat packages assume a pretty mild usage pattern, and only rotate
once a week. We now set all of our boxes to rotate daily, even those
that are seeing mild usage such as in businesses and tiny sub-T1 ISPs
(we also now use some log analyses tools that expect daily logs).

> I must say I'm impressed I got an answer from you. I read your squid
> tuning docs quite a few times. Nice work.

Thanks for your kind words. But Henrik, Adrian and Robert (and Duane
behind the curtain sometimes) are the real Squid nerds around here. I
just poke it and prod it, they make it tick.
                                   --
                      Joe Cooper <joe@swelltech.com>
                  Affordable Web Caching Proxy Appliances
                         http://www.swelltech.com
Received on Mon Aug 20 2001 - 13:09:14 MDT