Re: [squid-users] ntlmauthenticator processes busy

Billy Macdonald wrote:

> Marco Berizzi wrote:
>
> > Hello everybody.
> > This morning squid-2.5STABLE6 has crashed because
> > all ntlm authenticator processes were busy. This is
> > the relevant log's part:

> > 10:24:37| WARNING: All ntlmauthenticator processes are busy.
> > 10:24:37| WARNING: up to 199 pending requests queued
> > 10:24:37| Consider increasing the number of ntlmauthenticator
processes
> > to at least 239 in your config file.
> > 10:24:50| storeDirWriteCleanLogs: Starting...
> > 10:24:50| WARNING: Closing open FD 6
> > 10:24:50| Finished. Wrote 0 entries.
> > 10:24:50| Took 0.0 seconds ( 0.0 entries/sec).
> > FATAL: Too many queued ntlmauthenticator requests (201 on 40)
> > Squid Cache (Version 2.5.STABLE6): Terminated abnormally.
> >
> > I don't understand why there are so many pending
> > requests queued (up to 199?!?!): there are only
> > 10 clients connected to squid.
> >
> > Is there any way to find the crazy system doing
> > this crap from squid's logs? Increasing cache.log
> > level perhaps?
>
> Could you possibly have had issues with your domain controllers where
> the helper was hanging trying to connect to it and requests to browse
> the web just piled up instead of being denied or allowed?

DC is Windows NT 4.0sp6a Terminal server edition, uptime 1200hours,
eventlog is clean. Squid and the DC (it is a backup DC) are LAN
100mbit/s wired, so there shouldn't be connectivity problem.
I think the problem are some virused systems or some kind of
software trying to connect to the internet without user input
(webshot, antivirus autoupdate...).

Feature request: could squid logs the machine hostname or ip address
doing the authentication request?
Received on Wed Sep 15 2004 - 02:14:42 MDT