Re: [squid-users] Squid stopped working after update.

MARK ADAMS wrote:
> Mandriva Linux 2007, Squid Cache: Version 2.6.STABLE1
>
>
> Here's an odd thing: I ran updates on my server after a rather lengthy
> period of not updating -- I hate it when the lying bastage mirrors
> stop working, but anyway...
>
> After this lengthy upgrade, Squid updated to ver. 2.6.STABLE1 and
> stopped working. The process was still up, but when I configured the
> browser to use the proxy, it claimed it couldn't find the proxy I had
> configured.

You might want to start by reading the 2.6 release notes.
http://www.squid-cache.org/Versions/v2/2.6/squid-2.6.STABLE1-RELEASENOTES.html

>
> I looked at the config files and everything seemed okay. I checked
> the logs and it looked like there was a failure related to how it was
> resolving http. I'd like to be more articulate about that error, but
> I punted and uninstalled/reinstalled squid and squidGuard from the
> main_update repositories.
>
> The reinstall went okay and I've modified the new config files so that
> Squid and squidGuard run and should be working fine (when did
> squidGuard become a "url_rewriter_program"?), but now when I point a
> browser to a website under the proxy, it just times out.

Times out how? There are entries in the access.log...

>
> I've tried disabling IP tables on client and server, and disabling
> squidGuard but nothing has helped.
>
> Here's the config:
>
> http_port 3128
> http_port 8080
> hierarchy_stoplist cgi-bin ?
> acl QUERY urlpath_regex cgi-bin \?
> cache deny QUERY
> acl Apache rep_header Server ^Apache
> broken_vary_encoding allow apache
> access_log /var/log/squid/access.log squid
> url_rewrite_program /usr/bin/squidGuard -d -c /etc/squid/squidGuard.conf
> refresh_pattern ^ftp: 1440 20% 10080
> refresh_pattern ^gopher: 1440 0% 1440
> refresh_pattern . 0 20% 4320
> acl all src 0.0.0.0/0.0.0.0
> acl manager proto cache_object
> acl localhost src 127.0.0.1/255.255.255.255
> acl to_localhost dst 127.0.0.0/8
> acl SSL_ports port 443 563
> acl Safe_ports port 80 # http
> acl Safe_ports port 21 # ftp
> acl Safe_ports port 443 563 # https, snews
> acl Safe_ports port 70 # gopher
> acl Safe_ports port 210 # wais
> acl Safe_ports port 1025-65535 # unregistered ports
> acl Safe_ports port 280 # http-mgmt
> acl Safe_ports port 488 # gss-http
> acl Safe_ports port 591 # filemaker
> acl Safe_ports port 777 # multiling http
> acl CONNECT method CONNECT
> acl mynetwork src 192.168.1.0/255.255.255.0
> acl alexa src "/etc/squid/bad_1s"
> http_access allow manager localhost
> http_access deny manager
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports
> http_access allow mynetwork
> acl our_networks src 192.168.1.0/24
> http_access allow our_networks

This is redundant. You've already defined "mynetwork" as a src ACL of
the same IP block. I can't see it causing problems, but it's extraneous.

> http_access allow localhost

Even though the "http_access deny all" is implicit (given that your last
http_access line is an allow) it's not a bad idea to make it explicit.

> http_reply_access allow all
> icp_access allow all
> cache_effective_user squid
> cache_effective_group squid
> visible_hostname shuttle.adams-lan.local
> deny_info ERR_CUSTOM_ACCESS_DENIED mynetwork

I don't think this will be used, as the mynetwork ACL is not used in a
deny context. Then again, without an explicit http_access deny all,
that might just work.

> coredump_dir /var/spool/squid
>
> Logs don't seem to be showing much about squid that I can see:
SNIP

Squid logs nothing to syslog by default.

> # tail access.log
> 1175798813.718 1754 192.168.1.100 TCP_MISS/200 4806 GET
> http://www.fulldls.com/rss.php - DIRECT/66.29.9.69 text/xml
> 1175798822.053 2088 192.168.1.100 TCP_MISS/200 10020 GET
> http://www.squid-cache.org/mailing-lists.html - DIRECT/12.160.37.9
> text/html
> 1175799083.226 498 192.168.1.100 TCP_MISS/302 785 GET
> http://fxfeeds.mozilla.org/rss20.xml - DIRECT/63.245.209.21 text/html
> 1175799083.828 600 192.168.1.100 TCP_REFRESH_MISS/200 13460 GET
> http://newsrss.bbc.co.uk/rss/newsonline_world_edition/front_page/rss.xml
> - DIRECT/212.58.240.130 application/xml
> 1175799295.144 419 192.168.1.100 TCP_MISS/200 5791 GET
> http://login.yahoo.com/config/login? - DIRECT/209.191.92.114 text/html
> 1175799295.458 314 192.168.1.100 TCP_MISS/302 1185 POST
> http://login.yahoo.com/config/login - DIRECT/209.191.92.114 text/html
> 1175799295.721 251 192.168.1.100 TCP_MISS/302 587 GET
> http://mail.yahoo.com/ - DIRECT/209.191.92.114 text/html
> 1175799296.402 670 192.168.1.100 TCP_MISS/200 17262 GET
> http://us.f318.mail.yahoo.com/ym/login? - DIRECT/68.142.207.12 text/html
> 1175799304.308 10845 192.168.1.100 TCP_MISS/200 4636 CONNECT
> gmail.google.com:443 - DIRECT/64.233.163.107 -
> 1175799304.503 11041 192.168.1.100 TCP_MISS/200 5532 CONNECT
> gmail.google.com:443 - DIRECT/64.233.163.107 -
>

Here's my confusion. What IP address are you making your tests from?
Obviously 192.168.1.100 is experiencing success using the proxy.

>
>
> # tail store.log

The Store log just shows what objects are being cached and purged.
Nothing useful for this problem.

>
>
> # tail -n 25 cache.log
> 2007/04/05 08:39:58| Initialising SSL.
> 2007/04/05 08:39:58| parseEtcHosts: /etc/hosts: (13) Permission denied

Hmmm... You might want to have a look at this. Why is the hosts file
not world readable?

> 2007/04/05 08:39:58| User-Agent logging is disabled.
> 2007/04/05 08:39:58| Referer logging is disabled.
> 2007/04/05 08:39:58| DNS Socket created at 0.0.0.0, port 1330, FD 8
> 2007/04/05 08:39:58| Adding domain adams-lan.local from /etc/resolv.conf
> 2007/04/05 08:39:58| Adding nameserver 205.171.2.65 from /etc/resolv.conf
> 2007/04/05 08:39:58| Adding nameserver 205.171.3.65 from /etc/resolv.conf
> 2007/04/05 08:39:58| Adding nameserver 192.168.1.105 from
> /etc/resolv.conf
> 2007/04/05 08:39:58| Accepting proxy HTTP connections at 0.0.0.0, port
> 3128, FD 9.
> 2007/04/05 08:39:58| Accepting proxy HTTP connections at 0.0.0.0, port
> 8080, FD 10.
> 2007/04/05 08:39:58| Accepting ICP messages at 0.0.0.0, port 3130, FD 11.
> 2007/04/05 08:39:58| Accepting HTCP messages on port 4827, FD 12.
> 2007/04/05 08:39:58| Accepting SNMP messages on port 3401, FD 14.
> 2007/04/05 08:39:58| WCCP Disabled.
> 2007/04/05 08:39:58| Pinger socket opened on FD 15
> 2007/04/05 08:39:58| Loaded Icons.
> 2007/04/05 08:39:58| eventCleanup
> 2007/04/05 08:39:58| Ready to serve requests.
> 2007/04/05 09:00:24| icmpSend: send: (111) Connection refused
> 2007/04/05 09:00:24| Closing Pinger socket on FD 15
> 2007/04/05 09:22:44| NETDB state saved; 0 entries, 0 msec
> 2007/04/05 10:23:45| NETDB state saved; 0 entries, 0 msec
> 2007/04/05 11:34:43| NETDB state saved; 0 entries, 0 msec
> 2007/04/05 12:28:23| NETDB state saved; 0 entries, 0 msec
>
>
> Anybody know what is oing on here?

Given the evidence presented, not really. The access log gives time in
GMT and the cache log gives time in local time (without specifying what
time zone is used) so there's really no correlating the two. In any
case, Squid appears to be starting, and is serving requests for the
computer at 192.168.1.100. Which indicates to me it's not a direct
problem with Squid.

>
> Thanks.
>
> Mark
>

Chris
Received on Fri Apr 06 2007 - 13:52:51 MDT