Re: [squid-users] Re: TCp_HIT problem

Farhad Ibragimov wrote:
> Hello Squid-users,
>
> Dear Squid Guru
>
> I am install new squid 3 days ago . The version is 3.0 15 . The
> problem is that i don't see TCP_HIT (only TCP_MISS) in access log file .
> Configuration file is attached . Please help
>
>
>
> # WELCOME TO SQUID 3.0.STABLE15
> # ----------------------------
> http_port 3128 transparent
> cache_mem 1024 MB
> minimum_object_size 2048 KB

?? looks like your problem. Most of the web traffic you will ever see is
under 2 MB big.
Average size is somewhere between 32KB and 128KB depending on your clients.

... more point to follow....

> icp_port 0
> wccp2_router 85.132.32.20
> visible_hostname "url..."
> url_rewrite_children 20
> cache_dir ufs /cache 6000 16 256
> cache_swap_low 90
> cache_swap_high 95
> allow_underscore on
> request_header_max_size 128 KB

Please do NOT raise this above 64KB in Squid 3.0!
There are a very large number of remote DDoS vulnerabilities that opens
up. The default for each squid version is kept at the largest safe value
we can be sure of.

> client_persistent_connections on
> server_persistent_connections on
> maximum_object_size_in_memory 50 KB
> cache_replacement_policy heap LFUDA
> maximum_object_size 50 MB
> ######LOG################
> access_log /var/squid/logs/access.log squid
> cache_log /var/squid/logs/cache.log
> cache_store_log /var/squid/logs/store.log
> ###############################
> cache_mgr "mail address"
> httpd_suppress_version_string on
> # SNMP OPTIONS
> # -----------------------------------------------------------------------------
> #snmp_port 1161
> #snmp_access allow snmppublic localhost
> #snmp_access deny all
> cache_effective_user squid
> cache_effective_group squid
> ###############################################################
> acl dayaz dstdomain .day.az
> always_direct allow dayaz
> ###############################################################
> refresh_pattern -i \.gif$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.png$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.jpg$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.jpeg$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.pdf$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.zip$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.tar$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.gz$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.tgz$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.exe$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.prz$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.ppt$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.inf$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.swf$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.mid$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.wav$ 43200 100% 43200 override-lastmod override-expire
> refresh_pattern -i \.mp3$ 43200 100% 43200 override-lastmod override-expire
>
> #refresh_pattern ^ftp: 1440 20% 10080
> #refresh_pattern ^gopher: 1440 0% 1440
> refresh_pattern (cgi-bin|\?) 0 0% 0
> #refresh_pattern . 0 20% 4320

Please do not alter the four above. They ensure that your cache is not
vulnerable to cache poisoning attacks or committing them against other
caches.

>
> # ACCESS CONTROLS
> ##############################################################
> acl manager proto cache_object
> acl localhost src 127.0.0.1/32
> acl to_localhost dst 127.0.0.0/8
>
>
> # Example rule allowing access from your local networks.
> # Adapt to list your (internal) IP networks from where browsing
> # should be allowed
> acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
> acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
> acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
> #
> acl SSL_ports port 443
> acl Safe_ports port 80 # http
> acl Safe_ports port 21 # ftp
> acl Safe_ports port 443 # https
> acl Safe_ports port 70 # gopher
> acl Safe_ports port 210 # wais
> acl Safe_ports port 1025-65535 # unregistered ports
> acl Safe_ports port 280 # http-mgmt
> acl Safe_ports port 488 # gss-http
> acl Safe_ports port 591 # filemaker
> acl Safe_ports port 777 # multiling http
> acl CONNECT method CONNECT
>
> # TAG: http_access
> http_access allow manager localhost
> http_access deny manager
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports
> #http_access allow localnet

Something has gone wrong. The above line commented out prevents local
networks from being serviced by this Squid.
I would expect this config to show constant TCP_MISS:DENIED in access.log.

>
> http_access deny all
>
> icp_access deny all
> htcp_access deny all
>
> hierarchy_stoplist cgi-bin ?
>
> # TAG: debug_options
> # Logging options are set as section,level where each source file
> # is assigned a unique section. Lower levels result in less
> # output, Full debugging (level 9) can result in a very large
> # log file, so be careful. The magic word "ALL" sets debugging
> # levels for all sections. We recommend normally running with
> # "ALL,1".
> #
> #Default:
> # debug_options ALL,1
>
> icp_port 0
> htcp_port 0
> log_icp_queries off
>
> allow_underscore on
>
> # WCCPv1 AND WCCPv2 CONFIGURATION OPTIONS
> #wccp_version 4
> # wccp2_rebuild_wait on
> # wccp2_forwarding_method 1
> # wccp2_return_method 1
> # wccp2_assignment_method 1
> # wccp2_service standard 0
> # wccp2_weight 10000
> # wccp_address 0.0.0.0
> # wccp2_address 0.0.0.0
>
> # ERROR PAGE OPTIONS
> # -----------------------------------------------------------------------------
> # error_directory /squid/share/errors/templates
> email_err_data on
>
> client_db on
> coredump_dir /var/squid/cache

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE6 or 3.0.STABLE16
   Current Beta Squid 3.1.0.10 or 3.1.0.11