Squid process terminates for no apparent reason.

Palula · 01-21-2008, 07:44 PM

I´m having a problem qith squid.
This never happened before and I´ve been using this Linux machine for about 2 years now.

Somehow the squid process terminates and, because of that, internet surfing stops for all the subnet machines. This problem started to happen recently and for no apparent reason.

I already stopped redirection to port 3128 (squid´s port) to see if the whole connection had been droppped, but no. Everything worked fine when I stopped the redirection. So the problem really is happening to Squid.

Has anybody gone through this problem?

gilead · 01-21-2008, 08:09 PM

Have you checked Squid's logs to see if there's any info there? They're usually in /var/log/squid and the log names are access.log, cache.log and store.log. Also, have a look in /var/log/messages and (if you have it) /var/log/syslog.

Have you checked to see if the Squid process has died?

Code:

$ ps auxf | grep squid | grep -v grep
root     14652  0.0  0.1   8324  2468 ?        Ss   Jan13   0:00 /usr/local/squid/sbin/squid -D
squid    14654  0.0  1.5  28780 24632 ?        S    Jan13   9:34  \_ (squid) -D
squid    14655  0.0  0.0   2800   840 ?        Ss   Jan13   0:00      \_ (unlinkd)
$ sudo netstat -tanp | grep 3128
tcp        0      0 127.0.0.1:3128          0.0.0.0:*               LISTEN     14654/(squid)
tcp        0      0 192.168.1.10:3128       0.0.0.0:*               LISTEN     14654/(squid)

Palula · 01-27-2008, 11:03 AM

Thanks.
The problem was occuring due to low disk space. The squid logs were huge and my HD is small (2GB).

I recently wasn´t able to start the squid process. I cleaned the files touched them to create them again and re-grouped and re-owned the files to squid (system user).

Now I was able to start the process. Hopefully it will continue to work as usual.

Thank you very much.

Palula · 03-31-2008, 07:10 PM

Ok the problems aren't happening anymore. But something is bothering me. Rotations are not working with Squid log files. Consequentially, sooner or later I'll be facing the same problems again.

What should I do to make the logs rotate as usual?

Thanks!

gilead · 03-31-2008, 08:14 PM

How are you doing it at the moment? I have a box running Squid here (not much load and not many users) that uses the following logrotate config file for Squid:

Code:

/var/log/squid/access.log {
    weekly
    rotate 5
    copytruncate
    compress
    notifempty
    missingok
}
/var/log/squid/cache.log {
    weekly
    rotate 5
    copytruncate
    compress
    notifempty
    missingok
}

/var/log/squid/store.log {
    weekly
    rotate 5
    copytruncate
    compress
    notifempty
    missingok
# This script asks squid to rotate its logs on its own.
# Restarting squid with NCSA is a long process and not worth
# doing it just to rotate logs
    postrotate
      /usr/local/squid/sbin/squid -k rotate
    endscript
}

Palula · 03-31-2008, 11:56 PM

Yep! My machine is the same. I don´t have many users on the network.
Is that the config file for rotation? Where should I store it. Is it invocated with cron?
Thanks!

Palula · 04-01-2008, 12:07 AM

Weird thing.
I found an identical configuration file under /etc/logrotate.d/
The problem is that Squid´s log files aren´t rotating.
Any help is appreciated.
Thanks!

gilead · 04-01-2008, 12:30 AM

Have you tried running logrotate with the -d switch (debug mode)? It may give a clue as to what is happening. It's worth checking the status file (default is /var/lib/logrotate/status) to see if the squid logs are there.

Also, in your squid.conf file, do you have the following line?

Code:

logfile_rotate 0

Palula · 04-01-2008, 12:43 AM

I just did that and I can see squid is not being activated.
Here is the verbose display of the command:

Code:

reading config file /etc/logrotate.conf
including /etc/logrotate.d
reading config file acpid
reading config info for /var/log/acpid
reading config file cups
reading config info for /var/log/cups/*_log
reading config file httpd
reading config info for /var/log/httpd/*log
reading config file mgetty
reading config info for /var/log/mgetty.log.tty[^.] /var/log/mgetty.log.tty[^.][^.] /var/log/mgetty.log.tty[^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.unknown /var/log/mgetty.callback
reading config file mysqld
reading config info for /var/log/mysqld.log
reading config file ppp
reading config info for /var/log/ppp/connect-errors
reading config file psacct
reading config info for /var/account/pacct
reading config file rpm
reading config info for /var/log/rpmpkgs
reading config file samba
reading config info for /var/log/samba/*.log
reading config file snmpd
reading config info for /var/log/snmpd.log
reading config file snort

My squid.conf has logfile_rotate 5

And here are the lines that refer squid in var/lib/logrotate.status:

Code:

logrotate state -- version 2
"/var/log/squid/access.log" 2007-3-18
"/var/log/squid/cache.log" 2007-3-18
"/var/log/squid/store.log" 2007-3-18

gilead · 04-01-2008, 10:26 PM

If you're using logrotate you should have logfile_rotate set to 0 - that may fix the problem but I haven't tested a set up where logrotate rotates the logs and the squid tries to rotate the logs (which it will do with a non zero value in logfile_rotate).

Palula · 04-01-2008, 11:05 PM

But I´ll try it anyway!
I´ll wait a week to see if it works.

The weird thing is that it was working flawlessly...
I don´t even know what trigdered the problem. Suddenly it stopped working.

gilead · 04-02-2008, 09:39 PM

When Squid first stopped working (after the hard disk became full), did any errors occur? It may be worth running fsck over the partition.

Palula · 04-11-2008, 09:39 AM

Still not working.

And when the problem started, I ran FSCK. Literally at the next boot.