Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am not a squid expert and I would like to ask you for your opinion. I have gateway running debian 7.1 wheezy with Squid 2.7.STABLE9-4.1 installed. Then I have a server running Windows 2000 (this one resides in local network). On this server our accounting website is running. Finally I have Ubuntu (13.10) workstation with system wide proxy set up for the squid. Workstation use squid for access to internet as well as for localnet.

When I try to connect to main page on windows server I can see TCP_MISS/200 on squid for the page. This one is retrieved but all resources it contains (css,js,images) are retrieved with TCP_MISS/304. I inspect whole page request/response process in web inspector (on one of the workstations) and all resources of main page (which are hitting TCP_MISS/304 in squid) show me this error page:

The requested URL could not be retrieved.The following error was 
encountered while trying to retrieve the URL: http://server1:82/MWL/C1_MWL_7_0.css 
This cache is in the process of shutting down and can not service 
your request at this time. Please retry your request again soon.

Access for internet sites is working fine. As well as access for our other internal webservers. For these squid is also returning TCP_MISS/304 in logs but whole content with resources is displayed correctly. I don't need cache, squid is used mainly for restriction of users for internet.

Here is my squid config:

http_port 3128
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
maximum_object_size 10000 KB
cache_dir ufs /var/spool/squid 3800 16 256
cache_access_log /var/log/squid/access.log
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl localnet src 192.168.1.0/255.255.255.0
acl SSL_ports port 443 563
acl Safe_ports port 80          # http
acl Safe_ports port 81          # test web
acl Safe_ports port 21          # ftp
acl Safe_ports port 443 563     # https, snews
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl Safe_ports port 82          # accounting
acl Safe_ports port 901         # SWAT
acl purge method PURGE
acl CONNECT method CONNECT
acl restricteddomains dstdomain ... restricted_domains_here...
acl timeoutdomains dstdomain ... timeout domains here ...
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny baddomains
http_access allow localnet
http_access allow localhost
always_direct allow localnet
no_cache deny localnet
http_access deny all
icp_access allow all
error_directory /usr/share/squid/errors/German
delay_pools 2
delay_class 1 1
delay_class 2 1
delay_access 1 allow timeoutdomains
delay_access 1 deny all
delay_access 2 allow restricteddomains
delay_access 2 deny all
delay_parameters 1 1/1
delay_parameters 2 1200/1200

Here is what I get in /var/log/squid/access.log when I acces both resources from both servers:

1395965664.497      2 192.168.1.8 TCP_MISS/304 394 GET http://server1:82/MWL/C1_MWL_7_0.css - DIRECT/192.168.1.110 text/css <-- here error is throw in web inspector

1395965705.776    825 192.168.1.8 TCP_MISS/304 343 GET http://server2/backuppc/image/BackupPC_stnd.css - DIRECT/192.168.1.104 - <-- content of this response is retrieved correctly

My /var/log/squid/store.log is signalling that object is not even saved on disk and used only from memory. So I persume there is no caching in this case which is fine.

My question is: Why for one server isn't response loaded correctly(with error message - see above) and for second one is? Am I missing something in configuration.

If I understand it right TCP_MISS/304 means that server's resource has not been modified and squid is not holding it in its own cache. So the browser must use its own cache. If it contains nothing browser submit If-Modified-Since request which will forward to the server.If the object hasn't been modified, it'll get a 304, which Squid will pass on to your browser.

Most interesting is that resources from 2nd server are loaded properly without any errors and with TCP_MISS/304 as well. On the other side windows server pop ups cache shutting down error and only main page is loaded correctly and its resources not (also with TCP_MISS/304). Permission for cache folders and files are correct.

Here is cache.log for particular request for css file of accounting app which should be loaded but it is not. I added only last part from it because it is quite long (I've used debug_options ALL,5 - quite verbse).

    enter code here2014/03/31 12:29:27| The reply for GET http://192.168.1.110:82/MWL/C1_MWL_7_0.css is ALLOWED, because it matched 'all'
2014/03/31 12:29:27| comm_write: FD 18: sz 394: hndl 0xb76e2160: data 0xba0d7be8.
2014/03/31 12:29:27| cbdataLock: 0xba0d7be8
2014/03/31 12:29:27| commSetSelect: FD 18 type 2
2014/03/31 12:29:27| cbdataUnlock: 0xba0d7be8
2014/03/31 12:29:27| cbdataUnlock: 0xba10bbf0
2014/03/31 12:29:27| commSetTimeout: FD 19 timeout -1
2014/03/31 12:29:27| commSetSelect: FD 19 type 1
2014/03/31 12:29:27| comm_remove_close_handler: FD 19, handler=0xb770a6d0, data=0xba0136a8
2014/03/31 12:29:27| cbdataUnlock: 0xba0136a8
2014/03/31 12:29:27| fwdUnregister: http://192.168.1.110:82/MWL/C1_MWL_7_0.css
2014/03/31 12:29:27| comm_remove_close_handler: FD 19, handler=0xb76f7600, data=0xba0d4ca8
2014/03/31 12:29:27| cbdataUnlock: 0xba0d4ca8
2014/03/31 12:29:27| pconnNew: adding 192.168.1.110:82
2014/03/31 12:29:27| commSetSelect: FD 19 type 1
2014/03/31 12:29:27| commSetTimeout: FD 19 timeout 60
2014/03/31 12:29:27| pconnPush: pushed FD 19 for 192.168.1.110:82
2014/03/31 12:29:27| fwdComplete: http://192.168.1.110:82/MWL/C1_MWL_7_0.css
        status 304 <-- Here is 304 status again 
2014/03/31 12:29:27| fwdReforward: http://192.168.1.110:82/MWL/C1_MWL_7_0.css?
2014/03/31 12:29:27| fwdReforward: No, ENTRY_FWD_HDR_WAIT isn't set <-- could this be a cause
2014/03/31 12:29:27| fwdComplete: not re-forwarding status 304
2014/03/31 12:29:27| storeComplete: 'D2A230B5335F30795536F3F73AE9FEAE'
2014/03/31 12:29:27| storeEntryValidLength: Checking 'D2A230B5335F30795536F3F73AE9FEAE'
2014/03/31 12:29:27| storeEntryValidLength:     object_len = 229
2014/03/31 12:29:27| storeEntryValidLength:         hdr_sz = 229
2014/03/31 12:29:27| storeEntryValidLength: content_length = 0
2014/03/31 12:29:27| InvokeHandlers: D2A230B5335F30795536F3F73AE9FEAE
2014/03/31 12:29:27| InvokeHandlers: checking client #0
2014/03/31 12:29:27| fwdStateFree: 0xba0d4ca8
2014/03/31 12:29:27| storePendingNClients: returning 1
2014/03/31 12:29:27| storeUnlockObject: (forward.c:119): key 'D2A230B5335F30795536F3F73AE9FEAE' count=3
2014/03/31 12:29:27| cbdataFree: 0xba0d4ca8
2014/03/31 12:29:27| cbdataFree: Freeing 0xba0d4ca8
2014/03/31 12:29:27| storeUnlockObject: (http.c:75): key 'D2A230B5335F30795536F3F73AE9FEAE' count=2
2014/03/31 12:29:27| cbdataFree: 0xba0136a8
2014/03/31 12:29:27| cbdataFree: Freeing 0xba0136a8
2014/03/31 12:29:27| comm_select: timeout 424
2014/03/31 12:29:27| do_comm_select: 1 fds ready
2014/03/31 12:29:27| commHandleWrite: FD 18: off 0, hd 0, sz 394.
2014/03/31 12:29:27| commHandleWrite: write() returns 394
2014/03/31 12:29:27| cbdataValid: 0xba0d7be8
2014/03/31 12:29:27| clientWriteComplete: FD 18, sz 394, err 0, off 229, len 229
2014/03/31 12:29:27| clientWriteComplete: FD 18 transfer is DONE
2014/03/31 12:29:27| clientWriteComplete: FD 18 Keeping Alive
2014/03/31 12:29:27| clientKeepaliveNextRequest: FD 18
2014/03/31 12:29:27| httpRequestFree: http://192.168.1.110:82/MWL/C1_MWL_7_0.css
2014/03/31 12:29:27| cbdataLock: 0xb927b778
2014/03/31 12:29:27| cbdataLock: 0xba039ab8
2014/03/31 12:29:27| cbdataUnlock: 0xba039ab8
2014/03/31 12:29:27| cbdataUnlock: 0xb927b778
2014/03/31 12:29:27| cbdataFree: 0xba00ee30
2014/03/31 12:29:27| cbdataFree: Freeing 0xba00ee30
2014/03/31 12:29:27| storeClientUnregister: called for 'D2A230B5335F30795536F3F73AE9FEAE'
2014/03/31 12:29:27| storePendingNClients: returning 0
2014/03/31 12:29:27| storeUnlockObject: (store_client.c:575): key 'D2A230B5335F30795536F3F73AE9FEAE' count=1
2014/03/31 12:29:27| cbdataFree: 0xba10bbf0
2014/03/31 12:29:27| cbdataFree: Freeing 0xba10bbf0
2014/03/31 12:29:27| storeUnlockObject: (client_side.c:1271): key 'D2A230B5335F30795536F3F73AE9FEAE' count=0
2014/03/31 12:29:27| storePendingNClients: returning 0
2014/03/31 12:29:27| storeRelease: Releasing: 'D2A230B5335F30795536F3F73AE9FEAE'
2014/03/31 12:29:27| destroy_StoreEntry: destroying 0xb9f52fb0
2014/03/31 12:29:27| ctx: enter level  0: 'http://192.168.1.110:82/MWL/C1_MWL_7_0.css'
2014/03/31 12:29:27| destroy_MemObject: destroying 0xba1a3478
2014/03/31 12:29:27| ctx: exit level  0
2014/03/31 12:29:27| cbdataFree: 0xba0d7be8
2014/03/31 12:29:27| cbdataFree: 0xba0d7be8 has 1 locks, not freeing
2014/03/31 12:29:27| clientKeepaliveNextRequest: FD 18 reading next req
2014/03/31 12:29:27| commSetTimeout: FD 18 timeout 120
2014/03/31 12:29:27| clientReadRequest: FD 18: reading request...
2014/03/31 12:29:27| clientReadRequest: FD 18: no data to process ((11) Resource temporarily unavailable)
2014/03/31 12:29:27| cbdataLock: 0xba039ab8
2014/03/31 12:29:27| cbdataValid: 0xba039ab8
2014/03/31 12:29:27| cbdataValid: 0xba039ab8
2014/03/31 12:29:27| cbdataUnlock: 0xba039ab8
2014/03/31 12:29:27| commSetSelect: FD 18 type 1
2014/03/31 12:29:27| cbdataUnlock: 0xba0d7be8
2014/03/31 12:29:27| cbdataUnlock: Freeing 0xba0d7be8
2014/03/31 12:29:27| comm_select: timeout 424
2014/03/31 12:29:27| do_comm_select: 1 fds ready
2014/03/31 12:29:27| clientReadRequest: FD 18: reading request...
2014/03/31 12:29:27| cbdataLock: 0xba039ab8
2014/03/31 12:29:27| cbdataValid: 0xba039ab8

I hope I didn't forget something.

Thanks a lot for your efforts and feedback

share|improve this question
    
What version of Squid are you using? (squid -v will show you). Is it the same on both proxies? –  Paul Haldane Mar 30 at 16:54
    
Does anything appear in /var/log/squid/cache.log on the proxy which doesn't work? Is squid restarting on that box? it may be that squid is repeatedly crashing and the message about shutting down is correct. Have you tried restarting squid (or the whole box if that's an option)? –  Paul Haldane Mar 30 at 16:56
    
Hi Paul. Thx for your answer. I am using 2.7.STABLE9-4.1 (quite old I know but it works so far). We are using only one proxy wich also serves as gateway. Workstations also use it for accessing internal web services on our LAN (such as CUPS, backuppc, accounting...) I have added part of cache.log above with request for css file which is not working. Proxy seems to be stable we have no issues with stability. There is certainly no restarting issues. I have also restarted squid several times. Thank you very much for your cooperation. –  zami Mar 31 at 10:52

1 Answer 1

you have GET http://server1:82/MWL/C1_MWL_7_0.css that is a request to server1 on port 82, but in squid config http_access deny !Safe_ports says to deny access to any other than safe ports.

Add port 82 as safe port also and squid -k reconfigure or restart squid.

share|improve this answer
    
Hi titus. Port 82 is allowed. If it wouldn't I would get access denied page from proxy server. For example port 631 for CUPS is also working. But I tried to allow port 82 explicitly and it didn't help.Thx –  zami Mar 31 at 22:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.