Problem with Squid Proxy

[versatile12]

Hello All,

I'm having serious problem with my proxy server (running Endian Firewall).

The proxy serves about 73 PCs (on a Hotel property). The problem I'm having is that I've realized for the last 2 days there is a service called 'squid-graph' which is running and literally takes up all of the RAM. As a result, the proxy frequently comes to a complete halt therefore preventing users from browsing the net.

Each time I kill the process, it comes back a few mins after.
I DESPERATELY need some help on this one guys. All suggestions are welcome!

 

[chipk]

Have you checked your cache-mem and maximum_object_size parameters in your config file?

http://www.comfsm.fm/computing/squid/FAQ-8.html

How much total RAM do you have, anyway?

 

[versatile12]

I have 768 MB of RAM.

The cache mem (squid.conf) is set to 40 MB.

Also, i realized my access log files grow pretty fast. Earlier today, it grew several MBs in approximately 4 mins.

Any suggestions??

 

[chipk]

Is this for employees, or hotel guests? If for employyes, I'd find out who's doing nothing but surfing the web all day long. You may also have a bot or something on your network if the traffic levels are ridiculously high.

 

[versatile12]

The proxy serves mainly hotel employees (supervisors, sales reps, managers etc).

Indeed there could be a bot on the network keeping the proxy ridculously busy.

In any case, is there a way I could minimize the rapidly growing effect of the squid access.log file? This file grows MBs in minutes. Additionally, squid takes atleast 8-9 mins to load during boot up.

As usual, any advice is highly appreciated!

 

[chipk]

I would focus on tracking down which host is generating this traffic. Been a while since I looked at Squid logs, so can't quite remember where that info is. There is a Squid forum here on Tek-Tips.

 

[jkupski]

Take others suggestions and deal with whatever is causing all the unwanted traffic.

Then, I say: if you don't know what squid-graph is (it aggregates and displays pretty pictures of your proxy usage) I think it's safe to say that you're not using it. Based on the fact that it's respawning, I think it's fair to say that it probably is being called from /etc/inittab. Look for the line that calls it, remove it, then execute an 'init q' to reprocess the inittab.

 

[zeland]

For fast relief, you might consider turning off the execute bit for 'squid-graph' so that it won't get launched. This should buy you some time to poke around your system to figure out how its being launched.

--== Anything can go wrong. It's just a matter of how far wrong it will go till people think its right. ==--