Proxy Server stops after a few days

[Pedro d'Alte]

I'm running Redhat 9 with the squid 2.5 rpm. After some days of use squid stops working.
I only notested this problem after the server increased it's clients and I had already seen this happening on another machine with RedHat8 (i think that squid was 2.4).
I can ping the Internet and the local network, but can't access internet hosts through telnet, ftp or http.
Restarting the network and squid services and stopping iptables don't solve the problem, only rebooting the server does.
Anyone with similar problem?
Thanks,
Pedro.

[Vitaly Karasik_1]

I'm running SUID 2.4Stable6-1.7.2 on RH 7.3 without problem.

do you see something in messages/squid logs?


did you tune kernel?


Regards,
Vitaly

[Jerome Henry]

I had this once because I had a wrong config in conf page and a too small cache size on my disk.
Check disk space (and quotas), and as Vitaly said, look for log messages, it'll tell you why, if it's not clear, send the log here.
J

[Ralf Puchner]

Why not looking into the log files of squid an the system? So we must not shoot in the dark....

[Shannon Petry]

squid will stop for a great number of reasons, most related to system security and integrity.

The squid log will explicitly tell you why it stopped. I have had this when...

Disk space for cache/logs is full
Process table was full so squid could not fork
Excessive system resources exausted (CPU, I/O, Memory, etc...)

In every case, the squid logs will told me exactly why it stopped, so I knew what to fix.

Someone/something started a 2nd squid.

If you look at squids logs, you will see what needs to be fixed.

Regards,
Shannon

[Pedro d'Alte]

Well, obviously the first thing I checked was squid log files and syslog, which reported nothing that could be related to the problem.
That's why it's being difficult to find out why it's happening.

I'm using the default kernel. Should I do any specific kernel configuration? I've installed many squid servers and this is the first time I see this happening...

[Shannon Petry]

When you start start squid, and it works you will see no errors.

After squid dies, if you manually try to start it, what does squid say for the error?

And as to the kernel, you should never have to do anything with it for squid to run.

Regards,S
Shannon

[Jerome Henry]

Look also at squid's last logs, I suppose it tells you number of clients increase, but maybe also sth more.
Same as Shannon on messages upon manual restart.
By the way, if this is no trouble for you, check your users and see who has rights on it, and change your root passwd, along with checking processes such as adore module or things like that.
I am not paranoid usually (sun is shinning on a war monday afternoon here), but last time I had a daemon stopping without any log, someone had an hand on it, and was deleting logs. Who can you trust nowadays ?

[Pedro d'Alte]

Well, maybe I didn't explain myself as I should.
The squid daemon is not stopping and the log files are recording the occuring events. I believe that squid may not be the problem.

Whats happening is that network connections stop working (only timeout event is recorded on squid log).

For example, after the users report that the Internet is not working, if I try to telnet port 25 of any mail server from the linux box, the connection fails. The same if I request a webpage. On the other hand if I try to ping an Internet host, I get the replies correctly.

If I stop and start the network service or ifdown/ifup the network interfaces and reset the iptables to ACCEPT ALL policy, I continue to have the same problem.

Only rebooting solves the problem.

Pedro.

[Stuart Browne]

So it's got nothing to do with the software or the OS on the system, but with the hardware.

Want to tell us what hardware you are using?

Also tell us what driver your NIC is using.

Do you have more than one NIC? Do you have interfaces coming up/down?

[Pedro d'Alte]

The network drivers it-s loading are 3c509 (eth1 / router network)and 3c59x (eth0 /local network).

I forgot to test the access to the local network resources to see if I have the same problems that I have while accessing external hosts... gotta way for the next crash.

I didn't think it was a hardware problem, because I had seen this exact problem on another server... until now that I notested that the outside NIC is the 3c509 on both servers.

This card driver could be the problem... anyone working with this card with the same trouble?

Pedro.

[Ralf Puchner]

Have you checked if the DNS is still working during the problem occurs? What is netstat telling us?

[Jerome Henry]

I feel Stuart meant driver prob linked to hardware. He was right, definetly. This 3c509 (which release ?) has a long hsitory of trouble, you'll get complete list here :
http://bugzilla.redhat.com/bugzilla/buglist.cgi?bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=NEEDINFO&bug_status=MODIFIED&bug_status=CLOSED&field0-0-0=product&type0-0-0=substring&value0-0-0=3c509&field0-0-1=component&type0-0-1=substring&value0-0-1=3c509&field0-0-2=short_desc&type0-0-2=substring&value0-0-2=3c509&field0-0-3=status_whiteboard&type0-0-3=subs...
It is said to be supported up to rh8.0, but so many troubles that it is not on the hardware compatibility list of rh9.0 : check here :
http://www.redhat.com/software/linux/technical/hcl/
Sad news, he ? Good news is that it's said to be compatible with older versions, but many troubles still were found...
Time to change your NIC ?
J

[Ralf Puchner]

Jerry,

the 3Com cards are well known as a "problem" since introduction of the altavista firewall ;-)

But as I read from the first posting, the problem is not network related at all, only the proxy stopped. So it is essential to test if all of the network communication was interrupted. So what we need are facts like DNS testings, netstat statistiks etc.....