Hi all,
I'm testing SSLBump and Squid eats up all my CPU, maybe I made something wrong
or maybe some updates are required ? Any advice would be greatly appreciated.
Debian 8.10 64 bits, Squid 3.5.27 + 64 Go ram + SSD + 15 Cores Xeon(R) CPU
E5-2637 v2 @ 3.50GHz
FI, I don't see anything about limit reached in kern.log (File descriptor or
network)
acl nobump dstdomain "/home/squid/domains" -> Some very used websites (google,
fb, etc) otherwise the system dies after less 1 minute
http_port 3128 ssl-bump cert=/etc/squid/ca_orion/cert
generate-host-certificates=on dynamic_cert_mem_cache_size=500MB
sslcrtd_program /usr/lib/squid/ssl_crtd -s /usr/lib/squid/ssl_db -M 100MB
sslcrtd_children 2000 startup=100 idle=20
sslproxy_capath /etc/ssl/certs/
sslproxy_foreign_intermediate_certs /etc/squid/ssl_certs/imtermediate.ca.pem
acl step1 at_step SslBump1
ssl_bump peek step1 all
ssl_bump splice nobump
ssl_bump bump all
The sslcrtd_children increases quickly and permanently
root@proxyorion5:/tmp# ps -edf | grep ssl | wc -l
1321
root@proxyorion5:/tmp# ps -edf | grep ssl | wc -l
1341
root@proxyorion5:/tmp# ps -edf | grep ssl | wc -l
1341
root@proxyorion5:/tmp# ps -edf | grep ssl_crt | wc -l
1380
root@proxyorion5:/tmp# ps -edf | grep ssl_crt | wc -l
1381
root@proxyorion5:/tmp# ps -edf | grep ssl_crt | wc -l
1382
root@proxyorion5:/tmp# ps -edf | grep ssl_crt | wc -l
1395
Of course after a while 2000 is reached and the system becomes completely mad,
but I already tried 200, 500, 1000, etc
Right after squid start CPU and load average values are very, very, high
top - 16:06:17 up 13 days, 2:46, 3 users, load average: 102,02, 56,67, 30,75
Tasks: 1964 total, 3 running, 1961 sleeping, 0 stopped, 0 zombie
%Cpu(s): 15,3 us, 3,7 sy, 0,0 ni, 80,2 id, 0,4 wa, 0,0 hi, 0,4 si, 0,0 st
KiB Mem: 66086692 total, 52378248 used, 13708444 free, 2899764 buffers
KiB Swap: 1952764 total, 0 used, 1952764 free. 32798948 cached Mem
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
23711 squid 20 0 3438832 2,976g 13784 R 100,0 4,7 6:01.02 squid
23724 squid 20 0 24868 8552 4340 S 3,6 0,0 0:02.46 ssl_crtd
23712 squid 20 0 25132 8896 4428 R 3,0 0,0 0:02.62 ssl_crtd
23714 squid 20 0 24868 8556 4344 S 2,3 0,0 0:02.43 ssl_crtd
23716 squid 20 0 24868 8636 4428 S 2,3 0,0 0:02.26 ssl_crtd
23720 squid 20 0 24868 8612 4400 S 2,3 0,0 0:02.58 ssl_crtd
23771 squid 20 0 24868 8580 4368 S 2,0 0,0 0:01.86 ssl_crtd
23780 squid 20 0 24872 8484 4268 S 2,0 0,0 0:01.86 ssl_crtd
23787 squid 20 0 24868 8612 4404 S 2,0 0,0 0:01.92 ssl_crtd
The same system without SSLBump and e2guardian (web filtering) added (I tried
without more or less 10% CPU )
Tasks: 304 total, 2 running, 302 sleeping, 0 stopped, 0 zombie
%Cpu(s): 2,0 us, 1,1 sy, 0,0 ni, 95,9 id, 0,1 wa, 0,0 hi, 0,9 si, 0,0 st
KiB Mem: 66086700 total, 65627952 used, 458748 free, 2652264 buffers
KiB Swap: 1952764 total, 20884 used, 1931880 free. 32639208 cached Mem
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
20389 e2guard+ 20 0 0,122t 1,133g 6144 S 28,6 1,8 191:06.50 e2guardian
20283 squid 20 0 21,761g 0,021t 8128 R 24,2 34,0 145:00.09 squid
101 root 20 0 0 0 0 S 1,3 0,0 19:05.09 kswapd1
100 root 20 0 0 0 0 S 1,0 0,0 22:41.82 kswapd0
8 root 20 0 0 0 0 S 0,7 0,0 68:49.48 rcu_sched
24 root 20 0 0 0 0 S 0,3 0,0 8:37.14 ksoftirqd/3
65 root 20 0 0 0 0 S 0,3 0,0 8:05.02
ksoftirqd/11
929 root 20 0 71928 6984 4716 S 0,3 0,0 17:53.57 syslog-ng
8069 root 20 0 0 0 0 S 0,3 0,0 0:22.35 kworker/0:0
16624 root 20 0 25868 3236 2592 R 0,3 0,0 0:00.19 top
20291 squid 20 0 59504 5228 4568 S 0,3 0,0 0:03.41 digest_
FredB
_______________________________________________
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users
