Billy Macdonald wrote: > Marco Berizzi wrote: > > > Hello everybody. > > This morning squid-2.5STABLE6 has crashed because > > all ntlm authenticator processes were busy. This is > > the relevant log's part:
> > 10:24:37| WARNING: All ntlmauthenticator processes are busy. > > 10:24:37| WARNING: up to 199 pending requests queued > > 10:24:37| Consider increasing the number of ntlmauthenticator processes > > to at least 239 in your config file. > > 10:24:50| storeDirWriteCleanLogs: Starting... > > 10:24:50| WARNING: Closing open FD 6 > > 10:24:50| Finished. Wrote 0 entries. > > 10:24:50| Took 0.0 seconds ( 0.0 entries/sec). > > FATAL: Too many queued ntlmauthenticator requests (201 on 40) > > Squid Cache (Version 2.5.STABLE6): Terminated abnormally. > > > > I don't understand why there are so many pending > > requests queued (up to 199?!?!): there are only > > 10 clients connected to squid. > > > > Is there any way to find the crazy system doing > > this crap from squid's logs? Increasing cache.log > > level perhaps? > > Could you possibly have had issues with your domain controllers where > the helper was hanging trying to connect to it and requests to browse > the web just piled up instead of being denied or allowed? DC is Windows NT 4.0sp6a Terminal server edition, uptime 1200hours, eventlog is clean. Squid and the DC (it is a backup DC) are LAN 100mbit/s wired, so there shouldn't be connectivity problem. I think the problem are some virused systems or some kind of software trying to connect to the internet without user input (webshot, antivirus autoupdate...). Feature request: could squid logs the machine hostname or ip address doing the authentication request?