Hello Jenny,
I will comment bellow:
> > Nov 17 15:43:13 02 kernel: Out of socket memory
>
>
> Well, there you go. Here is your problem. You will need to decrease your
> hashsize. I suggest you experiment with conntract max and hashsize nad
> buckets and watch for errors like these.
>
> There are couple of good docs out there explaining kernel memory use with
> conntrack.
[Nataniel Klug] This can be the problem. I made a change to my conntrack
hashsize so it's now double of it's default value (8192*2).
> You can check available port range with:
> cat /proc/sys/net/ipv4/ip_local_port_range
[Nataniel Klug] Ok, I'll look for it.
> And increase it with:
> echo "1024 65535" > /proc/sys/net/ipv4/ip_local_port_range
>
>
> This is for RHEL6, I don't recall if it is the same for RHEL5.
[Nataniel Klug] I made the change over sysctl on boot time. I am not using
1024~65535 in the second try. I set it to 16000~65000 (it has 35k more than
default value).
> Here is a small perl script to log these for post-mortem review. Put it to
cron,
> run every minute as root. Then you can review later.
>
> Your orphans don't look good to me. However, you have nolocalbind and you
> are using tproxy.
[Nataniel Klug] The orphans start to grow when squid start to grow on files
usage it's using more than 25k files and somehow it drop some of the files
and them the orphans grow. It's almost exact amount of "sockets/files"
unused by squid that are orphans.
> I am neither linux, nor perl, nor tproxy, nor tcp expert. Just someone
trying
> to solve her problems. So approach all these with caution, I take no
> responsibility.
>
> Good luck!
>
> Jenny
[Nataniel Klug] No problem Jenny, thank you so much for your help.
Att,
Nataniel Klug
