Squid 4.14 and helpers use 100% of CPU about squid-windows

[cezaryjk]

[cezaryjk]

Hi again,
And actually, it's working: pages are being served. Maybe a bit slower. And, of course, server becomes not so responsive after "saturation".
Squid service restart (from Squid console: "Stop Squid Service" and "Start...") restores stable conditions for several hours.

Our configuration is a bit complex, but I inherited it from my predecessor. And we have some policies in here as well.
I've been trying to tune it: disabled file cache, increased and changed helpers startup parameter and other. Still no luck...
Now, it looks like that:
VM server:
Hyper-V on Windows Server 2019
Memory: 16GB (dynamic from 8GB to 16GB)
Processor: 4 virtual processors
HDD: Separate for OS and for Squid files (dynamically expanding)

squid.config:
`http_port 3128

dns_nameservers 10.147.x.y 10.147.x.z

#cache_dir aufs /cygdrive/d/squidcachedir/cache 3000 16 256

cache_mem 1 GB
memory_cache_mode always

coredump_dir /var/cache/squid

hierarchy_stoplist cgi-bin ?

acl QUERY urlpath_regex cgi-bin ?
no_cache deny QUERY

auth_param basic program D:/Squid/lib/squid/basic_ldap_auth.exe -b "DC=xxx,DC=yyy,DC=zz" -R -D "CN=ssss,OU=pppp,OU=qqqq,OU=rrrr,DC=uuu,DC=www,DC=xxx" -f (sAMAccountName=%s) -w "password" -h 10.147.d.e -p 389

auth_param basic children 10 startup=5 idle=5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours

refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|?) 0 0% 0
refresh_pattern . 0 20% 4320

acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines

acl INSIDE_IP dst 10.147.x.0/23
acl INSIDE_IP dst 10.147.y.0/23
always_direct allow INSIDE_IP

acl SSL_ports port 443 563 7770 8000

acl Safe_ports port 80 8080 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 563 # snews
acl Safe_ports port 554 # IVMS, RSTP
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

acl blacklist url_regex "D:/Squid/etc/squid/black_new.list"
acl blacklist_proxyuser url_regex "D:/Squid/etc/squid/blackproxy_new.list"
acl whitelist url_regex "D:/Squid/etc/squid/white_new.list"
acl goldlist url_regex "D:/Squid/etc/squid/gold_new.list"
acl windowsupdate dstdomain "D:/Squid/etc/squid/windowsupdate.list"

acl BannedExe url_regex -i .(exe|m3u|mp2|mp3|ra|ram|rm|viv|vivo|vob|vqf|wav|wma|vbs|shs|pif|tar|ace|com)($|?)
acl BannedFiles url_regex -i .(afx|asf|au|avi|divx|exe|m3u|mov|mp2|mp3|mpeg|mpg|qt|ra|ram|rm|viv|vivo|vob|vqf|wav|wma|wmv|vbs|shs|pif|tar|ace|com)($|?)

external_acl_type ldap_group children-startup=10 children-max=15 children-idle=10 %LOGIN D:/Squid/lib/squid/ext_ldap_group_acl.exe -D "CN=ssss,OU=pppp,OU=qqqq,OU=rrrr,DC=uuu,DC=www,DC=xx" -w "password" -b "CN=Users,DC=uuu,DC=www,DC=xx" -f "(&(cn=%g)(member=%u)(objectClass=group))" -F "(sAMAccountName=%s)" -B "DC=uuu,DC=www,DC=xx" -h 10.147.161.209 -p 3268

acl everyone proxy_auth REQUIRED

acl Comp_ProxyUsers external ldap_group SW_Proxy
acl Comp_ProxyUsersYouTube external ldap_group SW_Proxy_YT
acl Comp_ProxyPowerUsers external ldap_group SW_Proxy_PowerUser

http_access allow localhost manager
http_access deny manager

http_access deny !Safe_ports

http_access deny CONNECT !SSL_ports

acl wuCONNECT dstdomain www.update.microsoft.com
acl wuCONNECT dstdomain sls.microsoft.com
acl wuCONNECT dstdomain outlookdiagnostics.azureedge.net

http_access allow CONNECT wuCONNECT localnet

http_access allow windowsupdate localnet

http_access allow goldlist
http_access allow Comp_ProxyPowerUsers !blacklist
http_access allow Comp_ProxyUsersYouTube !blacklist !BannedExe
http_access allow Comp_ProxyUsers !blacklist !BannedFiles !blacklist_proxyuser
http_access allow everyone whitelist
http_access deny blacklist
http_access deny all`

Can you see anything bad in it?
BR
Cezary

[ra-at-diladele-com]

Hello Cezary,

I am very sorry we only package the application into MSI - so can only support issues related to the installation.
I would advise to consult the Squid developers. As a quick test you can deploy our other app (which we do support fully) from https://webproxy.diladele.com/download.html - but it is not squid :(

[cezaryjk]

Hi Rafael,

Sorry to hear that...
All links related to Windows version seems to lead to you...

So, I will try on squid-cache org site.

Maybe somebody had similar issue and will share the solution?
So don't close my case yet, please :)

BR
Cezary