Topic: HTTPD stop by itself, maybe Squid?

[Paul Wolsink]

Hi there

I have a weird problem. I am running a website with a couple of virtual domains on SME 5.5. It always ran quite well, but recently I had errors where the http for the websites just stopped. The http for the server-manager (hhtpd-admin) keeps on running.

I can't find anything in the logfiles. No errors, noting in the SSL, httpd or Squid except in squid I find the following which may be a clue, but I know to little about Squid to make sense out of it.


Squid Log files when it stopped on two occasions.

ACCESS.LOG  21/3/2003 10h00

 
1047813109.268      1 216.137.3.105 TCP_DENIED/403 1041 CONNECT 64.157.4.84:25 - NONE/- -
1047912812.937     11 62.211.139.199 TCP_DENIED/403 1052 GET http://www.s3.com - NONE/- -
1047916439.094      0 64.159.75.220 TCP_DENIED/403 1041 CONNECT 64.157.4.84:25 - NONE/- -
1048030760.342      9 212.88.169.92 TCP_DENIED/403 1047 CONNECT 207.46.133.140:21 - NONE/- -
1048101587.578      1 216.137.3.105 TCP_DENIED/403 1041 CONNECT 64.157.4.84:25 - NONE/- -
1048154179.520      6 203.217.63.223 TCP_DENIED/403 1075 CONNECT pacific.nsw.au.austnet.org:6667 - NONE/- -
1048195876.807      1 64.191.52.220 TCP_DENIED/403 1041 CONNECT 64.157.4.84:25 - NONE/- -
1048236022.923      1 170.208.15.79 TCP_DENIED/403 1041 CONNECT 64.157.4.84:25 - NONE/- -

--------------------------------------------------------------------------------

STORE.LOG 21/3/2003 10h00

1048235183.916 SWAPOUT 00 0000000D 837C6E6CA87A658D9D748C0368DB7853  200 1048235183 1014406699        -1 image/gif 155/155 GET http://mailsme.webpropsystems.com:3128/squid-internal-static/icons/anthony-script.gif
1048235183.916 SWAPOUT 00 0000000E E95B001D79115138C6E4908AED1B1292  200 1048235183 1014406699        -1 image/gif 156/156 GET http://mailsme.webpropsystems.com:3128/squid-internal-static/icons/anthony-dvi.gif
1048235183.916 SWAPOUT 00 0000000F 5EA1B3F20FD906383CA826BC2C7A5EBA  200 1048235183 1014406699        -1 image/gif 164/164 GET http://mailsme.webpropsystems.com:3128/squid-internal-static/icons/anthony-tex.gif
1048235183.916 SWAPOUT 00 00000010 96E4FBDD389BE8A784A2EAF228CD3EE2  200 1048235183 1014406699        -1 image/gif 154/154 GET http://mailsme.webpropsystems.com:3128/squid-internal-static/icons/anthony-xbm.gif
1048235183.916 SWAPOUT 00 00000011 D8F2CC1BC053AE5D592E7464F9664E22  200 1048235183 1014406699        -1 image/gif 168/168 GET http://mailsme.webpropsystems.com:3128/squid-internal-static/icons/anthony-xpm.gif
1048235183.916 SWAPOUT 00 00000012 6A525B13334ABF1185C1A87D29CEF712  200 1048235183 1014406699        -1 image/gif 160/160 GET http://mailsme.webpropsystems.com:3128/squid-internal-static/icons/anthony-c.gif
1048235183.916 SWAPOUT 00 00000013 3CCFA6CD6F6C320070642A02ADE75127  200 1048235183 1014406699        -1 image/gif 166/166 GET http://mailsme.webpropsystems.com:3128/squid-internal-static/icons/anthony-binhex.gif
1048235183.916 SWAPOUT 00 00000014 91D77882A1BAE6804C13AB14AA041BC7  200 1048235183 1014406699        -1 image/gif 192/192 GET http://mailsme.webpropsystems.com:3128/squid-internal-static/icons/anthony-bomb.gif
1048236022.923 RELEASE -1 FFFFFFFF A9C95CB01C5D4E35EDEE50449F10875A  403        -1        -1        -1 unknown -1/969 CONNECT 64.157.4.84:25

--------------------------------------------------------------------------------------

ACCESS.LOG  21/3/2003  10h39


1047916439.094      0 64.159.75.220 TCP_DENIED/403 1041 CONNECT 64.157.4.84:25 - NONE/- -
1048030760.342      9 212.88.169.92 TCP_DENIED/403 1047 CONNECT 207.46.133.140:21 - NONE/- -
1048101587.578      1 216.137.3.105 TCP_DENIED/403 1041 CONNECT 64.157.4.84:25 - NONE/- -
1048154179.520      6 203.217.63.223 TCP_DENIED/403 1075 CONNECT pacific.nsw.au.austnet.org:6667 - NONE/- -
1048195876.807      1 64.191.52.220 TCP_DENIED/403 1041 CONNECT 64.157.4.84:25 - NONE/- -
1048236022.923      1 170.208.15.79 TCP_DENIED/403 1041 CONNECT 64.157.4.84:25 - NONE/- -


--------------------------------------------------------------------------------------

STORE.LOG 21/3/2003  10H39

1048237606.555 SWAPOUT 00 00000014 91D77882A1BAE6804C13AB14AA041BC7  200 1048237606 1014406699        -1 image/gif 192/192 GET http://mailsme.webpropsystems.com:3128/squid-internal-static/icons/anthony-bomb.gif

-------------------------------------------------------------------------------------------

And this the very last time on 21/3/2003 at roughly 11h00

C7  200 1048241936 1014406699        -1 image/gif 192/192 GET http://mailsme.webpropsystems.com:3128/squid-internal-static/icons/anthony-bomb.gif


---------------------------------------------------------------------------------------------------------
What I did notice is that SQUID .gifs are shown to users and everytime HTTPD stopped, the anthony-bomb.gif was shown. Maybe no the cause, but the result.

Questions:
Could it be Squid causing it?
Will it help if I install www.tech-geeks.org patch where you can empty cache and also allow direct connection instead of squid?
Can it be connected to https/SSL? I recently installed certificates?
Can it be connected to .htaccess as I also installed that recently although not enabled with .htaccess files in the sites?

For what its worth, I get roughly 1000 visitors a day. i doubt it that that is the cause of the problem. At most 2 concurrent users. Server run at 93% idle when I have 2 concurrent users.
Swapping doesnt happen at all. 256Mb RAM and not all in use.


I hope someone can help.



Paul