Havp eating up memory spawning new childs

Alan87i · Mar 30, 2010, 10:09 AM

If I set Lusca/squid in transparent mode and HAVP as parent for squid the system is stable but HAVP fails to block the eicar.com test. It will block the txt and zip files.
The sys logs have a lot of entrys from logitec update site . I try too white list them but it does not seem to help.

If I Turn OFF Lusca/Squid transparent and set Havp as transparent with sys IP and 3128 port number it auto adds the extra options to squids config and all seems fne . Havp will block the eicar.com test and the txt zip files. But after a few hours the used system memory starts to rise from a steady 25 % to well over 40 sometimes more. I have seen it go to 80 some % last week on my first setup.
I reloaded from scratch saved all with no package info.
This is a tid bit from the system log with havp as transparent.
Mar 30 03:47:43 havp[24488]: (192.168.0.19) Could not send header to browser
Mar 30 03:31:37 havp[24461]: All childs busy, spawning new (now: 56) - SERVERNUMBER might be too low
Mar 30 03:31:36 havp[24461]: All childs busy, spawning new (now: 54) - SERVERNUMBER might be too low
Mar 30 03:31:35 havp[24461]: All childs busy, spawning new (now: 52) - SERVERNUMBER might be too low
Mar 30 03:31:27 havp[24478]: (192.168.0.19) Could not read browser header
Mar 30 03:31:27 havp[24490]: (192.168.0.19) Could not read browser header

I have edited the min max servers in havp.inc

# HAVP config file
# This file generated automaticly with HAVP configurator (part of pfSense)
# (C)2008 Serg Dvoriancev
# email: dv_serg@mail.ru
# ============================================================
";
    $conf[] = "USER           " . HVDEF_USER;
    $conf[] = "GROUP          " . HVDEF_GROUP;
    $conf[] = "DAEMON         true";
    $conf[] = "PIDFILE        " . HVDEF_PID_FILE;
    $conf[] = "\n# For small home use, 8 should be minimum.";
    $conf[] = "# For 500 users corporate use, start at 40.";
    $conf[] = "SERVERNUMBER 30  " . HVDEF_HAVP_MINSRV;
    $conf[] = "MAXSERVERS 100    " . HVDEF_HAVP_MAXSRV;
    # log
    $conf[] = "\n# log ";
    $conf[] = "ACCESSLOG      " . HVDEF_HAVP_ACCESSLOG;
    $conf[] = "ERRORLOG       " . HVDEF_HAVP_ERRORLOG;
    # syslog
    $conf[] = "\n# syslog";
    $conf[] = "USESYSLOG      {$havp_config[F_SYSLOG]}";
    $conf[] = "SYSLOGNAME     havp";
    $conf[] = "SYSLOGFACILITY daemon";
    $conf[] = "SYSLOGLEVEL    " . (HV_DEBUG === 'true' ? "debug" : "info");     # err | warning | info | debug

They were blank I left a space and added 30 and 100.
Thanks for any help .

dvserg · Mar 30, 2010, 10:32 AM

If I set Lusca/squid in transparent mode and HAVP as parent for squid the system is stable but HAVP fails to block the eicar.com test

The eicar.com taked from squid cache and not checked with havp. Check viruses in squid cache with clamscan.

At top havp.inc exists


define('HVDEF_HAVP_MINSRV',             '10');
define('HVDEF_HAVP_MAXSRV',             '100');

Change this.

Also HAVP need large ram for work.

Alan87i · Mar 30, 2010, 1:43 PM

Thanks
Of coarse I was looking in the wrong place for the min max servers.
I have 10 users at this time. What is a good place to start ?
I changed the min server to 30 and the max to 150 to start with. I have 2 GB of ram on a 3 Gig CPU .
I can add 2 more GB of ram if needed.

Still seeing this in the sys log
Mar 30 09:39:43 havp[27786]: All childs busy, spawning new (now: 24) - SERVERNUMBER might be too low
Mar 30 09:39:42 havp[27786]: All childs busy, spawning new (now: 22) - SERVERNUMBER might be too low

dvserg · Mar 30, 2010, 5:32 PM

@Alan87i:

Thanks
Of coarse I was looking in the wrong place for the min max servers.
I have 10 users at this time. What is a good place to start ?
I changed the min server to 30 and the max to 150 to start with. I have 2 GB of ram on a 3 Gig CPU .
I can add 2 more GB of ram if needed.

Find and set (on havp.inc top) this option

define('HV_DEBUG', 'false');

define('HVDEF_HAVP_MINSRV', '10');
define('HVDEF_HAVP_MAXSRV', '50');

And test this config new.

Alan87i · Apr 2, 2010, 1:52 AM

I tried the settings and still have sort of the same issue . After 2 days the system has gone from 11 % memory usage to 57 % and these errors in the sys log
Apr 1 21:50:01 havp[40970]: (192.168.0.102) Could not send body to browser
Apr 1 21:49:41 havp[5736]: (192.168.0.102) Could not send body to browser
Apr 1 21:47:01 havp[31268]: (192.168.0.102) Could not send body to browser
Apr 1 21:46:06 havp[56925]: (192.168.0.102) Could not send body to browser
Apr 1 21:45:04 havp[15151]: (192.168.0.102) Could not send body to browser
Apr 1 21:45:00 havp[5736]: (192.168.0.102) Could not send body to browser
Apr 1 21:44:32 havp[56925]: (192.168.0.102) Could not send body to browser
Apr 1 21:44:32 havp[31268]: (192.168.0.102) Could not send body to browser
Apr 1 21:44:01 havp[31137]: (192.168.0.102) Could not send body to browser
Apr 1 21:43:57 havp[32088]: (192.168.0.102) Could not send body to browser
Apr 1 21:42:49 havp[53892]: (192.168.0.102) Could not send body to browser
Apr 1 21:39:56 havp[31137]: (192.168.0.102) Could not send body to browser

dvserg · Apr 2, 2010, 5:32 AM

This is debug info too
http://havp.hege.li/forum/viewtopic.php?f=2&t=4

In /usr/local/pkg/havp.inc find function havp_config_havp()
Change $conf[] = "LOGLEVEL 1";
as
$conf[] = "LOGLEVEL 0";

Alan87i · Apr 6, 2010, 5:55 PM

With the settings above the machine has ran almost 4 days and the used memory has gone from 11% at start up to 59% as of 3 days 20 hours. I'll leave it be and see how high it goes.
If I re start havp it will drop 1 or 2 % but no more.
Allan

dvserg · Apr 6, 2010, 6:35 PM

Test different settings (+/-) for
'HVDEF_HAVP_MINSRV', 'HVDEF_HAVP_MAXSRV'
May be you found the best values.