Squid - rotate nightmare

bellera

Tested with squid3-dev 3.3.10 pkg 2.2.1 package

Previous threats that I found
http://forum.pfsense.org/index.php?topic=45777.0
http://forum.pfsense.org/index.php?topic=47569.0

I'm not logging access.log but I want to rotate cache.log

I put one day to rotate cache.log. It doesn't rotate.

cat /usr/pbi/squid-amd64/etc/squid/squid.conf | grep log
access_log /dev/null
cache_log /var/squid/logs/cache.log
cache_store_log none
logfile_rotate 1

It's squid rotate working? Must be logs activated at WebGUI for rotating cache.log?

marcelloc

Can you check if this entry exists on your cron?

At least on squid3-dev logs(access and cache) are rotating fine.

This may need another fix for squid cache log rotation if still present on squid 3.3

Changes in 3.1 logfile_rotate
No longer controls cache.log rotation. Use debug_options rotate=N instead.

squid_cron.png_thumb

bellera

I didn't have Cron Package installed. Now, I have it. And I see the configured job for squid3.

I will wait until tomorrow to see that it happens at 00:00

Thanks!

http://www.squid-cache.org/Doc/config/logfile_rotate/

bellera

After 00:00 no swap-state file and cache.log not rotated

ls -l /var/squid/logs/cache.log
-rw-r-----  1 proxy  proxy  38140597 Apr  2 23:42 /var/squid/logs/cache.log

bellera

0  	0  	*  	*  	*  	root  	/bin/rm /var/squid/cache/swap.state; /usr/pbi/squid-amd64/sbin/squid -k rotate -f /usr/pbi/squid-amd64/etc/squid/squid.conf

swap.state shouldn't be erased? It's the index for the cache!

http://www.squid-cache.org/Doc/config/cache_swap_state/

Since this is the index for the whole object list you CANNOT periodically rotate it!

http://wiki.squid-cache.org/SquidFaq/SquidLogs

If you accidentally delete swap.state while Squid is running, you can recover it by following the instructions in the previous questions.

http://wiki.squid-cache.org/SquidFaq/SquidLogs#swap.state

bellera

Log rotate	
Defines how many days of logfiles will be kept. Rotation is disabled if left empty.

It should say "files" instead than "days". In fact are days because cron jo it's done every day at 00:00.

With rotate disabled (box empty) I continue having the cron job!

This means erasing swap.state for nothing (?).

squid rotate is always a nightmare. At my proxies FreeBSD based I finished writing my own daily maintenance script to run at midnight. It stoppes squid, runs sarg, does the rotates, updates squidGuard blacklists and starts squid a new time.

bellera

I saw there is a cron job at past quarter of each hour controlling the swap.state file:

*/15  	*  	*  	*  	*  	root  	/usr/local/pkg/swapstate_check.php

The code is written by Jim Pingle. Perhaps he could clarify a little bit what to do with swap.state.

Squid documentation has been always confused. I'm using squid before year 2000 and it's hard to find good updated documentation.

Tikimotel

So do I edit the cron job from

0  	0  	*  	*  	*  	root  	/bin/rm /var/squid/cache/swap.state; /usr/pbi/squid-amd64/sbin/squid -k rotate -f /usr/pbi/squid-amd64/etc/squid/squid.conf

into

0  	0  	*  	*  	*  	root  	/usr/pbi/squid-amd64/sbin/squid -k rotate -f /usr/pbi/squid-amd64/etc/squid/squid.conf

this?
To prevent the swap.state to be lost?

marcelloc

How do you suggest to implement on squid3-dev? An option on gui that removes entire cache when swap.state is removed?

my cache.log is rotating fine on squid3-dev but I can include the debug_options rotate=N on squid.conf

bellera

@ Tikimotel,

Of course, but I didn't have time tot experiment if these crons are generated each time you configure squid with the WebGUI.

Squid documentation has been always confused. I'm using squid before year 2000 and it's hard to find good updated documentation.

I also want to propose a debate about what to do with swap.state

Looking at official documentation it seems that is better don't touch it. In fact, I never touch it for maintenance at my squid 2.x proxies.

bellera

@marcelloc:

How do you suggest to implement on squid3-dev? An option on gui that removes entire cache when swap.state is removed?

No. I think it doesn't help and cache is a very good value.

swap.state is removed at 00:00. It's supposed that squid -k rotate builds a new time. But I don't have logs activated at WebGUI. And I see swap.state at 0 bytes for many hours (until I go to sleep ;D). At morning, however, swap.state has been built. But I suspect that it's only partially build with the user accesses because no information about at cache.log. So, the index should be incomplete and I'm not sure the cache is optimized.

I will investigate more about it…

my cache.log is rotating fine on squid3-dev but I can include the debug_options rotate=N on squid.conf

Are you logging activated at WebGUI? I think yes, and you're logging also access.log. So, you are rotating. But in my case (as I said above) I don't want access.log and I'm not rotating cache.log at 00:00. Cron job does nothing about for me.

Thanks! See you later about this!

Tikimotel

wiki on "swap.state"

The file is a binary format that includes MD5 checksums, and StoreEntry fields. Please see the Programmers' Guide for information on the contents and format of that file.

Squid can rebuild it from the original files, but that procedure can take a long time as every file in the cache must be fully scanned for meta data.

I think, while reading the wiki, that cleaning the (/bin/rm) "swap.state" should only occur when you want to re-install squid or change the cache dir policy (aufs / diskd) or cachesize.
It contains the checksums of all cached items in the cache, so rebuilding ever 24h seems unnecessary and slow.

doktornotor

@Tikimotel:

rebuilding ever 24h seems unnecessary and slow.

The file should only get deleted when


	// If the swap.state file is taking up more than 75% disk space, 
	//	or the drive is 90% full and swap.state is larger than 1GB, 
	//	kill it and initiate a rotate to write a fresh copy.

If it happens every day for you, that'd strongly suggest you should just get a suitable (read: bigger) HDD for your box.

bellera

@doktornotor:

If it happens every day for you, that'd strongly suggest you should just get a suitable (read: bigger) HDD for your box.

It happens because cron job for rotate has a rm command for it! As we discussed…

0  	0  	*  	*  	*  	root  	/bin/rm /var/squid/cache/swap.state; /usr/pbi/squid-amd64/sbin/squid -k rotate -f /usr/pbi/squid-amd64/etc/squid/squid.conf

bellera

@Tikimotel:

I think, while reading the wiki, that cleaning the (/bin/rm) "swap.state" should only occur when you want to re-install squid or change the cache dir policy (aufs / diskd) or cachesize.
It contains the checksums of all cached items in the cache, so rebuilding ever 24h seems unnecessary and slow.

I agree.

In fact, the swap.state is controlled each hour by

*/15  	*  	*  	*  	*  	root  	/usr/local/pkg/swapstate_check.php

and it's completely built at squid restarts.

So, If you want to be sure /bin/rm /var/squid/cache/swap.state is erroneous and will be better a squid stop/start. But this (stop/start) can be a problem for environments with full 24 hours service.

That I'm wondering it's if erasing swap.state is a real problem or not for the cache. In other words, it's squid capable to find the objects without an initial index? Can we trust to the index if has been "manually" erased and it's built a new time "on the fly"?

doktornotor

@bellera:

It happens because cron job for rotate has a rm command for it! As we discussed…

Uh. Why?

@bellera:

That I'm wondering it's if erasing swap.state is a real problem or not for the cache.

It takes damn ages to rebuild the index… Like, hours / or even days for a reasonably big / huge cache - and causes huge I/O meanwhile as a "bonus". It is a completely retarded idea to delete the thing every 24 hours.

bellera

Uh. Why?

Because squid pfSense installation (or configuration) generates these two cron jobs:

0  	0  	*  	*  	*  	root  	/bin/rm /var/squid/cache/swap.state; /usr/pbi/squid-amd64/sbin/squid -k rotate -f /usr/pbi/squid-amd64/etc/squid/squid.conf
*/15  	*  	*  	*  	*  	root  	/usr/local/pkg/swapstate_check.php

You can see them if you have Cron Job package installed.

Do you use squid with pfSense?

doktornotor

No, not with pfSense. Using squid on a couple of dedicated boxes. Never occured to me someone could some with an "idea" of wiping the cache index daily. If you are running out of disk space, you are running the proxy on a wrong HW and/or you should sanitize the cache size settings. Not delete indexes.

bellera

@doktornotor:

If you are running out of disk space, you are running the proxy on a wrong HW and/or you should sanitize the cache size settings. Not delete indexes.

I agree.

/usr/local/pkg/swapstate_check.php is controlling this each hour.

I'm using also squid outside pfSense. But now I'm migrating one installation having squid into pfSense.

First cron should be without rm command:

@Tikimotel:

So do I edit the cron job from

0  	0  	*  	*  	*  	root  	/bin/rm /var/squid/cache/swap.state; /usr/pbi/squid-amd64/sbin/squid -k rotate -f /usr/pbi/squid-amd64/etc/squid/squid.conf

into

0  	0  	*  	*  	*  	root  	/usr/pbi/squid-amd64/sbin/squid -k rotate -f /usr/pbi/squid-amd64/etc/squid/squid.conf

this?
To prevent the swap.state to be lost?

bellera

I found some documentation about https://doc.pfsense.org/index.php/Squid_Package_Tuning#Compact_swap.state