HTTP Proxy high cpu usage

[shaumux]

Hi when ever i enable the http proxy module the cpu usage shoots up to 100% at stays that way.
is it to be expected?
also i donot see dansguardian running although i enabled content filtering, is it not used by zentyal? or is it because i have the antivirus enabled in http proxy?

The zentyal version in question is 3.0

Thanks

[Sam Graf]

No, the proxy ordinarily shouldn't cause 100% CPU usage. I'm afraid I haven't experienced that particular problem. Zentyal does use DansGuardian for content filtering whether HTTP antivirus is running or not.

[shaumux]

While accessing though vnc or nx the squid3 cpu usage is constant at 100% and when accessed over only ssh it jumps on between 25 to 100% constantly.
I don't think they should affect squid3 in anyway.
Also if i enable http proxy these connections keep closing i need to reconnect and nx sometimes is unable to connect.

processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 28
model name      : Intel(R) Atom(TM) CPU D410   @ 1.66GHz
stepping        : 10
microcode       : 0x107
cpu MHz         : 1666.749
cache size      : 512 KB

EDIT:
I forgot to mention the installation is on LVM, can that be the cause?

[Sam Graf]

I have never run Zentyal 3 on an Atom CPU so I cannot comment. My closest experience would be my vintage testing server which has dual PIIIs, and the proxy/filter combination doesn't run at 100% on that machine. Another useful piece of information would be installed RAM.

I don't think LVM would factor into the problem. As for connections closing, I think it'll be important to determine what's driving CPU usage first. Regrettably, outside uninstalling and reinstalling the proxy module I don't have any helpful suggestions.

[half_life]

My thinking is the high cpu load is causing the dropped connections so it is a symptom of the underlying problem.  Have you dumped the squid cache?  I mean get rid of the current contents.

http://wiki.squid-cache.org/SquidFaq/OperatingSquid

[shaumux]

I tried that now and still nothing.
There are a few acls in the squid.conf which were added when i added filter rules from the zentyal console.
Can they be the culprit?
will it help to post the contents squid.conf and squid-external.conf?

[tacioandrade]

This is like the problem with the monitor module, try to disable it and see if it solves your problem.

[shaumux]

Is it posssible to disable the monitoring module from the terminal?
I'm having trouble accessing the browser due to the high cpu usage

[christian]

something like:

Code: [Select]

sudo /etc/init.d/zentyal monitoring stop

[shaumux]

After a lot of testing i think the filter in the http proxy is the problem.
I used this http://urlblacklist.com/?sec=download to create filters.
I have used this before too on an arch installation but the filtering was done by dansguardian.
Zentyal seems to be doing the filtration by list using squid and there are quite a few reg exp in this.
When i run squid -k parse squid.conf i get a lot of messages.
The total RAM is 2G
Any Suggestions?

[saleh]

Hi,

Very CPU load happened because zentyal add the block category in the squid configuration not in the  dansguardian configuration. I don't know why zentyal add  block category in squid not in dansguardian.
I think the best method like the old zentyal version 2.2 "filtering was done by dansguardian" not "by squid"

Best Regards,
Saleh

[shaumux]

Yes i also believe that dansguardian is more efficient at filtering than squid, is there any way to change the behaviour.
I can see dansguardian is running, what is zentyal using dansguardian for then?

[Sam Graf]

As I mentioned above, Zentyal uses DansGuardian for content filtering. A Zentyal system with no domain list installed still provides content-based filtering.

[shaumux]

But when i add a tar.gz file in the categorized list the lists are added to the squid acls

[Sam Graf]

DansGuardian is still doing the content filtering that it always has. How domain lists should be or are being handled is a seprate question that the developers will have to speak to. You asked why DansGuardian is running, and that's the question I'm answering.

And in the case of the original concern, in my experience even with a categorized domain list in place, the HTTP proxy doesn't normally drive CPU usage to 100% and stay there. I can't speak to how it all responds under real world load because I have not done that, only a test enviroment. For me, the filesharing/domain service was easily the bigger resource killer of the two even there.