[Ubuntu] Squid slow web access

[joe90bass]

Hi,
I've spent the last week setting up Ubuntu, Squid and dansguardian. I was making good progress up to yesterday. With just the one group Danguardian was filtering access. Today as I was going to setup more groups I've hit a big issue! It seems that any web traffic going through Squid is incredibly slow or times out. There's only me using our network (at most two of us), I'm hitting squid direct (3128) not going through Dansguardian at the moment, squid is forwarding to our LAs ISA server and authenticating against it (not using our AD credentials as the ISA is on a different network, so it's a different user and pass which Squid supplies to the ISA box). In the cache log for squid I am seeing:

280488089.359 56 127.0.0.1 TCP_MISS/200 9204 GET http://news.bbcimg.co.uk/media/image...sance-forc.jpg - DEFAULT_PARENT/192.168.248.201 image/jpeg
1280488089.444 28 127.0.0.1 TCP_MISS/200 5120 GET http://news.bbcimg.co.uk/media/image...09890963-1.jpg - DEFAULT_PARENT/192.168.248.201 image/jpeg
1280488089.830 53 127.0.0.1 TCP_MISS/200 5816 GET http://news.bbcimg.co.uk/media/image...1_48538247.jpg - DEFAULT_PARENT/192.168.248.201 image/jpeg
1280488089.902 72 127.0.0.1 TCP_MISS/200 28870 GET http://news.bbcimg.co.uk/media/image...day_magnum.jpg - DEFAULT_PARENT/192.168.248.201 image/jpeg
1280488089.987 60 127.0.0.1 TCP_MISS/304 360 GET http://node2.bbcimg.co.uk/iplayer/im...9ny_150_84.jpg - DEFAULT_PARENT/192.168.248.201 image/jpeg
1280488089.989 62 127.0.0.1 TCP_MISS/304 359 GET http://node2.bbcimg.co.uk/iplayer/im...qry_150_84.jpg - DEFAULT_PARENT/192.168.248.201 image/jpeg
1280488090.013 23 127.0.0.1 TCP_MISS/304 360 GET http://node2.bbcimg.co.uk/iplayer/im...cqs_150_84.jpg - DEFAULT_PARENT/192.168.248.201 image/jpeg

As well as

1280485942.768 22 172.21.117.38 TCP_MISS/304 360 GET http://node2.bbcimg.co.uk/iplayer/im...cqs_150_84.jpg mydomain\ccronin DEFAULT_PARENT/192.168.248.201 image/jpeg
1280486048.001 179293 172.21.117.38 TCP_MISS/504 2859 GET http://www.google.co.uk/csi? mydomainname\ccronin DIRECT/66.102.9.99 text/html
1280486049.982 0 172.21.117.38 TCP_DENIED/407 2731 GET Google - NONE/- text/html
1280486050.127 0 172.21.117.38 TCP_DENIED/407 3121 GET Google - NONE/- text/html
1280486050.332 202 172.21.117.38 TCP_MISS/200 6492 GET Google mydomainname\ccronin DEFAULT_PARENT/192.168.248.201 text/html

From Google I believe a lot of the tcp_miss can be ignored as they're expected...
I was hoping today to finish off this and move onto the next item on the ever growing list of summer jobs!

[linuxgirlie]

If it was me, if it was going slow I would first check that the server can go out on the internet at a reasonable speed. Then follow other avenues.

[joe90bass]

If it was me, if it was going slow I would first check that the server can go out on the internet at a reasonable speed. Then follow other avenues.

Nothing like overlooking the obvious........! I've checked pretty much everything else except that

Now to find the commands to do that, thankfully I have an Ubuntu server book to hand

[ind1ekid]

Nothing like overlooking the obvious........! I've checked pretty much everything else except that

Now to find the commands to do that, thankfully I have an Ubuntu server book to hand

Try squidclient (apt-get install squidclient) - its pretty handy for checking squid itself directly from your server!
If you don't get very far post your squid conf, maybe theres something astray in there.

[joe90bass]

Semes to be okay, I've tried downloading via the squidclient and it appears to be (lot of random scrolling text on screen!) I've also gone to BBC - Homepage and have the html for the page on screen so it seems to be an issue between dansguardian and squid?
edit: Actually the problem is there accessing squid direct from a client PC (i.e. bypassing Dansguardian)

I've attached my squid.conf (renamed to .txt), I don't think I've left any passwords in there!
We're running Ubuntu 10.04, Squid 3 and Dansguardian 2.10.1.1.

Cheers!

[joe90bass]

Trying again using our squid proxy I get

ERROR
The requested URL could not be retrieved

--------------------------------------------------------------------------------

The following error was encountered while trying to retrieve the URL: Advanced Search - EduGeek.net

Connection to 78.46.90.194 failed.

The system returned: (110) Connection timed out

The remote host or network may be down. Please try the request again.

Your cache administrator is webmaster.




--------------------------------------------------------------------------------

Generated Mon, 02 Aug 2010 12:13:24 GMT by localhost (squid/3.0.STABLE19)

The above error looks like a DNS issue, but I can do nslookups no problem on the server. Very confused!

edit: Further testing seems to indicate issues with parts of web pages. Sky.com seems to load most of the page and then hang, bbc.co.uk takes forever, edugeek takes a long time and is then completely unformatted but www.waterways.org.uk loads quickly and correctly! I'm trying to work out what Squid is objecting to in these pages!

[ind1ekid]

Do you normally go through an isp or local authority proxy/filter?

[joe90bass]

Do you normally go through an isp or local authority proxy/filter?

LA proxy - the 192.168.248.201 address

[ind1ekid]

I'd think you will need to add that as a cache_peer in your squid conf then. And also add a never_direct allow all.

Cache Peer
never_direct

[joe90bass]

I've got

cache_peer 192.168.248.201 parent 8080 0 proxy-only no-query login=user : password

in there already, but not the never_direct. I'll give that a try when I'm back in on Monday- Thanks

[ind1ekid]

I've got in there already, but not the never_direct. I'll give that a try when I'm back in on Monday- Thanks

Ah, yea so it is. I gave up to soon whilst searching for cache_peer in your squid.conf. The never direct should fix your problem. Let us know how you get on.

Sean

[joe90bass]

The never direct should fix your problem. Let us know how you get on.

Sean

Top man, it's now working Now to get my head around Dansguardian and the filtering groups!