Squid with CARP load balancing

[jinnantonnixx]

Is anyone using Squid with CARP peers?

 

In a nutshell, I have a group of Squid proxy/cache servers working fine (on Centos 5), but I want to move away from my primitive (awful) hashing algorithm in my PAC/WPAD files to a proper load balanced system.

 

I've read that CARP can provide a solution, but can't get it to work.

 

I've gone through the obvious documentation I could find, but I'm frustrated at the lack of explanation of key points (why would you use sibling instead of parents in your CARP array, for instance).

 

I'm adding cache_peer lines to my squid.conf, but my peer servers aren't receiving any directed traffic. i.e. I've done something wrong.

 

Any pointers?

Edited April 27, 2012 by jinnantonnixx

[ricki]

HI

 

I have an idea could you create a record in dns for each of you proxy servers under the name of proxy. Then change the ie proxy settings in group policy to the proxy name.

 

When the computers pick up the ip address for the proxy it will get a round robin and all the proxy servers will be used,

 

Richard

[jinnantonnixx]

Thanks.

 

I don't really want round robin though. I read the draft RFC for CARP and it mentioned a fairly sophisticated load-balancing which is what I want. Apart from filtering, the servers must cache and it would be best if the URLs were directed to the 'correct' server to make the most of the caching.

 

The documentation is frustrating.

 

 

 

What I'd like:

 

Front end Squid (with fail-back caching in case a peer went south) > Carp hashes the URL > Passes to the appropriate peer server based on the URL > Server returns cache hit or fetches from the internet > happy bunny.

 

I've got a cluster of Squid servers, but the distribution is based on a crummy algorithm in the pac file.

[tom_newton]

Why are you clustering? Resilience or Load? Or both?

I think you are trying to do something ICP-ish, where a cache hit on one member is nearly as good as a direct cache hit. That's great, but doesn't answer your load balancing problem.

 

CARP is for redundancy, usually between 2 servers. For linux purposes I think the equivalent is VRRP.

 

For load balancing I would suggest using a "proper" load balancer. The ones at loadbalancer.org are inexpensive and VERY good. You could roll your own but you would need CARP/VRRP between them for failover and to use something like haproxy to do the actual LB. Sounds like a lot of work, but your call

[jinnantonnixx]

Thanks, Tom.

 

Everything I read about Carp says it's the best thing in the world for load balancing. Well, perhaps not quite that, but they do drift towards that impression.

 

I will check out you link for load balancing - thanks.

Edited April 27, 2012 by jinnantonnixx

[jinnantonnixx]

Why are you clustering? Resilience or Load? Or both?

I think you are trying to do something ICP-ish, where a cache hit on one member is nearly as good as a direct cache hit. That's great, but doesn't answer your load balancing problem.

 

CARP is for redundancy, usually between 2 servers. For linux purposes I think the equivalent is VRRP.

 

For load balancing I would suggest using a "proper" load balancer. The ones at loadbalancer.org are inexpensive and VERY good. You could roll your own but you would need CARP/VRRP between them for failover and to use something like haproxy to do the actual LB. Sounds like a lot of work, but your call

 

Hold on - are you talking about the Squid CARP? The Cache Array Routing Protocol (CARP)

This is the one I meant. I know there is a different CARP, but this CARP is definitely for load balancing against a hash of the URL.

 

Every time I restart my front-facing Squid server with the "cache_peer carp" directive my Kerberos authentication goes west. It's as if the ticket has expired. The other peer servers work correctly on their own, and as part of an array from a pac file.

 

I could just write something in Java to achieve the same thing from the PAC file, as I can just copy a hashing algorithm off the net.

Edited April 27, 2012 by jinnantonnixx

[Geoff]

Every time I restart my front-facing Squid server with the "cache_peer carp" directive my Kerberos authentication goes west.

 

You can't do that. Kerberos auth is not compatible with CARP load balancing. You need to have two squids back to back. You can accomplish this by changing your peer lines to parents.

Edited April 27, 2012 by Geoff

[tom_newton]

Ah, I had a different CARP You will still have to VRRP your "front-end" squids (for resilience) which then "carp off" to the backend peers (for LB), and even then you're going to get no more than a single-squid in terms of performance (unless your backend squids are doing something else too, like content filtering), so if it is scaling under load you're after I would still reccomend loadbalancer.org.

[tom_newton]

You can't do that. Kerberos auth is not compatible with CARP load balancing. You need to have two squids back to back. One to handle the auth then another to talk to your CARP peers.

 

Yes, Kerberos and loadbalancing is difficult - we think we may have it cracked, but we're not holding our breath just yet.

[Geoff]

Indeed, if you have more money than time just buy a load balancer. The squid peers in your pool can still swap notes via ICP/HTCP/CARP or whatever. Edited April 27, 2012 by Geoff

[jinnantonnixx]

Thanks guys. My home-brew solution is not looking too promising. I'm running filtering, proxying (of course) and caching on all my Squid servers.

 

It's more complex still as I have NTLM and basic as failover.

 

So is the consensus that if I'm using Kerberos then CARP won't work in Squid, even as parent?

Edited April 27, 2012 by jinnantonnixx

[tom_newton]

Kerberos, in general, uses machine accounts, and as such needs to talk to the same *machine* all the time.

You might do FrontSquid (auth,no filtering) Backsquid(no auth,filtering), and have a pair of VRRP Frontsquids talking to 2 or 3 CARP backsquids.

[Geoff]

Try parenting, it might work.

[jinnantonnixx]

Does anyone have a working squid.conf file they can post which uses CARP with parent peers?

 

TIA.

[ricki]

HI

 

I know this will be a stupid question but why do you need all this load balancing. Could you not just set each year group to a different proxy to balance the load. I have only see load balancing in county where full load balancing is needed when they are filtering for lots of schools.

 

Richard

[jinnantonnixx]

Spot on - we've got several thousand users going through the boxes (thousands of machines in lots of schools), so we need some kind of balancing.

I need a deterministic algorithm to make best use of each of the server's caching. It's working OK at the moment (even with my embarrassingly poor algorithm), but I want to make it as good as possible.

[Sandman]

You might like to try the trial download through for KEMP Virtual LoadBalancer Edited July 11, 2012 by Sandman