Então galera,

Esse cliente e o que mais reclama mais sinto nos outros uma certa lentidão também.

O padrão e o CENTOS 7 do repositório versão 3.3.8 o servidor tem 4 GB de memoria hd convencional e 45 máquinas ligadas a ele.

Vi num poste que tinha que aumentar a quantidade de conexões pois o centos limita sabem dizer se isso realmente e necessário ?

Hoje eu uso 3 grupos um 1 grupo livre / 2 grupo restrito / 3 grupo bloqueado (grupo 1 tudo liberado / grupo 2 tudo liberado menos a lista negra / grupo 3 tudo travado apenas liberando a lista branca).

Vou postar aqui para que olhem o tamanho do meu squid acredito que tenha muita coisa que não seja necessária se puderem olhar e me dar algumas dicas para termos uma melhora nele vou ser muito grato.

# usuário que vai utilizar o squid
cache_effective_user squid
## Squid normalmente escuta na porta 3128
http_port 8080
hierarchy_stoplist cgi-bin ?
error_directory /usr/share/squid/errors/pt-br
#nos recomendamos essas duas linhas.
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
# sinal do ETag responda corretamente no apache
acl apache rep_header Server ^Apache
#Padr√£o:
cache_mem 2048 MB
#altera a performance em conexões pipeline(paralelo)
pipeline_prefetch on
##maximum_object_size_in_memory 128 KB
##maximum_object_size 4096 kb
##minimum_object_size 0 kb
##cache_swap_low 90
##cache_swap_high 95
##cache_dir ufs /cache 10000 128 256
##cache_replacement_policy heap LFUDA
##memory_replacement_policy heap GDSF
##store_dir_select_algorithm least-load
access_log /var/log/squid/access.log squid
##cache_log /var/log/squid/cache.log
##cache_store_log /var/log/squid/store.log
pid_filename /var/run/squid.pid
auth_param ntlm program /usr/bin/ntlm_auth XXXXX.LOCAL/samba --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 20
auth_param ntlm keep_alive off
auth_param basic program /usr/lib64/squid/basic_ldap_auth -R -b "dc=XXXXX,dc=local" -D "cn=squid,ou=Users,dc=XXXXX,dc=local" -w "Mudar2016" -f sAMAccountName=%s -h <XXX.XX.XX.4 lx-server>
auth_param basic children 5
auth_param basic realm Senha da Internet
auth_param basic credentialsttl 2 hours
#ACLS EXTERNA PARA AUTENTICACAO NAS BASES LDAP DO PDC
external_acl_type NT_group %LOGIN /usr/lib64/squid/ext_wbinfo_group_acl

#sugestao padrao:

refresh_pattern ^ftp:          1440    20%     10080
refresh_pattern ^gopher:       1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0    0%      0
refresh_pattern .              0       20%     4320
#configuração minima:
acl rede_local src fc00::/7   # RFC 4193 local private network range
acl rede_local src fe80::/10  # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl SSL_ports port 1863
acl Safe_ports port 81          #http
acl Safe_ports port 1863
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl safe_ports port 1025-65535  #unregistered portsx
acl safe_ports port 8081        #rastreamento
acl purge method PURGE
acl CONNECT method CONNECT
acl autenticacao proxy_auth REQUIRED src XXX.XX.XX.0/24
acl grupo_livre external NT_group grp-int-livre
acl grupo_restrito external NT_group grp-int-rest
acl grupo_bloqueado external NT_group grp-int-bloq
acl sites_proibidos dstdomain -i "/root/gerencia/squid/sites_proibidos"
acl sites_permitidos dstdomain -i "/root/gerencia/squid/sites_permitidos"
acl sites_eroticos url_regex -i "/root/gerencia/squid/sites_eroticos"
acl palavras_proibidas url_regex -i "/root/gerencia/squid/palavras_proibidas"
acl Browsers browser "/root/gerencia/squid/browsers"
acl sites_webproxy dstdomain -i "/root/gerencia/squid/sites_webproxy"
acl Mimes_req req_mime_type -i "/root/gerencia/squid/mimes_proibidos"
acl Mimes_rep rep_mime_type -i "/root/gerencia/squid/mimes_proibidos"

###############################################################
# LIBERA O JAVA
# Java não funciona com Autenticacao NTLM
###############################################################

acl java browser Java
http_access allow java

###############################################################
# LIBERA iTUNES sem Autenticacao
###############################################################

acl itunes dstdomain -i .apple.com
http_access allow iTUNES
###############################################################
# LIBERA GMAIL sem Autenticacao
###############################################################

acl google dstdomain -i .google.com
acl gstatic dstdomain -i .gstatic.com
http_access allow google
http_access allow gstatic

###############################################################
###############################################################
# LIBERA ITAU
###############################################################

acl Itau dstdomain -i itau.com.br
http_access allow CONNECT Itau

################################################################
## Libera Sites sem Autenticacao
################################################################

acl Sites_UnAuth dstdomain -i "/root/gerencia/squid/sites_unauth"
http_access allow Sites_UnAuth

#################################################################
## Bloqueia / Libera navegacao com IP na URL
#################################################################

acl Deny_URL_IP dstdom_regex [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
acl Libera_URL_IP dstdomain "/root/gerencia/squid/libera_url_ip"

# somente permitir cachemgr acessar do localhost
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge

# Probir solictação de portas desconhecidas
http_access deny !Safe_ports

# Proibir CONNECT para outros usando SSL ports
http_access deny CONNECT !SSL_ports

# Coloque suas regras aqui
http_access allow grupo_livre
http_access deny Browsers
# ACL PARA O GRUPO RESTRITO
http_access deny sites_proibidos !sites_permitidos
http_access deny sites_eroticos
http_access deny sites_webproxy
http_access deny palavras_proibidas
http_access deny Deny_URL_IP !Libera_URL_IP
http_reply_access deny Mimes_req
http_reply_access deny Mimes_rep
#http_access deny extban
http_access allow grupo_restrito

#ACL PARA O GRUPO BLOQUEADO
http_access deny all !sites_permitidos
http_access allow grupo_bloqueado
http_access allow autenticacao

#E finalmente proibir todas outras tentativas de acesso a esse proxy
http_access allow localhost
http_access deny all
http_reply_access allow all

#Permitir consultas ICP de qualquer um
icp_access allow all
visible_hostname proxy

#pasta onde esta os arquivos do cache
coredump_dir /cache

#servidores dns usados pelo squid
dns_nameservers XXX.XX.XX.4
#dns_nameservers 8.8.8.8
#dns_nameservers 8.8.4.4

###############################################################################
#
# ADMINISTRATIVE PARAMETERS
#
###############################################################################

 cache_mgr suporte@XXXXX.com.br
 mail_from suporte@XXXXX.com.br
 mail_program mail

###############################################################################
#
# ERROR PAGE OPTIONS
#
###############################################################################

 error_directory /usr/share/squid/errors/pt-br
 err_page_stylesheet /etc/squid/errorpage.css
 err_html_text mailto:gabriel@XXXXX.com.br



Atenciosamente,

Gabriel Franca



Em 22/02/2016 20:50, Rodrigo Maia escreveu:

É um cliente isolado ou vários se for isolado veja os passivos da rede.  O squid tem uma regra ao se criar o repositório de cache outra coisa interessante é declarar os dns servers por meio das strings do proprio squid no Conf dele.

Desculpe o jeito postado do móvel e em aula.  Boa sorte!

On Feb 22, 2016 4:53 PM, "Greyson Farias" <greysonsilva@gmail.com> wrote:
É bom revisar as configurações do Squid. Alguma ACL pode estar ocasionando a lentidão. Dar uma monitorada com o IOTOP para verificar se não é algo no disco rígido, verificar com o HTOP como está o consumo de CPU também é recomendado.

Greyson Farias da Silva
Técnico em Operação de redes - CREA/AC 9329TD
Eu prefiro receber documentos em ODF.
http://about.me/greysonfarias


Em 22 de fevereiro de 2016 14:46, Gabriel O. Franca <gabriel.franca@gmail.com> escreveu:
Boa Tarde Pessoal.

Estou com um cliente reclamando de lentidão no proxy.

Estou usando um centos 7 o squid e o do repositório padrão.

Em alguns casos o cliente reclama e como não está tendo consumo exagerado de link eu vou lá e reinicio o squid e normaliza o acesso.

alguém já passou por isso ?

Atenciosamente,

Gabriel Franca
_______________________________________________
CentOS-pt-br mailing list
CentOS-pt-br@centos.org
https://lists.centos.org/mailman/listinfo/centos-pt-br


_______________________________________________
CentOS-pt-br mailing list
CentOS-pt-br@centos.org
https://lists.centos.org/mailman/listinfo/centos-pt-br



_______________________________________________
CentOS-pt-br mailing list
CentOS-pt-br@centos.org
https://lists.centos.org/mailman/listinfo/centos-pt-br