[squid-users] Re: squid_kerb_auth High CPU load.

[Viorel Robu]

Markus Moeller huaraz at moeller.plus.com writes:

 
 Good news.
 
 Thank you for sharing.
 Markus 


Can this be fixed in some way? 
Because selinux is required by our security policies.

[squid-users] Re: squid_kerb_auth High CPU load.

[Viorel Robu]

Hooray!!! I solved my problem with squid_kerb_auth!!!

The problem was not in architecture, as I wrongly supposed. The problem is
SELINUX, even in permissive mode it make a big CPU pressure.

[squid-users] Re: squid_kerb_auth High CPU load.

[Viorel Robu]

Markus Moeller huaraz at moeller.plus.com writes:

 
 Hi Viorel,
 
What you mean with a list of high load sites ? Are you saying that the 
 performance depends on which sites you are accessing via squid ?
 
 Regards
 Markus
 

It's because of my pour english, I meant that I can easely simulate the
situation without impacting my business.
When I wrote high load I meant sites that users usualy access and squid are
making a lot authentifications.

Viorel

[squid-users] Re: squid_kerb_auth High CPU load.

[Viorel Robu]

Markus Moeller huaraz at moeller.plus.com writes:

 
 Hi Viorel,
 
It is the first time I hear that x64 performs differently to x86.  I have 
 no idea how to debug such a situation.
 
 Markus

Hi Markus,

You may have all my support in invetigating this.
I make a list of high load sites non critical for my business sites and can
simulate the situation by redirecting user traffic using WPAD script.

Viorel

[squid-users] Re: squid_kerb_auth High CPU load.

[Viorel Robu]

Simon Dwyer mail at simmyd.net writes:

 
 Hi all,
 
 I have got kerberos working and moved it to production but then the
 server started smashing its cpu.  It seems that the squid_kerb_auth
 processes are killing the cpu.
 
 I have the following in my config.
 
 /etc/sysconfig/squid/
 
 KRB5RCACHETYPE=none
 export KRB5RCACHETYPE
 
 /etc/squid/squid.conf
 
 auth_param negotiate program  /usr/bin/negotiate_wrapper
 --kerberos /usr/lib64/squid/squid_kerb_auth -i -r -s GSS_C_NO_NAME
 --ntlm /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
 --domain=DOMAIN.EXAMPLE
 auth_param negotiate children 30
 auth_param negotiate keep_alive on
 
 From what i have read the first part should fix the high cpu issue but
 it doesnt seem to help.
 
 More the case i am having trouble getting that variable active.
 
 Anyone else come up on this?
 
 Simon
 
 

Hi Simon and Markus!

Have you any progress in invetigation performance issue on squid 3.1.10 with
squid_kerb_auth 1.07?
Because I ran in the same situation as Simon and found that issue apear only on
x64 linux. I build two identical systems on Centos 6.3 + Squid 3.1.10 with x64
and x86 system architecture. And I have to say that x86 sistem is behave
adequate to its load. Kerberos libraries, squid and kerberos helper are the same
version, the only difference is processor architecture.