the paranoid answer is that someone is replacing your squid and rebooting
the system to cover their tracks...
On Thu, 23 Aug 2001, Jim Mercer wrote:
>
> [ i'm not on hackers or questions lists, so a Cc: would be appreciated on any
> replies ]
>
> i have a squid server in pakistan that is exhibiting some really, really screwy
> behaviour.
>
> firstly, it is running FreeBSD 4.x-stable (circa Feb 2001)
>
> secondly it is running squid-2.3 stable4
>
> when we initially set it up, we found that the default kernel maxfiles of
> 2088 was inadequate.
>
> using sysctl (/etc/sysctl.conf) we bumped it (and procmaxfile) up to 10000.
>
> squid didn't seem to find the 10000 after this, only 2088.
>
> someone mentioned that squid calculates the number of descriptors at compile
> time.
>
> so, we recompiled squid, restarted, and voila, it found the 10000.
>
> a few weeks ago, i was informed that it was running out of file descriptors.
>
> i checked it out, and for some reason, squid was only seeing 2088 again.
>
> sysctl -a showed me that it was in fact having 10000.
>
> i figured maybe someone re-installed squid.
>
> so i did a:
>
> # cd /usr/ports/www/squid23
> # make clean
> # make
> # make install (or maybe reinstall)
>
> restarted squid, and lo and behold, it was seeing 10000 descriptors again.
>
> yesterday, i got a message that it was out of descriptors again.
>
> this time, i noticed that the box had been rebooted recently.
>
> sysctl -a still showed 10000, but squid was only seeing 2088.
>
> now, this is the weird, weird, weird part.
>
> without rebooting or anything, i killed squid and did:
> # cd /usr/ports/www/squid23
> # make reinstall
>
> i restarted squid, and lo and behold, it saw 10000 descriptors.
>
> i had a close look at what "make reinstall" did, and as best i can tell it
> did not update any config files, just programs.
>
> now, WTF would cause the binary to get a different perspective on the
> number of file descriptors between boottime and reinstall ?
>
> --
> [ Jim Mercer [EMAIL PROTECTED] +1 416 410-5633 ]
> [ Now with more and longer words for your reading enjoyment. ]
>
> To Unsubscribe: send mail to [EMAIL PROTECTED]
> with "unsubscribe freebsd-hackers" in the body of the message
>
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-hackers" in the body of the message
