Hello Amos ,
Config file is based on IP auth and user/pass auth . But I want to minimize the CPU hit of my config file as much as possible . Version : Squid 5.3 ############################################################################################### squid.conf acl RDP-Domain-controller src 77.90.230.0/24 77.90.228.0/24 77.90.225.0/24 77.90.210.0/24 77.90.193.0/24 77.90.145.0/24 77.90.112.0/24 88.21.95.0/24 88.21.94.0/24 88.21.76.0/24 88.21.75.0/24 88.21.72.0/24 88.21.36.0/24 88.21.34.0/24 88.21.199.0/24 88.21.193.0/24 88.21.192.0/24 88.21.137.0/24 88.21.135.0/24 88.21.132.0/24 88.21.131.0/24 88.21.129.0/24 88.21.128.0/24 88.21.126.0/24 88.21.121.0/24 88.21.120.0/24 88.108.9.0/24 88.108.45.0/24 http_access allow RDP-Domain-controller acl googleaccess dstdomain .google.com .google.ad .google.ae .google.com.af .google.com.ag .google.com.ai .google.al .google.am .google.co.ao .google.com.ar .google.as .google.at .google.com.au .google.az .google.ba .google.com.bd .google.be .google.bf .google.bg .google.com.bh .google.bi .google.bj .google.com.bn .google.com.bo .google.com.br .google.bs .google.bt .google.co.bw .google.by .google.com.bz .google.ca .google.cd .google.cf .google.cg .google.ch .google.ci .google.co.ck .google.cl .google.cm .google.cn .google.com.co .google.co.cr .google.com.cu .google.cv .google.com.cy .google.cz .google.de .google.dj .google.dk .google.dm .google.com.do .google.dz acl FTP proto FTP http_access deny FTP http_access deny manager ################################# acl URN proto URN http_access deny URN ########################### ############################################################# visible_hostname squid ################################### # Lockdown Procedures auth_param basic program /lib/squid/basic_ncsa_auth /etc/squid/squid_user acl ncsa_users proxy_auth REQUIRED auth_param basic children 50 auth_param basic realm login squid Login http_access deny ncsa_users googleaccess http_access allow ncsa_users auth_param basic casesensitive on ######################################### cache_effective_user squid cache_effective_group squid ############## server_persistent_connections off client_persistent_connections off cache deny all ############################################### http_port 66.4.223.238:45000 name=45000 http_port 66.4.223.238:45001 name=45001 http_port 66.4.223.238:45002 name=45002 http_port 66.4.223.238:45003 name=45003 ######### acl user45000 myportname 45000 acl user45001 myportname 45001 acl user45002 myportname 45002 acl user45003 myportname 45003 ############# tcp_outgoing_address 2a0f:3fc6:f1f1:459e:ba16:10cc:3d9f:6d8f user45000 tcp_outgoing_address 2a0f:3fc6:f1f1:459e:ca27:f465:986e:6dfc user45001 tcp_outgoing_address 2a0f:3fc6:f1f1:459e:27de:fec7:49fc:3113 user45002 tcp_outgoing_address 2a0f:3fc6:f1f1:459e:698a:d044:d39e:ffe7 user45003 tcp_outgoing_address 2a0f:3fc6:f1f1:459e:bc96:9e75:6653:76ac user45004 From: squid-users <squid-users-boun...@lists.squid-cache.org> on behalf of Amos Jeffries <squ...@treenet.co.nz> Date: Friday, April 1, 2022 at 1:51 AM To: squid-users@lists.squid-cache.org <squid-users@lists.squid-cache.org> Subject: Re: [squid-users] Squid 3-5 CPU optimization and best practise . FYI; CPU in Squid is primarily consumed by two things: 1) parsing and processing HTTP message headers. The only thing you can do about this is detect and reject unwanted traffic as early as possible. Your OS firewall is obviously the early line of defense. Preventing unwanted network ranges from reaching Squid listening ports saves Squid from spending CPU cycles looking up details about those unwanted clients. Then for clients who are potentially valid the default http_access rules reject dangerous traffic quickly and efficiently. Make sure any custom http_access rules are listed *after* those ones. Then see (2). 2) processing access controls (ACL checks). To optimize this needs attention to what order ACLs are tested in versus how complex they are to process. How many CPU cycles are consumed managing any resources they or other processes they trigger is also important. If you want a free optimization review please post your full squid.conf (just without the documentation comments and empty lines). Then we can point out any performance tricks you may not yet be using. Beyond those two you are getting into "advanced admin" levels of performance optimization. Where YMMV, Alex has mentioned. Every network is different so none of us can say a specific thing to do that will be better for you. HTH Amos _______________________________________________ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
_______________________________________________ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
