Squid使用总结（安装、配置、优化...）

较早的工作日志，记下来备忘

1. 编译和安装

暂时使用CENTOS 5.2上缺省安装的2.6STABLE7版本

2. squid配置

2.1 最简单配置

http_port 80
cache_peer 127.0.0.1 parent 8080 0 no-query default originserver name=bes
acl all src all
http_access allow all

access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log

2.2 监控管理

acl snmppublic snmp_community public
snmp_port 3401
snmp_access allow snmppublic localhost
snmp_access deny all

2.3 更安全的配置

acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443       # https
acl Safe_ports port 80       # http
acl Safe_ports port 443       # https
acl purge method PURGE
acl CONNECT method CONNECT

http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access deny all

cache_effective_user squid
cache_effective_group squid

2.4打开相关性能告警

high_response_time_warning 1000
high_page_fault_warning xxx
high_memory_warning xxx

2.5 其他

visible_hostname proxy.hostname

3. 调试

3.1 在配置文件中设置debug_options ALL,9
3.2 cache.log
3.3 squid -XF
3.4 squid -k parse 分析配置文件语法

4. 网络相关优化

4.1 减少TIME_WAIT套接字数量

＃vi /etc/sysctl.conf
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_max_tw_buckets = 5000
＃/sbin/sysctl -p
详见http://blog.s135.com/read.php?338

5. DISK IO相关的优化

5.1 cache_dir设置的考虑

• cache_dir采用二级目录方式保存cache object，做配置时不宜过大，建议为规划容量的1倍，否则建立swap目录会花费较多时间。推荐保留10%的空间。这些额外的空间用于存放squid的swap.state文件和临时文件。
• 可以配置多个cache_dir，建议每个cache_dir都放在不同的物理硬盘上，以改善IO效率

5.2 squid相关的目录设置

• log和cahce_dir不要放在一个物理盘上
• cache_dir所在的盘建议使用ReiserFS格式
• mount cache_dir盘时建议使用noatime参数

5.3 DISK Cache的相关设置

• max_open_disk_fds
This directive defines an upper limit on the number of file descriptors that Squid should open for reading and writing cache files on disk. 当达到这个限制后，squid会跳过DISK cache，从而避免IO持续恶化。
缺省为0（无限制）。［建议］For a single disk cache, 900 is a good choice. For a dual disk cache, try 1400.
• max_filedescriptors
允许打开的最大文件描述符，实际允许打开的数量也受编译squid的--with-maxfd的影响。缺省为0。［建议］
• maximum_object_size
maximum_object_size 1024 KB
• cache_swap_low／cache_swap_high ？？？

5.4 Linux设置

• filedescriptors
一共有两个方面的限制: 整个系统，当前用户。
http://prefetch.net/blog/index.php/2009/07/31/increasing-the-number-of-available-file-descriptors-on-centos-and-fedora-linux-servers/

整个系统：

动态调整，每次启动后该设置会丢失：

＃ulimit -HSn 4096

在/etc/sysctl.confg中设置：
# vi /etc/sysctl.conf
fs.file-max = 100000
# sysctl -p
［ulimit显示的值和/proc/sys/fs/file-max中显示的值有什么关系］
ulimit command provides control over the resources available to the shell and to processes started by it, on systems that allow such control. The maximum number of open file descriptors displayed with following command

#vi /etc/security/limits.conf

单个用户

* - nofile 8192

6. MEM优化考虑

• cache_mem
Squid占用内存量似乎不受这个参数的控制，此参数不必设得太大，适量就行。服务器：cache_mem 100 MB
• maximum_object_size_in_memory：
设置较小的maximum_object_size_in_memory值有助于有效控制squid过度占用内存
• client_db off
• The ratio of memory-to-disk can be important. We recommend that you have at least 32 MB of RAM for each GB of disk space that you plan to use for caching.

7. CPU优化相关

Squid is a single process application and can not make use of SMP. If you want to make Squid benefit from a SMP system you will need to run multiple instances of Squid and find a way to distribute your users on the different Squid instances just as if you had multiple Squid boxes.