HTTP Anti-Virus Proxy

Hi,

I've havp 0.86 in front of squid 2.6 running on a Debian etch box..
3GHz, 512MB, fast RAID-10 in a VM, approx 200 Users..

some config:
SERVERNUMBER 50
FAILSCANERROR false
MAXSCANSIZE 1000000


Now things are fine so far, but every few days it happens the loadavg grows above 10 having dozens of havp processes eatingup the CPU until I restart it.
Unfortunately I haven't managed to reproduce this and is it's "productive" there's also not much time to troubleshoot before restarting when this happens.

Now I wonder at first stage: how to find out what havp is getting killed by ?

I set to log OKs now, is there any description of the log-format, i.e. what do the two numbers at the end mean? maybe request time?

TIA

Makki

Try to look at "ps axu --forest |grep havp" to see what processes are eating up the CPU. I would guess it's the last ones in the tree (scanners). If you are using ClamAV, most likely you are having some issues there. Maybe try upgrading, or try using clamd.



Nothing in error.log? The numbers you mean are transferred data size (header+body).

Hi,

here is simple suggestion from a production environment.

1. More detail configuration will helpful for debug.
2. 512MB is not good enough for "50" HAVP process, depend on how much virus scanner you used.

a simple case for you.
Use clamav , 57MB memory used for one havp process.

After peak request , you will need 2GB swap space, OS load will up to 20-30 or more , seems like died.