HTTP Anti-Virus Proxy
http://havp.hege.li/forum/

HAVP hanging
http://havp.hege.li/forum/viewtopic.php?f=3&t=307		 Page 1 of 1
Author:  makki [ 26 Oct 2007 01:23 ]
Post subject:  HAVP hanging
Hi,

I've havp 0.86 in front of squid 2.6 running on a Debian etch box..
3GHz, 512MB, fast RAID-10 in a VM, approx 200 Users..

some config:
SERVERNUMBER 50
FAILSCANERROR false
MAXSCANSIZE 1000000


Now things are fine so far, but every few days it happens the loadavg grows above 10 having dozens of havp processes eatingup the CPU until I restart it.
Unfortunately I haven't managed to reproduce this and is it's "productive" there's also not much time to troubleshoot before restarting when this happens.

Now I wonder at first stage: how to find out what havp is getting killed by ?

I set to log OKs now, is there any description of the log-format, i.e. what do the two numbers at the end mean? maybe request time?

TIA

Makki
Author:  hege [ 26 Oct 2007 08:19 ]
Post subject:  Re: HAVP hanging
makki wrote:
Now things are fine so far, but every few days it happens the loadavg grows above 10 having dozens of havp processes eatingup the CPU until I restart it.


Try to look at "ps axu --forest |grep havp" to see what processes are eating up the CPU. I would guess it's the last ones in the tree (scanners). If you are using ClamAV, most likely you are having some issues there. Maybe try upgrading, or try using clamd.

Quote:
I set to log OKs now, is there any description of the log-format, i.e. what do the two numbers at the end mean? maybe request time?


Nothing in error.log? The numbers you mean are transferred data size (header+body).
Author:  butz [ 26 Oct 2007 18:03 ]
Post subject: 
Hi,

here is simple suggestion from a production environment.

1. More detail configuration will helpful for debug.
2. 512MB is not good enough for "50" HAVP process, depend on how much virus scanner you used.

a simple case for you.
Use clamav , 57MB memory used for one havp process.

After peak request , you will need 2GB swap space, OS load will up to 20-30 or more , seems like died.
Page 1 of 1 All times are UTC + 2 hours [ DST ]
Powered by phpBB® Forum Software © phpBB Group
https://www.phpbb.com/