Re: [squid-users] wrong content in squid cache

Hello Henrik,

>>we use squid-2.5STABLE1 as shiped with SuSE Linux 8.2.
>>Since last week several clients get a wrong site from squid cache.
>>For example:
>>
>>
>>The client tries to fetch http://www.arbeitsamt.de and gets
>>the content of the side forums.groundspeak.com.
>
>
>Is this Squid directly connected to the Internet, or are you using any
>parent proxy?

there is a virusscanner (Trendmicro Viruswall 3.8.1) installed between
the squid and the internet.

>Can you also please try to get the request where this got into the
>cache.

this is the first one with the wrong content, because it is 5109 bytes.

this request was the last one befor the wrong one

--snip--
2004-09-11 06:18:13.000000708 45 10.32.67.85 TCP_MISS/302 211 HEAD http://www.arbeitsamt.de/ someuser DEFAULT_PARENT/127.0.0.1 -
--snip--

--snip--
2004-09-12 17:51:41.000000513 54 10.32.48.165 TCP_MISS/200 5109 GET http://www.arbeitsamt.de/ someuser DEFAULT_PARENT/127.0.0.1 text/html
2004-09-12 23:54:01.000000516 70 10.32.69.41 TCP_IMS_HIT/200 5124 GET http://www.arbeitsamt.de/ someuser NONE/- text/html
2004-09-12 23:56:33.000000688 26 10.32.69.41 TCP_IMS_HIT/304 283 GET http://www.arbeitsamt.de/ someuser NONE/- text/html
2004-09-13 00:27:03.000000824 40 10.32.67.85 TCP_CLIENT_REFRESH_MISS/302 210 HEAD http://www.arbeitsamt.de/ someuser DEFAULT_PARENT/127.0.0.1 -
2004-09-13 06:56:32.000000511 39 10.32.67.85 TCP_MISS/302 211 HEAD http://www.arbeitsamt.de/ someuser DEFAULT_PARENT/127.0.0.1 -
2004-09-13 10:03:20.000000547 53 10.32.67.85 TCP_MISS/302 211 HEAD http://www.arbeitsamt.de/ someuser DEFAULT_PARENT/127.0.0.1 -
--snip--

>All information you sent indicates Squid requested
>http://www.arbeitsamt.de and in return got a page which redirects to
>forums.groundspeak.com. What needs to be concluded is from where Squid
>got this redirection page.

So my assumption was that squid wrote wrong data to the cache.
Since I deaktivate the diskd, the problem is gone (for 2 days now)

>It does not look like Squid has mixed up to different pages.

I hope so.

-- 
Gruß
  Dieter
--
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
From field.