see first page of this thread:
"After you have changed this setting, restart the http proxy with '/var/mdw/scripts/httpproxy restart'. The proxy should start to fetch the database. You can watch that in /var/chroot-http/var/pattern/sfcontrol. The database will be approx. 350MB in size when finished. After finishing the download the proxy should use the local database." - in AngeloC's long post.
thx hallowach, i just tried it again with no luck, it seems that this not working for my customer's ASG 625 and his 10 k users [:(] is there any other way to fix this? the slowness problem is killing me an him.
you say 10k on a 625? It's not rated for 10k users. How do you have that machine configured? What is your cpu/ram/swap usage. I'm curious if the slowness isn't from just too much stuff being put onto the box.
i know that the box doesn't support 10k users but the box is not working with all features, thats why i am asking.also the CPU and the RAM normal after enabling the web filter on the box.CPU 9 % and the RAM 16 %
well if you have enabled the http proxy cff ram caching and it's still slow then that's not the issue. What's your wan speed? Also log in as root and run top. What's the load levels?
the afcd takes between 50 and 80 % of the CPU and the http proxy takes 15 % only,otherwise, nothing consuming the CPU or the box. the internet bandwidth is 155MB and up to 250 MB.
ok so the cpu is highly loaded. afcd is the ips/p2p control otherwise known as snort. so by your numbers you are using 65 to 95% cpu. afcd is the snort engine this means you have ips/p2p turned on. This is highly cpu/ram/bus intensive. you don't have enough cpu to move 10k users through that box and that's why you can't get the performance you want. you have a few choices:
1. reduce the suers on that segment 2. get a second 625 and do an active/active cluster 3. Build a custom monster box with at least 8 3ghz cores and 16 gigs of ram
You can try disabling all ids/p2p functions..if that helps then that's a bandaid..but doesn't address the underlying issue..you have too many users on the box.
afcd IS another snort. if hes using the cpu he says he is..the box is underpowered....badly. A bigger box will help if the cpu's are faster(both in raw clock and IPC). Keep in mind that Astaro launches multiple snort processes based on core count...so yeah..he's pounding the box. Try killing p2p/ips(so you turn off all snort processes no matter their name) and see if things don't improve.. dramatically...if they don't then your moving too much data for the cpu/bus systems to keep up with. You're going to need one of the options i listed.
