Refresh Pattern

The refresh_pattern directive controls the disk cache only indirectly. It helps Squid decide whether or not a given request can be a cache hit or must be treated as a miss. Liberal settings increase your cache hit ratio but also increase the chance that users receive a stale response. Conservative settings, on the other hand, decrease hit ratios and stale responses.

The refresh_pattern rules apply only to responses without an explicit expiration time. Origin servers can specify an expiration time with either the Expiresheader, or the Cache-Control: max-age directive.

You can put any number of refresh_pattern lines in the configuration file. Squid searches them in order for a regular expression match. When Squid finds a match, it uses the corresponding values to determine whether a cached response is fresh or stale. The refresh_pattern syntax is as follows:

refresh_pattern [-i] regexp min percent max [options]

For example:

refresh_pattern -i \.jpg$ 30 50% 4320 reload-into-ims
refresh_pattern -i \.png$ 30 50% 4320 reload-into-ims
refresh_pattern -i \.htm$ 0 20% 1440
refresh_pattern -i \.html$ 0 20% 1440
refresh_pattern -i . 5 25% 2880

The regexp parameter is a regular expression that is normally case-sensitive. You can make them case-insensitive with the -i option. Squid checks the refresh_pattern lines in order; it stops searching when one of the regular expression patterns matches the URI.

The min parameter is some number of minutes. It is, essentially, a lower bound on stale responses. A response can’t be stale unless its time in the cache exceeds the minimum value. Similarly, max is an upper limit on fresh responses. A response can’t be fresh unless its time in the cache is less than the maximum time.

Responses that fall between the minimum and maximum are subject to Squid’s last-modified factor(LM-factor) algorithm. For such responses, Squid calculates the response age and the LM-factor and compares it to the percent value. The response age is simply the amount of time passed since the origin server generated, or last validated, the response. The resource age is the difference between the Last-Modified and Date headers. The LM-factor is the ratio of the response age to the resource age.

Figure 7-2 demonstrates the LM-factor algorithm. Squid caches an object that is 3 hours old (based on the Date and Last-Modified headers). With an LM-factor value of 50%, the response will be fresh for the next 1.5 hours, after which the object expires and is considered stale. If a user requests the cached object during the fresh period, Squid returns an unvalidated cache hit. For a request that occurs during the stale period, Squid forwards a validation request to the origin server.

Figure 7-2. Calculating expiration times based on LM-factor

It’s important to understand the order that Squid checks the various values. Here is a simplified description of Squid’s refresh_pattern algorithm:

• The response is stale if the response age is greater than the refresh_pattern max value.
• The response is fresh if the LM-factor is less than the refresh_pattern percent value.
• The response is fresh if the response age is less than the refresh_pattern min value.
• Otherwise, the response is stale.

The refresh_pattern directive also has a handful of options that cause Squid to disobey the HTTP protocol specification. They are as follows:

override-expire

When set, this option causes Squid to check the min value before checking the Expires header. Thus, a non-zero min time makes Squid return an unvalidated cache hit even if the response is preexpired.

override-lastmod

When set, this option causes Squid to check themin value before the LM-factor percentage.

reload-into-ims

When set, this option makes Squid transform a request with a no-cache directive into a validation (If-Modified-Since) request. In other words, Squid adds an If-Modified-Since header to the request before forwarding it on. Note that this only works for objects that have a Last-Modifiedtimestamp. The outbound request retains the no-cache directive, so that it reaches the origin server.

ignore-reload

When set, this option causes Squid to ignore the no-cache directive, if any, in the request.

Sumber: etutorials.org

---

Sedikit tambahan hasil copas http://forum.linux.or.id

inad said: 

Baik saya coba jelaskan mekanisme refresh_pattern tapi sepengetahuan saya lho, siapa tahu penjelasannya meleset jauh, he he he … Silahkan dikomentari jika informasinya salah, maaf …. ha ha ha …

Mekanisme umum akses internet via web browser utk menguji validitas (‘freshness’) obyek yg tersimpan adl dg ‘menjenguk’ obyek tsb ke server asal/sumber dan membandingkannya dg obyek yg sama yg sudah tersimpan di lokal. Jadi memang ‘boros’ walaupun belum tentu setiap saat obyek tersebut diambil lho, jadi hanya sekedar di’tanyai’ saja ‘tgl lahirnya’ (dan ada beberapa info yg lain yg penting juga, tapi kita fokus di ‘umur’nya saja). Dg demikian saran utk teman-teman yg mengelola warnet adl dg memperbesar cache lokal web browser (internet temporary files-nya utk IE dan tidak salah default-nya 10% dari ukuran partisinya ya?). Kenapa kok ‘umur’ obyek (atau halaman web) diuji? Ya kira2 jawabannya supaya informasinya selalu yg terbaru dan tidak salah (kalau tidak mau yg terbaru dan selalu hanya mengakses yg sudah tersimpan di lokal cache web browser ya di-set saja mode ‘offline, dijamin akses akan sangat lebih cepat dan sangat hemat bandwidth, tapi dg konsekuensi ekstrim spt halaman tsb di server sudah dihapus, di sisi klien bakalan tidak tahu lho). Kepingin mjd ‘super boros’ dg asumsi tanpa Squid atau cache server (bukan lokal cache lho)? ya cache di web browser dimatikan saja shg setiap saat akses internet akan selalu mengambil obyek/halaman langsung dari server asal/sumbernya (tapi irit tempat di hardisk lokal, hanya ini keuntungannya). Jelas dari sisi latensi akan naik drastis. Kira2 sudah bisa dibayangkan ya? hi hi hi … (makanya beberapa ISP secara diam2 akan men’transparan’kan cache server dg maksud mau membantu ekstrimis yg ‘super boros’ ini tadi, he he he … apa hanya sekedar alasan buat mereka menghemat bw ya?)

Baik skrg masuk peran Squid yg pada dasarnya bersifat ‘shared’ obyek lokal dalam konteks 1 domain. Secara garis besar mekanisme kerjanya mirip dg ‘temporary cache’ lokal web browser itu tadi cuma bedanya dipakai bersama dg user yg lain. Yg membedakan dalam kaitannya dg refresh_pattern adl Squid tidak tidak akan ‘bertanya’ validitas obyek jika ternyata ‘umur’nya masih dalam durasi refresh_pattern-nya (default minimum Squid 120 menit atau 2 jam, kalau tidak salah). Jadi jika ‘umur’ obyek sejak di’lahir’kan belum mencapai 2 jam (utk contoh) maka Squid tidak akan mengakses server asal/sumber utk mengambil info ‘umur’nya, dg kata lain obyek akan dianggap masih valid selama durasi waktu tadi (2 jam, misalnya), alias penghematan bw dan peningkatan responsivitas akses.

Kerugian jika refresh_pattern minimum (min) terlalu lama, misalnya kita set 1 hari, jelas jika ternyata dalam waktu kurang dari 1 hari obyek di ujung server asal berubah, di sisi klien dan Squid-nya masih akan tetap dianggap valid, atau dg kata lain, informasinya salah/tidak akurat, lha halaman web-nya memang tidak sama dg yg di server. Bagi web desainer, contoh saja lho tanpa ada masuk diskriminasi, he he he … akan tidak suka krn ada kebutuhan ‘instan’ setiap kali mengubah atau memperbaiki halaman web di ujung server utk keperluan evaluasi (ya jelas tidak akan mau menunggu 1 hari utk melihat perubahannya, ha ha ha … benar ya?). Jadi intinya min refresh_pattern adalah keterangan kapan waktu ‘tersegera’ utk menguji validitas obyek. Jika obyek teruji masih valid, Squid akan mengambil dari lokal cache swap-nya, jika obyek sudah tidak valid ya jelas Squid akan mengambil obyek dari server asal. Sekarang masalahnya, bagaimana jika obyek tidak memiliki ‘umur’ atau info ‘tgl lahir’? (tidak semua web itu memiliki info ini lho, tergantung si web programernya).

Kapan menguji atau mengambil langsung dari server asal obyek ‘tak berumur’ ini, toh validitasnya tidak bisa diuji? Persentase dan nilai maksimum-lah yg akan menentukan (percentage max). Obyek tanpa umur ini tadi akan dianggap valid oleh Squid selama umur minimumnya 50% dari umur maksimumnya, misalnya. Utk contoh 50% 120 akan berarti obyek tanpa umur valid selama ‘umur’nya masih kurang dari 1 jam (50% dari 120 menit). Menurut pengalaman perubahan obyek2 HTTP di internet itu relatif ‘lamban’, maka kebiasaan saya pribadi demi Squid yg ‘agresif’ adalah antara 80% s/d 95% dg nilai maksimum hingga 1 bulan (berapa menit ya, sori lupa) dan utk FTP krn semakin jarang berubah bisa lebih lama lagi bisa hingga 3 bulan atau 6 bulan. Tentunya ini tergantung profil pengguna internet anda lho, hanya contoh ekstrim saja. Jadi saat ‘umum’ maksimum yg sudah didefinisikan di refresh_pattern tercapai, jelas Squid akan ‘menjenguk’ obyek tsb ke asal servernya. Dg asumsi obyek masih sama maka Squid akan mengambil dari loka cache swap-nya. Jika ternyata obyek sudah berbeda, misalnya dari ukuran file atau saat file obyek tsb berbeda, maka Squid akan mengambil dari server tsb.

Opsi override-lastmod dan reload-into-ims kepanjangannya adalah ‘override last modification’ dan ‘reload into if-modified-since’. Override-lastmod akan meng’override’ perubahan yg terjadi di server asal obyek dg mengabaikan validitasnya hingga minimum refresh_pattern-nya tercapai. Efeknya obyek di lokal Squid bisa berbeda dg obyek yg di server asal. Tapi opsi ini masih mengijinkan si user ‘memaksa’ menguji validitasnya dg menekan tomboh ‘reload’ atau ‘refresh’ di web browser. Opsi ini, kalau saya memandangnya ‘agak menipu sedikit’, he he he … Sbg contoh di atas, saya yakin obyek di ujung server sudah berubah walaupun terakhir saya akses baru 10 menit yg lalu (min refresh_pattern=120 menit, misalnya), maka dg menekan tombol ‘reload’ di browser saya akan bisa menguji validitas obyek tsb dg yg di server asal, dan jika ternyata ya benar obyek tsb sudah berubah, jelas Squid akan langsung mengambil obyek lebih baru dari server asal. Jika saya biarkan saja akses ke obyek tsb tanpa menekan tombol ‘reload’ di browser maka mekanisme uji validitas mempergunakan min refresh_pattern akan berlaku biasa. (kadang saya punya pemikiran bgmana jika ada mesin klien yg ‘usil’ membangkitkan ‘reload’ atau ‘refresh’ dg intensif sekali shg Squid kewalahan, apakah bisa DoS semacam ini ya?, he he he … “boys and girls, please don’t try this at home”, ha ha ha).

Opsi reload-into-ims akan mengubah atau memodifikasi ‘umur’ obyek sehingga seakan-akan ‘dilahirkan’ kembali atau ‘direset’. Misalnya saya pernah mengakses suatu obyek suatu obyek 1,5 jam yg lalu, dan saya akses lagi obyek yg sama sekarang, maka ‘umur’ obyek yg sama ini akan dianggap ‘fresh’ atau obyek baru dan sudah tidak berumur 1,5 jam yg lalu. Keuntungan opsi ini adalah mekanisme ‘penyegaran’ umur obyek populer sehingga tidak pernah mjd ‘tua’ hingga nilai percentage dan maksimumnya tercapai, sekali lagi ‘agak menipu’, he he he … Kendali penuh tetap di user utk menekan tombol ‘reload’ atau ‘refresh’ jika tidak yakin obyek ‘fresh’.

Jadi kira2 dan sepemahanan saya mekanisme refresh_pattern Squid spt ini. Utk konfigurasi yg ‘pas’ utk keperluan anda ya silahkan bereksperimen sendiri krn keperluan dan profil user plus kemampuan h/w juga berbeda. Begitu saja, semoga bermanfaat dan masuk akal ya, yg paling penting tidak menambah kebingungan, hi hi hi ….

mulyadi.santosa said:

Halo gan

Ane paling inget soal regular expressionnya, jadi ane terangkan soal itu aja yah …

^http:\/\/apps.facebook.com.*\/

kita break down sebagai berikut:

^ –> matching di awal…. jadi maksudnya, jika ada regex (regular expression) tanpa ^ semisal “*hoho*” maka dia akan match dengan kata “hehoho” juga “hohoho”, tapi kalau ^hoho* maka harus depannya hoho contoh hohohehe atau hohohoho

\/\/–> ini sebenarnya mau ngomong tanda //, cuma kita gak bisa langsung nulis demikian. Kenapa? karena tanda / punya makna khusus. Jadi supaya dianggap sebagai karakter biasa, maka di “escape” dengan\. Jadilah \/\/

tanda * yang mengikuti “com.”, artinya terserah kata apapun mengikuti “apps.facebook.com”, misal “apps.facebook.com/doel” dst

jadi secara lengkap, ini artinya untuk memberikan suatu aturan kapan harus refresh bagi website dari domain facebook.com, lebih khususnya aplikasinya (game misalnya).

ane lupa maknya parameter sisanya, tapi ane bisa artikan secara umum, itu maksudnya agar isi website dari apps.facebook.com dicache selama mungkin dan bahkan mengabaikan permintaan refresh dari user. Inilah yang dimaksud oleh manual si squid sebagai “hal berbahaya”  Berbahaya karena ya ini melanggar protokol HTTP yang mengurusi soal browsing.

Semoga membantu

refresh_pattern

# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp:  1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern .  0 20% 4320

usage: refresh_pattern [-i] regex min percent max [options]

 By default, regular expressions are CASE-SENSITIVE.  To make
 them case-insensitive, use the -i option.

 'Min' is the time (in minutes) an object without an explicit
 expiry time should be considered fresh. The recommended
 value is 0, any higher values may cause dynamic applications
 to be erroneously cached unless the application designer
 has taken the appropriate actions.

 'Percent' is a percentage of the objects age (time since last
 modification age) an object without explicit expiry time
 will be considered fresh.

 'Max' is an upper limit on how long objects without an explicit
 expiry time will be considered fresh.

 options: override-expire
   override-lastmod
   reload-into-ims
   ignore-reload
   ignore-no-cache
   ignore-no-store
   ignore-must-revalidate
   ignore-private
   ignore-auth
   refresh-ims

  override-expire enforces min age even if the server
  sent an explicit expiry time (e.g., with the
  Expires: header or Cache-Control: max-age). Doing this
  VIOLATES the HTTP standard.  Enabling this feature
  could make you liable for problems which it causes.

  Note: override-expire does not enforce staleness - it only extends
  freshness / min. If the server returns a Expires time which
  is longer than your max time, Squid will still consider
  the object fresh for that period of time.

  override-lastmod enforces min age even on objects
  that were modified recently.

  reload-into-ims changes client no-cache or ``reload''
  to If-Modified-Since requests. Doing this VIOLATES the
  HTTP standard. Enabling this feature could make you
  liable for problems which it causes.

  ignore-reload ignores a client no-cache or ``reload''
  header. Doing this VIOLATES the HTTP standard. Enabling
  this feature could make you liable for problems which
  it causes.

  ignore-no-cache ignores any ``Pragma: no-cache'' and
  ``Cache-control: no-cache'' headers received from a server.
  The HTTP RFC never allows the use of this (Pragma) header
  from a server, only a client, though plenty of servers
  send it anyway.

  ignore-no-store ignores any ``Cache-control: no-store''
  headers received from a server. Doing this VIOLATES
  the HTTP standard. Enabling this feature could make you
  liable for problems which it causes.

  ignore-must-revalidate ignores any ``Cache-Control: must-revalidate``
  headers received from a server. Doing this VIOLATES
  the HTTP standard. Enabling this feature could make you
  liable for problems which it causes.

  ignore-private ignores any ``Cache-control: private''
  headers received from a server. Doing this VIOLATES
  the HTTP standard. Enabling this feature could make you
  liable for problems which it causes.

  ignore-auth caches responses to requests with authorization,
  as if the originserver had sent ``Cache-control: public''
  in the response header. Doing this VIOLATES the HTTP standard.
  Enabling this feature could make you liable for problems which
  it causes.

  refresh-ims causes squid to contact the origin server
  when a client issues an If-Modified-Since request. This
  ensures that the client will receive an updated version
  if one is available.

 Basically a cached object is:

  FRESH if expires < now, else STALE
  STALE if age > max
  FRESH if lm-factor < percent, else STALE
  FRESH if age < min
  else STALE

 The refresh_pattern lines are checked in the order listed here.
 The first entry which matches is used.  If none of the entries
 match the default will be used.

 Note, you must uncomment all the default lines if you want
 to change one. The default setting is only active if none is
 used.

http_access

Option Name: http_access Replaces: Requires: Default Value: http_access deny all Suggested Config:

#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager

# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

 Allowing or Denying access based on defined access lists

 Access to the HTTP port:
 http_access allow|deny [!]aclname ...

 NOTE on default values:

 If there are no "access" lines present, the default is to deny
 the request.

 If none of the "access" lines cause a match, the default is the
 opposite of the last line in the list.  If the last line was
 deny, the default is allow.  Conversely, if the last line
 is allow, the default will be deny.  For these reasons, it is a
 good idea to have an "deny all" entry at the end of your access
 lists to avoid potential confusion.

 This clause supports both fast and slow acl types.
 See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.

Sumber: http://www.squid-cache.org/Versions/v3/3.1/cfgman/http_access.html

follow_x_forwarded_for

Option Name:	follow_x_forwarded_for
Replaces:
Requires:	–enable-follow-x-forwarded-for
Default Value:	follow_x_forwarded_for deny all
Suggested Config:

Allowing or Denying the X-Forwarded-For header to be followed to find the original source of a request. Requests may pass through a chain of several other proxies before reaching us. The X-Forwarded-For header will contain a comma-separated list of the IP addresses in the chain, with the rightmost address being the most recent. If a request reaches us from a source that is allowed by this configuration item, then we consult the X-Forwarded-For header to see where that host received the request from. If the X-Forwarded-For header contains multiple addresses, we continue backtracking until we reach an address for which we are not allowed to follow the X-Forwarded-For header, or until we reach the first address in the list. For the purpose of ACL used in the follow_x_forwarded_for directive the src ACL type always matches the address we are testing and srcdomain matches its rDNS. The end result of this process is an IP address that we will refer to as the indirect client address. This address may be treated as the client address for access control, ICAP, delay pools and logging, depending on the acl_uses_indirect_client, icap_uses_indirect_client, delay_pool_uses_indirect_client and log_uses_indirect_client options. This clause only supports fast acl types. See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details. SECURITY CONSIDERATIONS: Any host for which we follow the X-Forwarded-For header can place incorrect information in the header, and Squid will use the incorrect information as if it were the source address of the request. This may enable remote hosts to bypass any access control restrictions that are based on the client's source addresses. For example: acl localhost src 127.0.0.1 acl my_other_proxy srcdomain .proxy.example.com follow_x_forwarded_for allow localhost follow_x_forwarded_for allow my_other_proxy

Sumber:	http://www.squid-cache.org/Versions/v3/3.1/cfgman/follow_x_forwarded_for.html

ACL

Option Name:	acl
Replaces:
Requires:
Default Value:	acl all src all
Suggested Config:

# # Recommended minimum configuration: # acl manager proto cache_object acl localhost src 127.0.0.1/32 ::1 acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1 # Example rule allowing access from your local networks. # Adapt to list your (internal) IP networks from where browsing # should be allowed acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT

 Defining an Access List

 Every access list definition must begin with an aclname and acltype, 
 followed by either type-specific arguments or a quoted filename that
 they are read from.

    acl aclname acltype argument ...
    acl aclname acltype "file" ...

 When using "file", the file should contain one item per line.

 By default, regular expressions are CASE-SENSITIVE.
 To make them case-insensitive, use the -i option. To return case-sensitive
 use the +i option between patterns, or make a new ACL line without -i.

 Some acl types require suspending the current request in order
 to access some external data source.
 Those which do are marked with the tag [slow], those which
 don't are marked as [fast].
 See http://wiki.squid-cache.org/SquidFaq/SquidAcl
 for further information

 ***** ACL TYPES AVAILABLE *****

 acl aclname src ip-address/netmask ... # clients IP address [fast]
 acl aclname src addr1-addr2/netmask ... # range of addresses [fast]
 acl aclname dst ip-address/netmask ... # URL host's IP address [slow]
 acl aclname myip ip-address/netmask ... # local socket IP address [fast]

 acl aclname arp      mac-address ... (xx:xx:xx:xx:xx:xx notation)
   # The arp ACL requires the special configure option --enable-arp-acl.
   # Furthermore, the ARP ACL code is not portable to all operating systems.
   # It works on Linux, Solaris, Windows, FreeBSD, and some
   # other *BSD variants.
   # [fast]
   #
   # NOTE: Squid can only determine the MAC address for clients that are on
   # the same subnet. If the client is on a different subnet,
   # then Squid cannot find out its MAC address.

 acl aclname srcdomain   .foo.com ...
   # reverse lookup, from client IP [slow]
 acl aclname dstdomain   .foo.com ...
   # Destination server from URL [fast]
 acl aclname srcdom_regex [-i] \.foo\.com ...
   # regex matching client name [slow]
 acl aclname dstdom_regex [-i] \.foo\.com ...
   # regex matching server [fast]
   #
   # For dstdomain and dstdom_regex a reverse lookup is tried if a IP
   # based URL is used and no match is found. The name "none" is used
   # if the reverse lookup fails.

 acl aclname src_as number ...
 acl aclname dst_as number ...
   # [fast]
   # Except for access control, AS numbers can be used for
   # routing of requests to specific caches. Here's an
   # example for routing all requests for AS#1241 and only
   # those to mycache.mydomain.net:
   # acl asexample dst_as 1241
   # cache_peer_access mycache.mydomain.net allow asexample
   # cache_peer_access mycache_mydomain.net deny all

 acl aclname peername myPeer ...
   # [fast]
   # match against a named cache_peer entry
   # set unique name= on cache_peer lines for reliable use.

 acl aclname time [day-abbrevs] [h1:m1-h2:m2]
   # [fast]
   #  day-abbrevs:
   # S - Sunday
   # M - Monday
   # T - Tuesday
   # W - Wednesday
   # H - Thursday
   # F - Friday
   # A - Saturday
   #  h1:m1 must be less than h2:m2

 acl aclname url_regex [-i] ^http:// ...
   # regex matching on whole URL [fast]
 acl aclname urlpath_regex [-i] \.gif$ ...
   # regex matching on URL path [fast]

 acl aclname port 80 70 21 0-1024...   # destination TCP port [fast]
                                       # ranges are alloed
 acl aclname myport 3128 ...           # local socket TCP port [fast]
 acl aclname myportname 3128 ...       # http(s)_port name [fast]

 acl aclname proto HTTP FTP ...        # request protocol [fast]
 
 acl aclname method GET POST ...       # HTTP request method [fast]

 acl aclname http_status 200 301 500- 400-403 ... 
   # status code in reply [fast]

 acl aclname browser [-i] regexp ...
   # pattern match on User-Agent header (see also req_header below) [fast]

 acl aclname referer_regex [-i] regexp ...
   # pattern match on Referer header [fast]
   # Referer is highly unreliable, so use with care

 acl aclname ident username ...
 acl aclname ident_regex [-i] pattern ...
   # string match on ident output [slow]
   # use REQUIRED to accept any non-null ident.

 acl aclname proxy_auth [-i] username ...
 acl aclname proxy_auth_regex [-i] pattern ...
   # perform http authentication challenge to the client and match against
   # supplied credentials [slow]
   #
   # takes a list of allowed usernames.
   # use REQUIRED to accept any valid username.
   #
   # Will use proxy authentication in forward-proxy scenarios, and plain
   # http authenticaiton in reverse-proxy scenarios
   #
   # NOTE: when a Proxy-Authentication header is sent but it is not
   # needed during ACL checking the username is NOT logged
   # in access.log.
   #
   # NOTE: proxy_auth requires a EXTERNAL authentication program
   # to check username/password combinations (see
   # auth_param directive).
   #
   # NOTE: proxy_auth can't be used in a transparent/intercepting proxy
   # as the browser needs to be configured for using a proxy in order
   # to respond to proxy authentication.

 acl aclname snmp_community string ...
   # A community string to limit access to your SNMP Agent [fast]
   # Example:
   #
   # acl snmppublic snmp_community public

 acl aclname maxconn number
   # This will be matched when the client's IP address has
   # more than  TCP connections established. [fast]
   # NOTE: This only measures direct TCP links so X-Forwarded-For
   # indirect clients are not counted.

 acl aclname max_user_ip [-s] number
   # This will be matched when the user attempts to log in from more
   # than  different ip addresses. The authenticate_ip_ttl
   # parameter controls the timeout on the ip entries. [fast]
   # If -s is specified the limit is strict, denying browsing
   # from any further IP addresses until the ttl has expired. Without
   # -s Squid will just annoy the user by "randomly" denying requests.
   # (the counter is reset each time the limit is reached and a
   # request is denied)
   # NOTE: in acceleration mode or where there is mesh of child proxies,
   # clients may appear to come from multiple addresses if they are
   # going through proxy farms, so a limit of 1 may cause user problems.

 acl aclname req_mime_type [-i] mime-type ...
   # regex match against the mime type of the request generated
   # by the client. Can be used to detect file upload or some
   # types HTTP tunneling requests [fast]
   # NOTE: This does NOT match the reply. You cannot use this
   # to match the returned file type.

 acl aclname req_header header-name [-i] any\.regex\.here
   # regex match against any of the known request headers.  May be
   # thought of as a superset of "browser", "referer" and "mime-type"
   # ACL [fast]

 acl aclname rep_mime_type [-i] mime-type ...
   # regex match against the mime type of the reply received by
   # squid. Can be used to detect file download or some
   # types HTTP tunneling requests. [fast]
   # NOTE: This has no effect in http_access rules. It only has
   # effect in rules that affect the reply data stream such as
   # http_reply_access.

 acl aclname rep_header header-name [-i] any\.regex\.here
   # regex match against any of the known reply headers. May be
   # thought of as a superset of "browser", "referer" and "mime-type"
   # ACLs [fast]

 acl aclname external class_name [arguments...]
   # external ACL lookup via a helper class defined by the
   # external_acl_type directive [slow]

 acl aclname user_cert attribute values...
   # match against attributes in a user SSL certificate
   # attribute is one of DN/C/O/CN/L/ST [fast]

 acl aclname ca_cert attribute values...
   # match against attributes a users issuing CA SSL certificate
   # attribute is one of DN/C/O/CN/L/ST [fast]

 acl aclname ext_user username ...
 acl aclname ext_user_regex [-i] pattern ...
   # string match on username returned by external acl helper [slow]
   # use REQUIRED to accept any non-null user name.

 acl aclname tag tagvalue ...
   # string match on tag returned by external acl helper [slow]

 Examples:
  acl macaddress arp 09:00:2b:23:45:67
  acl myexample dst_as 1241
  acl password proxy_auth REQUIRED
  acl fileupload req_mime_type -i ^multipart/form-data$
  acl javascript rep_mime_type -i ^application/x-javascript$ 

Sumber: http://www.blogger.com/blogger.g?blogID=4178251841297857100#editor/target=post;postID=4640298480786995324 

Memasang Widget Yahoo Messenger Pada Blog

Yahoo Messenger atau sering disebut dengan YM merupakan fasilitas chatting yang sangat populer pada masa sekarang. Dengan adanya Yahoo Messenger, kita bisa mengirimkan pesan instan (lebih dikenal dengan IM). Pesan instan digunakan untuk berkomunikasi dengan teman-teman pada internet dengan akses yang cepat. Semua pengguna internet pasti sudah tau maksud dan tujuan dari pada Yahoo Messenger ini, jadi saya tidak akan menjelaskan lebih detail tentang Yahoo Messenger karena topik postingan kali ini adalah bagaimana caranya Memasang Widget Yahoo Messenger Pada Blog.

Apa sih gunanya menampilkan Widget Yahoo Messenger Pada Blog ? Mungkin ada sebagian anda yang bertanya seperti itu. Nah, adapun kegunaannya tidak lain dan tidak bukan adalah agar pengunjung tau apakah Admin sedang Online atau Offline. Jadi, pengunjung bisa berinteraksi langsung dengan Admin jika ada pertanyaan atau hal2 lain yang ingin di ajukan. Agar Widget Yahoo Messenger bisa langsung terpasang diblog, terlebih dahulu pilih salah satu bentuk widget dibawah ini kemudian copy kode nya.

bank_moel_dech”>
bank_moel_dech&m=g&t=6″/>

atau

bank_moel_dech”>
bank_moel_dech&m=g&t=2“/>

Kemudian masuk ke Account Blogger anda –>> Pilih Tata Letak —>> Tambah Gadget Html java script kemudian masukkan kode diatas —>> Simpan.

Keterangan :
—>> Teks berwarna merah ganti dengan ID YM anda

Sumber: http://zona-klik.blogspot.com/2009/08/memasang-widget-yahoo-messenger-pada.html

Cara Membuat "READMORE" Otomatis di Blogspot

Cara membuat read more pada blog, blogspot, blogger ini sangat mudah sekali, karena hanya tinggal mengcopykan script code yang ada ke template blogspot anda, dan Berikut ini cara yang mudah untuk membuat Read More Otomatis dengan Thumbnail di Blogger seperti halnya yang digunakan pada Blog. sebelum anda memulai membuat read more pada blog, blogspot, blogger yang harus anda lakukan adalah sebagai berikut :

► Silahkan Login dan masuk di akun blogger anda

► lalu klik Rancangan dan klik Edit HTML

► Centang Expand Template Widget

► Untuk mempermudah pencarian kode HTML nya anda tekan aja ( CTRL + F )

► Cari kode </head> dan kalau sudah ketemu

► Lalu silahkan Tambahkan kode dibawah ini tepatnya diatas kode </head>

<script type='text/javascript'>
var thumbnail_mode = "float" ;
summary_noimg = 250;
summary_img = 250;
img_thumb_height = 120;
img_thumb_width = 120;
</script>
<script type='text/javascript'>
//<![CDATA[
/******************************************
Auto-readmore link script, version 2.0 (for blogspot)
visit : http://caramembuatada.blogspot.com
********************************************/
function removeHtmlTag(strx,chop){
if(strx.indexOf("<")!=-1)
{
var s = strx.split("<");
for(var i=0;i<s.length;i++){
if(s[i].indexOf(">")!=-1){
s[i] = s[i].substring(s[i].indexOf(">")+1,s[i].length);
}
}
strx = s.join("");
}
chop = (chop < strx.length-1) ? chop : strx.length-2;
while(strx.charAt(chop-1)!=' ' && strx.indexOf(' ',chop)!=-1) chop++;
strx = strx.substring(0,chop-1);
return strx+'...';
}

function createSummaryAndThumb(pID){
var div = document.getElementById(pID);
var imgtag = "";
var img = div.getElementsByTagName("img");
var summ = summary_noimg;
if(img.length>=1) {
imgtag = '<span style="float:left; padding:0px 10px 5px 0px;"><img src="'+img[0].src+'" width="'+img_thumb_width+'px" height="'+img_thumb_height+'px"/></span>';
summ = summary_img;
}

var summary = imgtag + '<div>' + removeHtmlTag(div.innerHTML,summ) + '</div>';
div.innerHTML = summary;
}
//]]>
</script>

Bila anda ingin merubah ukuran Read More Pada Blog, Blogspot, Blogger anda, ubah aja di bagian-bagian kode di bawah ini, dan Ubah angka nya sesuai kebutuhan:

summary_noimg = 430; adalah tinggi potongan artikel tanpa gambar

summary_img = 340; adalah tinggi potongan artikel dengan gambar

img_thumb_height = 100; adalah ukuran tinggi thumbnail

img_thumb_width = 120; adalah ukuran lebar thumbnail

► langkah Selanjutnya cari kode <data:post.body/> atau <p><data:post.body/></p> lalu ganti tag tersebut dengan kode script di bawah ini :

<b:if cond='data:blog.pageType != "item"'>
<div style=' text-align: justify;' expr:id='"summary" + data:post.id'><data:post.body/></div>
<script type='text/javascript'>createSummaryAndThumb("summary<data:post.id/>");</script>
<span class='rmlink' style='float:left'><a expr:href='data:post.url'>READ MORE - <data:post.title/></a></span>
</b:if>
<b:if cond='data:blog.pageType == &quot;item&quot;'><data:post.body/></b:if>

► dan untuk kata ” READ MORE “ bisa diganti sesuai dengan selera anda.

setelah dipastikan semua udah terpasang dengan benar langkah selanjutnya adalah simpan template dan coba lihatlah hasilnya.

Okelah sobat itulah artikel tentang Cara Membuat Read More Pada Blog, Blogspot, Blogger yang mungkin bisa sedikit membantu anda. dan ingat, sebelum anda memasukan kode2 diatas sebaiknya anda backup terlebih dahulu template dengan cara download lengkap tempalte, langkah ini untuk antisipasi bila anda salah memasukkan kode yang ada.

sumber : http://www.gallerydunia.com/2011/01/cara-membuat-read-more-pada-blog.html

############

summary_noimg = 400; summary_img = 350; img_thumb_height = 110; img_thumb_width = 110; //<![CDATA[ function removeHtmlTag(strx,chop){ if(strx.indexOf("<")!=-1) { var s = strx.split("<"); for(var i=0;i“)!=-1){ s[i] = s[i].substring(s[i].indexOf(“>”)+1,s[i].length); } } strx = s.join(“”); } chop = (chop =1) { imgtag = ‘‘; summ = summary_img; } var summary = imgtag + ‘

‘ + removeHtmlTag(div.innerHTML,summ) + ‘

‘; div.innerHTML = summary; }

Bikin Terminal di ClearOS Lebih Berwarna dengan CCZE

Mau bikin terminal ClearOS Anda lebih berwarna seperti di bawah ini??

Ikuti langkahnya seperti ini

1. Siapkan Putty. 2. Masuk dengan user dan password anda.
3. Masukkan command di bawah ini (copy paste saja)

rpm -Uvh http://mirror.fraunhofer.de/download.fedora.redhat.com/epel/5Client/i386/ccze-0.2.1-6.el5.i386.rpm

4. Sudah selesai. contoh kalau mau lihat log history client atau Hit squid tinggal di tambah command “| ccze”. misalnya

# tail -f /var/log/squid/access.log | ccze

Sumber:
http://www.clearfoundation.com/component/option,com_kunena/Itemid,232/catid,40/func,view/id,31177/
http://belajar-clearos.blogspot.com/2011/10/bikin-terminal-di-clearos-lebih.html

IGOS Nusantara dan proxy server squid kompilasi

Optimasi squid dapat lebih ditingkatkan dengan melakukan kompilasi dari source squid. 

1. Spesifikasi Server

Berikut ini kompilasi squid untuk spesifikasi:

1. Sistem Operasi memakai IGOS Nusantara 2010 (Instal minimal)
2. Posesor Intel(R) Xeon(TM) CPU 3.00GHz
3. RAM 1 GB (yup memori masih kecil, harusnya update ke 4 GB)
4. Harddisk 2 x 80 GB SCSI
   • Harddisk1: /dev/sda (untuk menyimpan sistem operasi)
   • Harddisk2: /dev/sdb (untuk menyimpan cache squid)

2. Prasyarat untuk optimasi squid

Sebelum melakukan kompilasi squid, beberapa hal sudah selesai dikonfigurasi dan berfungsi denganbaik, yaitu:

1. Mengetahui skema jaringan, ada di: http://igos-nusantara.or.id/wiki/Skema_Jaringan
2. Instal IGOS Nusantara sebagai server, memakai pilihan minimal/konsol, ada di: http://igos-nusantara.or.id/wiki/Instal_IGOS_Nusantara_minimal-konsol
3. Memformat harddisk kedua, ada di: http://igos-nusantara.or.id/wiki/Memformat_harddisk_kedua
4. Tuning file sistem, ada di: http://igos-nusantara.or.id/wiki/Tuning_file_sistem

3. Kompilasi Squid

Pasang paket untuk kompilasi squid

# yum -y install gcc 
# yum -y install gcc-c++
# yum -y install libxml2-devel libcap-devel

Instal semua dalam satu baris perintah:

# yum -y install gcc gcc-c++ libxml2-devel libcap-devel

Unduh squid-3.1.10.tar.bz2

# mkdir /root/sumber
# cd /root/sumber
# wget http://www.squid-cache.org/Versions/v3/3.1/squid-3.1.10.tar.bz2

Buat group dan user

Group dan user yang akan dipakai untuk menjalankan squid dibuat dengan cara:

# useradd squid -c "Squid Proxy" -M -d /cache/proxy1 -s /bin/false

Optimasi Kompilasi

Kompilasi agar optimal perlu memakai opsi atau FLAG yang sesuai dengan prosesor. Informasi tentang prosesor ada di /proc/cpuinfo

# cat /proc/cpuinfo

# cat /proc/cpuinfo | grep family
cpu family : 15
cpu family : 15

[root@intra ~]# cat /proc/cpuinfo |grep model
model  : 4
model name : Intel(R) Xeon(TM) CPU 3.00GHz

Informasi yang diperoleh dari /proc/cpuinfo kemudian disesuaikan dengan flag kompilasi yang ada Gentoo Wiki[1], yaitu diperoleh:

CHOST="i686-pc-linux-gnu"
CFLAGS="-march=prescott -O2 -pipe -fomit-frame-pointer"
CXXFLAGS="${CFLAGS}"

Parameter Kompilasi

Paramater yang dipakai untuk kompilasi sebagian disesuaikan dengan squid.spec yang ada squid-*-.src.rpm dari Fedora 13 (F13). Info: F13 adalah basis IGOS Nusantara 2010. Berikut penjelasan sebagian parameter yang akan dipakai saat kompilasi:

• –enable-async-io untuk mengaktifkan asynchronous I/O dalam proses baca/tulis ke harddisk. Memakai 16 bila memakai satu harddisk jenis lama (buffer hanya 2 MB). Bila memakai harddisk model baru dengan buffer 8 MB, 16 MB atau 32 MB dapat memakai 32.
• –enable-useragent-log berguna agar squid mencatat useragent di entri log
• –enable-snmp aktifkan snmp, misal mencatat statistik squid lalu ditampilkan dalam bentuk grafik.
• –enable-cache-digests harus diaktifkan jika memakai cache peer.
• –enable-storeio=”aufs” adalah metoda penyimpanan metode I/O. AUFS adalah Asynchronous, memiliki performa yang optimal di Linux.
• –enable-removal-policies=”heap,lru” adalah pilihan opsi untuk removal policies
• –with-maxfd=8192
• –enable-poll
• –disable-ident-lookups menghentikan squid dari melihat ident di setiap koneksi, bisa juga untuk mencegah serangan DDOS (membuka ribuan koneksi) yang dapat mematikan squid server
• –enable-truncate memerintahkan squid untuk selalu menggunakan truncate() ketimbang unlink() ketika menghapus file cache.
• –enable-delay-pools

Memulai Kompilasi

# cd /root/sumber
# tar xjvf squid-3.1.10.tar.bz2
# cd squid-3.1.10
# CHOST="i686-pc-linux-gnu" \
CFLAGS="-march=prescott -O2 -pipe -fomit-frame-pointer" \
CXXFLAGS="${CFLAGS}" \
./configure \
--bindir=/usr/bin \
--datadir=/usr/share \
--exec-prefix=/usr \
--includedir=/usr/include \
--infodir=/usr/share/info \
--libexecdir=/usr/libexec \
--localstatedir=/var \
--mandir=/usr/share/man \
--prefix=/usr \
--program-prefix= \
--sbindir=/usr/sbin \
--sharedstatedir=/var/lib \
--sysconfdir=/etc/squid \
--disable-auth \
--disable-basic-auth-helpers \
--disable-dependency-tracking \
--disable-digest-auth-helpers \
--disable-epoll \
--disable-external-acl-helpers \
--disable-hostname-checks \
--disable-htcp \
--disable-ident-lookups \
--disable-ipv6 \
--disable-linux-tproxy \
--disable-negotiate-auth-helpers \
--disable-ntlm-auth-helpers \
--disable-snmp \
--disable-translation \
--disable-wccp \
--disable-wccpv2 \
--enable-arp-acl \
--enable-auth=basic,digest \
--enable-async-io=32 \
--enable-cache-digests \
--enable-cachemgr-hostname=localhost \
--enable-default-err-languages=English \
--enable-delay-pools \
--enable-err-languages=English \
--enable-follow-x-forwarded-for \
--enable-gnuregex \
--enable-icmp \
--enable-linux-transparent \
--enable-linux-netfilter \
--enable-removal-policies=heap,lru \
--enable-storeio=aufs \
--enable-underscores \
--enable-useragent-log \
--enable-zph-qos \
--with-aufs-threads=32 \
--with-default-user=squid \
--with-dl \
--with-filedescriptors=32768 \
--with-large-files \
--with-logdir=/var/log/squid \
--with-maxfd=32768 \
--with-pidfile=/var/run/squid.pid \
--with-pthreads 

Selanjutnya ketikkan perintah

# make

Lanjutkan dengan

# make install

Ketik perintah

# ls -l /usr/sbin/squid
-rwxr-xr-x 1 root root 2521209 Jan 29 13:30 /usr/sbin/squid

# strip /usr/sbin/squid

# ls -l /usr/sbin/squid
-rwxr-xr-x 1 root root 2121976 Jan 29 13:31 /usr/sbin/squid

4. Konfigurasi

Konfigurasi squid.conf

# localhost
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32

# Jaringan lokal yang boleh mengakses
#acl ip-admin src 192.168.228.10/32
#acl localnet src 10.0.0.0/8
#acl localnet src 172.16.0.0/12
acl localnet src 192.168.228.0/24

acl SSL_ports port 443 563 # https, snews
acl Safe_ports port 80 81 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 631 # cups
acl Safe_ports port 10000 # webmin
acl Safe_ports port 777 # multiling http
acl Safe_ports port 873 # rsync
acl Safe_ports port 901 # SWAT
acl CONNECT method CONNECT

# Akses cachemgr hanya boleh dari localhost
# http_access allow manager ip-admin
http_access allow manager localhost
http_access deny manager

# Tolak permintaan ke Safe_ports
http_access deny !Safe_ports

# Tolak CONNECT ke selain SSL ports
http_access deny CONNECT !SSL_ports
http_access deny to_localhost
http_access allow localnet
http_access allow localhost

# Terakhir: tolak yang lainnya untuk akses ke proxy
http_access deny all

http_port 3128 transparent
icp_port 3130

max_filedescriptors 32768
dns_nameservers 127.0.0.1

hierarchy_stoplist cgi-bin ? .js .jsp .awt 
acl QUERY urlpath_regex cgi-bin \? localhost
no_cache deny QUERY

cache_mgr admin
cache_effective_user squid
cache_effective_group squid
visible_hostname proxy

memory_replacement_policy heap LFUDA
cache_replacement_policy heap GDSF

# Ukuran 50GB untuk cache_dir (contoh memakai harddisk SCSI)
# cache_dir aufs /cache/proxy1 50000 102 256
cache_dir aufs /cache/proxy1 7500 16 256

# cache_mem 256 MB
cache_mem 128 MB

minimum_object_size 0 KB
maximum_object_size 128 MB
maximum_object_size_in_memory 64 KB

cache_swap_low 98
cache_swap_high 99

#high_response_time_warning 2000
#high_page_fault_warning 2
#high_memory_warning 1900 MB

mime_table /etc/squid/mime.conf
pid_filename /var/run/squid.pid
# coredump_dir /cache/proxy1/
coredump_dir none

access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log

#access_log none
#cache_log /dev/null
#cache_store_log none

emulate_httpd_log off
logfile_rotate 2
log_fqdn off
buffered_logs off
client_netmask 255.255.255.255
strip_query_terms off

refresh_pattern windowsupdate.com/.*\.(cab|exe\dll) 259200 95% 259200 override-expire override-lastmod reload-into-ims ignore-reload ignore-no-cache ignore-private
refresh_pattern download.microsoft.com/.*\.(cab|exe\dll) 259200 95% 259200 override-expire override-lastmod reload-into-ims ignore-reload ignore-no-cache ignore-private
refresh_pattern au.download.windowsupdate.com/.*\.(cab|exe|psf) 259200 95% 259200 override-expire override-lastmod reload-into-ims ignore-reload ignore-no-cache ignore-private
refresh_pattern ^ftp: 20160 95% 259200 override-expire override-lastmod reload-into-ims ignore-reload ignore-no-cache ignore-private
refresh_pattern . 180 95% 120960 reload-into-ims override-lastmod

quick_abort_min 0 KB
quick_abort_max 0 KB
quick_abort_pct 100
negative_ttl 2 minutes
positive_dns_ttl 60 seconds
negative_dns_ttl 30 seconds
store_avg_object_size 16 KB
vary_ignore_expire on
client_lifetime 2 hours
half_closed_clients off
shutdown_lifetime 4 seconds
log_icp_queries off
icp_hit_stale on
query_icmp on
ipcache_size 4096
ipcache_low 90
ipcache_high 95
fqdncache_size 4096
memory_pools off
forwarded_for off
reload_into_ims on
reload_into_ims on
pipeline_prefetch on

Menyiapkan folder untuk squid

mkdir -p /var/log/squid
touch /var/log/squid/access.log
chmod 770 /var/log/squid
chown -R squid:root /var/log/squid

touch /var/run/squid.pid
mkdir -p /cache/proxy1
chown -R squid:squid /cache/proxy1

Periksa Konfigurasi

Konfigurasi squid.conf yang dibuat dapat diperiksa dengan:

# squid -k parse

2011/01/28 02:43:07| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2011/01/28 02:43:07| Starting Authentication on port [::]:3128
2011/01/28 02:43:07| Disabling Authentication on port [::]:3128 (interception enabled)
2011/01/28 02:43:07| Disabling IPv6 on port [::]:3128 (interception enabled)
2011/01/28 02:43:07| WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP
2011/01/28 02:43:07| WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP
2011/01/28 02:43:07| WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP
2011/01/28 02:43:07| WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP
2011/01/28 02:43:07| WARNING: use of 'ignore-no-cache' in 'refresh_pattern' violates HTTP
2011/01/28 02:43:07| WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP

Abaikan warning yang muncul karena refresh_pattern yang dibuat memang diatur untuk mengabaikan beberapa pengaturan HTTP.

Buat /etc/init.d/squid

Pada bagian awal skrip /etc/init.d/squid harus memakai “ulimit -n 32768”

# wget http://repo.informatika.lipi.go.id/panduan/wiki/squid -O /etc/init.d/squid
# chmod 700 /etc/init.d/squid          

Buat simbolik link untuk squid

# chkconfig --add squid
              

Agar squid otomatis jalan saat server dinyalakan, tambahkan service squid dengan chkconfig

# chkconfig --level 345 squid on

Memasang squid di rc.local

# echo "# Squid Proxy" >> /etc/rc.local
# echo "/etc/init.d/squid start" >> /etc/rc.local

5. Buat swap

Setelah konfigurasi squid.conf dilakukan, kini saatnya menjalankan squid. Ketikkan perintah agar squid membuat swap

# /usr/sbin/squid -z

6. Jalankan squid

Pertama kali menjalankan squid sebaiknya mengaktifkan parameter debug, sehingga beberapa kesalahan dapat diketahui. Jalankan dengan cara:

# /usr/sbin/squid -Nd1

Buka terminal kedua, lalu periksa apakah squid sudah jalan atau gagal, lakukan:
Cek apakah squid sudah berjalan apa belum dengan perintah

# netstat -pln | grep squid

bila muncul tampilan seperti dibawah ini, berarti squid sudah berjalan

tcp        0      0 0.0.0.0:3128                0.0.0.0:*                   LISTEN      13109/(squid)       
udp        0      0 0.0.0.0:6628                0.0.0.0:*                               13109/(squid)       
udp        0      0 :::41063                    :::*                                    13109/(squid)       
udp        0      0 :::3401                     :::*                                    13109/(squid)       
udp        0      0 :::3130                     :::*                                    13109/(squid)

Setelah squid dijalankan, akses beberapa situs dari PC client, jika squid sudah berfungsi, hentikan squid dengan menekan Ctrl+C. Selanjutnya jalankan squid sebagai daemon. Caranya:

# /etc/init.d/squid start

7. Periksa log

Ada di /var/log/squid/access.log

# tail -f /var/log/squid/access.log

Tampilan log ringkas

# tail -f /var/log/squid/access.log | awk '{print$3 " " $8 " " $7}'

8. Boot ulang server

Lakukan reboot, kemudian jalankan squid.

Referensi

• [1] http://forum.linux.or.id/viewtopic.php?f=40&t=20030#p117128
• [x] http://www.scribd.com/doc/47172020/Cara-Instal-dan-Optimasi-Squid-Proxy-Server
• [x] http://en.gentoo-wiki.com/wiki/Safe_Cflags/Intel
• [pf] http://directory.fedoraproject.org/wiki/Performance_Tuning
• [fd] http://www.cyberciti.biz/faq/squid-proxy-server-running-out-filedescriptors/
• http://www.linuxinfo.com.br/squid_tproxy.htm
• https://wiki.archlinux.org/index.php/Reiser4FShowto

 
Source: http://igos-nusantara.or.id/wiki/IGOS_Nusantara_dan_proxy_server_squid_kompilasi 

Squid result codes

The TCP_ codes refer to requests on the HTTP port (usually 3128). The UDP_ codes refer to requests on the ICP port (usually 3130). If ICP logging was disabled using the log_icp_queries option, no ICP replies will be logged.

The following result codes were taken from a Squid-2, compare with the log_type enum in src/enums.h:

TCP_HIT A valid copy of the requested object was in the cache.

TCP_MISS The requested object was not in the cache.

TCP_REFRESH_HIT The requested object was cached but STALE. The IMS query for the object resulted in “304 not modified”.

TCP_REFRESH_FAIL_HIT The requested object was cached but STALE. The IMS query failed and the stale object was delivered.

TCP_REFRESH_MISS The requested object was cached but STALE. The IMS query returned the new content.

TCP_CLIENT_REFRESH_MISS The client issued a “no-cache” pragma, or some analogous cache control command along with the request. Thus, the cache has to refetch the object.

TCP_IMS_HIT The client issued an IMS request for an object which was in the cache and fresh.

TCP_SWAPFAIL_MISS The object was believed to be in the cache, but could not be accessed.

TCP_NEGATIVE_HIT Request for a negatively cached object, e.g. “404 not found”, for which the cache believes to know that it is inaccessible. Also refer to the explainations for negative_ttl in your squid.conf file.

TCP_MEM_HIT A valid copy of the requested object was in the cache and it was in memory, thus avoiding disk accesses.

TCP_DENIED Access was denied for this request.

TCP_OFFLINE_HIT The requested object was retrieved from the cache during offline mode. The offline mode never validates any object, see offline_mode in squid.conf file.

TCP_STALE_HIT The object was cached and served stale. This is usually caused by stale-while-revalidate or stale-if-error.

TCP_ASYNC_HIT A background request (e.g., one started by stale-while-revalidate) resulted in a refresh hit.

TCP_ASYNC_MISS A background request (e.g., one started by stale-while-revalidate) resulted in a miss; i.e., the cached object (if any) was updated).

UDP_HIT A valid copy of the requested object was in the cache.

UDP_MISS The requested object is not in this cache.

UDP_DENIED Access was denied for this request.

UDP_INVALID An invalid request was received.

UDP_MISS_NOFETCH During “-Y” startup, or during frequent failures, a cache in hit only mode will return either UDP_HIT or this code. Neighbours will thus only fetch hits.

NONE Seen with cachemgr requests and errors, usually when the transaction fails before being classified into one of the above outcomes.

The following code suffixes are specific to Squid3:

_ABORTED suffix means that the connection with HTTP client was closed or otherwise failed prematurely. This includes half-closed client sockets when half_closed_clients in squid.conf is off.

_TIMEDOUT suffix means that the transaction timed out while writing the response to the HTTP client (i.e., the client was not reading or stopped reading Squid’s response).

The following codes are no longer available in Squid-2:

ERR_* Errors are now contained in the status code.

TCP_CLIENT_REFRESH See: TCP_CLIENT_REFRESH_MISS.

TCP_SWAPFAIL See: TCP_SWAPFAIL_MISS.

TCP_IMS_MISS Deleted, now replaced with TCP_IMS_HIT.

UDP_HIT_OBJ Refers to an old version that would send cache hits in ICP replies. No longer implemented.

UDP_RELOADING See: UDP_MISS_NOFETCH. 

Source: http://wiki.squid-cache.org/SquidFaq/SquidLogs