Overview of Caching Servers
Caching servers function as specialized systems that store frequently accessed web content including pages, images, and files using memory and disk storage. These servers act as intermediaries, delivering cached content to users rapidly while significantly reducing network traffic from origin servers. Most caching solutions also operate as proxy servers, transparently serving content to end users who perceive the data as coming directly from the visited websites.
Popular caching solutions in enterprise environments include Squid, Varnish (now rare), Nginx, and ATS. Squid stands out due to its mature architecture and extensive deployment history, making it essential knowledge for system administrators despite newer alternatives claiming superior performance. Empirical testing rather than anecdotal evidence should guide decisions about caching software effectiveness.
The majority of commercial CDN providers in China utilize Squid, including major players like ChinaCache, Wangsu, and Dalian. AT&T's ATS is employed by companies such as Sina.
Web Caching Concepts
Cache Hit Rate
A cache hit occurs when the caching server fulfills client HTTP requests from its stored content. The cache hit rate represents the percentage of successful cache retrievals among all requests. Typical web cache hit rates range between 30% and 60%. Byte hit rate measures the volume of data served from cache.
Strategies to improve cache hit rates:
- Implement Expires and Cache-Control headers in Apache/Nginx
- Separate static and dynamic content, utilize CDN for static assets
- Prioritize MySQL caching
- Avoid caching 4xx/5xx error pages and broken links
Cache Miss Scenarios
Cache misses happen when requested content isn't available in cache storage. Common causes include:
- First-time requests for new resources - resolved through pre-warming or pre-fetching
- Storage capacity exhaustion or object expiration - addressed by increasing memory/disk space, extending expiration times, adjusting cache parameters, or implementing resource-based partitioning
- Unreachable origin content - handled according to server directives about cacheability and reuse periods
Cache Validation
Data consistency presents challenges in caching systems. Cache validation ensures expired content isn't delivered to users. Servers regularly verify cached copies with origin servers before reuse. When updates occur in databases or storage systems, proactive cache invalidation through business-level interfaces becomes crucial. CDN propagation typically takes 5-15 minutes.
Squid Service Architecture
Squid operates as a high-performance proxy caching server supporting FTP, Gopher, and HTTP protocols. It uses a single non-modular I/O-driven process to handle all client requests, caching both data objects and DNS query results. Squid supports SSL and access control mechanisms, utilizing ICP (Internet Cache Protocol) for hierarchical proxy arrays to optimize bandwidth usage.
Proxy Modes
Forward Proxy
In traditional proxy configuration, clients explicitly configure browser settings to route requests through the proxy server. This approach requires manual client configuration but provides centralized control over internet access.
Transparent Proxy
Transparent proxies require no client-side configuration. Deployed at network egress points, they intercept traffic automatically. Integration with iptables enables comprehensive solutions including proxy functionality, gateway services, content filtering, and traffic security controls.
Workflow: Client requests are forwarded by firewall to Squid, which checks its cache. If content exists locally, it's returned immediately. Otherwise, Squid fetches from the destination server, serves the response, and stores a copy for future requests.
Reverse Proxy
Reverse proxies accept external internet connections and forward them to internal servers, returning responses asif they originated from the proxy itself. This configuration reduces backend server load while providing caching benefits.
Workflow: Squid acts as the frontend for server clusters. External clients connect to Squid, which either serves cached content directly or forwards requests to appropriate backend web servers.
Hardware and System Requirements
Operating System Environment
Squid runs on most Unix/Linux distributions and Windows platforms. However, Unix/Linux implementations offer better stability, security, and performance. CentOS 6.4 x86_64 serves as the reference platform.
Hardware Specifications
Memory: Primary resource requirement. Insufficient RAM severely impacts performance since objects are cached in memory for optimal response times.
Disk Storage: Critical to efficient operation. More storage space increases cache targets and hit rates. Fast media like SSD/SAS drives preferred over SATA. RAID configurations and multiple disk paths enhance performance.
Memory-Disk Relationship: General rule suggests 32MB memory per GB disk space. For example, 512MB RAM supports approximately 16GB cache storage. Actual requirements vary based on cache object sizes, CPU architecture, concurrent users, and feature usage.
Virtual Environment Setup
Minimum specifications: 512MB RAM, 8-10GB disk space, 1-2 VM instances (one for cache server, one for test web server), CentOS 6.5 x86_64.
Compilation and Installation
Source Download and Extraction
# wget http://www1.it.squid-cache.org/Versions/v3/3.0/squid-3.0.STABLE20.tar.gz
# tar xf squid-3.0.STABLE20.tar.gz -C /usr/src/
# cd /usr/src/squid-3.0.STABLE20/
Kernel Parameter Tuning
File Descriptor Adjustment
Squid requires substantial kernel resources under high load. File descriptor limits significantly impact performance. Default limit of 1024 may suffice for basic installations, but busy caches need 4096 or higher values.
# ulimit -n 20480
# echo "ulimit -n 20480" >> /etc/rc.local
Ephemeral Port Range Configuration
TCP/IP stack assigns local ports for outgoing connections. Limited port ranges affect performance on slow proxies due to TIME_WAIT state preventing immediate port reuse.
# echo "net.ipv4.ip_local_port_range = 4000 65000" >> /etc/sysctl.conf
# sysctl -p
Compilation Process
# yum -y install openssl-devel
# ./configure --prefix=/usr/local/squid3 \
--enable-async-io=100 \
--with-pthreads \
--enable-storeio="aufs,diskd,ufs" \
--enable-removal-policies="heap,lru" \
--enable-icmp \
--enable-delay-pools \
--enable-useragent-log \
--enable-referer-log \
--enable-kill-parent-hack \
--enable-cachemgr-hostname=localhost \
--enable-arp-acl \
--enable-default-err-language=English \
--enable-err-languages="Simplify_Chinese English" \
--disable-poll \
--disable-wccp \
--disable-wccpv2 \
--disable-ident-lookups \
--disable-internal-dns \
--enable-basic-auth-helpers="NCSA" \
--enable-stacktrace \
--with-large-files \
--disable-mempools \
--with-filedescriptors=64000 \
--enable-ssl \
--enable-x-acceletator-vary \
--disable-snmp \
--with-aio \
--enable-linux-netfilter \
--enable-linux-tproxy
# make && make install
# ln -s /usr/local/squid3/ /usr/local/squid
Directory Structure
Post-installation layout includes:
- sbin/ - Main Squid executables requiring root privileges
- bin/ - User-accessible programs including RunCache, RunAccel, and squidclient
- libexec/ - Auxiliary programs like unlinkd, cachemgr.cgi, diskd, and pinger
- etc/ - Configuration files with squid.conf as primary configuration
- var/ - Variable data including logs and default cache directory
Configuration Management
Configuration Syntax
Squid configuration follows standard Unix conventions with directives followed by values or keywords. Comments begin with # and empty lines are ignored.
# Generate minimal configuration
# egrep -v "^#|^$" squid.conf.default > squid.conf
User and Group Configuration
Create dedicated service account to prevent unauthorized system access:
# useradd -s /sbin/nologin -M squid
# echo "cache_effective_user squid" >> /usr/local/squid/etc/squid.conf
# echo "cache_effective_group squid" >> /usr/local/squid/etc/squid.conf
Port Configuration
HTTP_PORT directive specifies listening port (default 3128). Multiple ports supported through additional declarations:
http_port 3128
http_port 8080
http_port 192.168.1.1:3128
Logging System
Three primary log files:
- cache.log - Configuration info, warnings, and critical errors
- access.log - HTTP transaction records (~150 bytes per entry)
- store.log - Cache storage and deletion decisions
# Enable logging
echo "cache_store_log /usr/local/squid/var/logs/store.log" >> /usr/local/squid/etc/squid.conf
echo "cache_log /usr/local/squid/var/logs/cache.log" >> /usr/local/squid/etc/squid.conf
Access Control Lists
ACL foundation for access control with syntax: acl name type value1 value2 ...
IP Address ACLs
acl Workstations src 10.0.0.0/16
acl Bar src 172.16.66.0/24
Domain ACLs
acl A dstdomain foo.com # Exact match required
acl B dstdomain .foo.com # Wildcard matching subdomains
Regular Expression ACLs
acl Images url_regex -i \.jpg$ # Case-insensitive JPEG matching
acl SecureSites url_regex ^https:// # HTTPS protocol restriction
Method ACLs
acl Uploads method PUT POST
acl CONNECT method CONNECT
acl SSL_ports port 443 563
http_access allow CONNECT SSL_ports
http_access deny CONNECT
Protocol ACLs
acl FTP proto ftp
http_access deny FTP
Rule Matching Logic
ACL elements use OR logic within definitions but AND logic for access rules. Rule order matters critically:
acl MyNetwork src 192.168.0.0/16
http_access allow MyNetwork
http_access deny all
Server Identification
echo "visible_hostname www.example.com" >> /usr/local/squid/etc/squid.conf
echo "cache_mgr admin@example.com" >> /usr/local/squid/etc/squid.conf
Service Operations
Command Line Options
-a port HTTP port specification
-d level Debug output level
-f file Configuration file path
-h Help display
-k signal Service control signals
-s Syslog integration
-u port ICP port specification
-v Version information
-z Initialize cache directories
-C Disable fatal signal handling
-D Skip DNS initialization
-F Wait for store rebuild
-N Foreground mode
-R Disable REUSEADDR
-S Verify swap during rebuild
-X Full debug mode
-Y Fast reload behavior
Configuration Validation
# /usr/local/squid/sbin/squid -k parse
# chown -R squid /usr/local/squid/var/logs
# chown -R squid /usr/local/squid/var/
Cache Initialization
# ln -s /usr/local/squid/sbin/* /usr/local/sbin/
# ln -s /usr/local/squid/bin/* /usr/local/bin/
# squid -z
Service Startup
# Terminal testing
squid -N -d1
# Background operation
/usr/local/squid/sbin/squid -D
# Service script approach
#!/bin/bash
case "$1" in
start)
/usr/local/squid/sbin/squid -D
;;
stop)
/usr/local/squid/sbin/squid -k shutdown
;;
restart)
/usr/local/squid/sbin/squid -k reconfigure
;;
*)
echo "Usage: $0 {start|stop|restart}"
;;
esac
Log Rotation
# Manual rotation
/usr/local/squid/sbin/squid -k rotate
# Automated scheduling
0 0 * * * /usr/local/squid/sbin/squid -k rotate
Web Management Interface
# Install Apache
yum -y install httpd
# Configure cachemgr access
ScriptAlias "/squid" "/usr/local/squid/libexec/cachemgr.cgi"
<Location "/squid">
Order deny,allow
Deny from all
Allow from all
</Location>