[squid-users] squid consuming near all (95+ %) CPU, it is normal?

With this squid configuration:
acl localnet src 172.16.0.0/12
acl localnet src 192.168.0.0/16
acl SSL_ports port 443
acl SSL_ports port 85
acl SSL_ports port 81
acl SSL_ports port 5443
acl Safe_ports port 80
acl Safe_ports port 21
acl Safe_ports port 443
acl Safe_ports port 70
acl Safe_ports port 210
acl Safe_ports port 1025-65535
acl Safe_ports port 280
acl Safe_ports port 488
acl Safe_ports port 591
acl Safe_ports port 777
acl Safe_ports port 5443
acl Safe_ports port 85
acl Safe_ports port 81
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128
hierarchy_stoplist cgi-bin ?
cache_dir ufs /var/spool/squid 1000 16 256 max-size=999000
cache_mem 512 MB
maximum_object_size 4096 KB
memory_pools off
cache_swap_low 90
cache_swap_high 95
dns_nameservers 172.16.1.1
client_db off
half_closed_clients off
max_filedesc 4096
coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
acl users src 172.31.0.0/16
delay_pools 1
delay_class 1 2
delay_parameters 1 5000000/10000000 5000000/10000000
delay_access 1 allow users

squid very often load CPU at near 100%, with cca 200 users and 4000
connections (~2000 to users, 2000 to internet). Removing delay pool
configuration has no big effect.
HW configuration: Dual core E8500_at_3.16GHz CPU, 4GB RAM, 2x SATA 7k2
Raid Edition disks in SW RAID1 for squid cache (disk performance
seems isn't problem, IOWAIT is small), gigabit ethernet cards to
internet (~800 Mbps line) and to LAN.
It is squid-3.2.3.20121106.r11695-1.fc14.i686 on Fedora 14 i686
(I test it with some older squid 3.1 version and same configuration
too, but results were same, or rather worse)

It this CPU load normal, or can be there done some performance
tunnning for it?

Thanks in advance, Fr. Hanzlik
Received on Sun Nov 11 2012 - 14:25:34 MST