From numard at gmail.com Mon Feb 2 20:45:56 2015 From: numard at gmail.com (Norberto Meijome) Date: Tue, 3 Feb 2015 07:45:56 +1100 Subject: error purging URLs In-Reply-To: References: Message-ID: If you changed hostname after starting varnish, you need to restart the service - the hostname is used in the path for internal control structures. If you can't restart, you can try symlinking.. On 31/01/2015 9:44 am, "Tim Dunphy" wrote: > Hey guys, > > For some reason when I go to purge the varnish cache on my second varnish > node, I get this error: > > [root at varnish2:~] #varnishadm ban "req.url ~ /" > Cannot open /var/lib/varnish/varnish2/_.vsm: No such file or directory > Could not open shared memory > > Can someone please explain to me what this error means and how to correct > that? > > Thanks! > Tim > > -- > GPG me!! > > gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B > > > _______________________________________________ > varnish-misc mailing list > varnish-misc at varnish-cache.org > https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc > -------------- next part -------------- An HTML attachment was scrubbed... URL: From bluethundr at gmail.com Mon Feb 2 23:37:08 2015 From: bluethundr at gmail.com (Tim Dunphy) Date: Mon, 2 Feb 2015 18:37:08 -0500 Subject: error purging URLs In-Reply-To: References: Message-ID: Hi Norberto, Thanks. I actually tried doing a 'yum reinstall varnish' command. And after that it did start working again. Thanks, Tim Sent from my iPhone > On Feb 2, 2015, at 3:45 PM, Norberto Meijome wrote: > > If you changed hostname after starting varnish, you need to restart the service - the hostname is used in the path for internal control structures. > If you can't restart, you can try symlinking.. > >> On 31/01/2015 9:44 am, "Tim Dunphy" wrote: >> Hey guys, >> >> For some reason when I go to purge the varnish cache on my second varnish node, I get this error: >> >> [root at varnish2:~] #varnishadm ban "req.url ~ /" >> Cannot open /var/lib/varnish/varnish2/_.vsm: No such file or directory >> Could not open shared memory >> >> Can someone please explain to me what this error means and how to correct that? >> >> Thanks! >> Tim >> >> -- >> GPG me!! >> >> gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B >> >> >> _______________________________________________ >> varnish-misc mailing list >> varnish-misc at varnish-cache.org >> https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc -------------- next part -------------- An HTML attachment was scrubbed... URL: From cello86 at gmail.com Tue Feb 3 16:54:25 2015 From: cello86 at gmail.com (Marcello Lorenzi) Date: Tue, 3 Feb 2015 17:54:25 +0100 Subject: Ghost security issue. Message-ID: Hi All, do someone notice if the varnish cache can be affected by Ghost security issue? Thanks, Marcello -------------- next part -------------- An HTML attachment was scrubbed... URL: From perbu at varnish-software.com Tue Feb 3 17:15:00 2015 From: perbu at varnish-software.com (Per Buer) Date: Tue, 3 Feb 2015 18:15:00 +0100 Subject: Ghost security issue. In-Reply-To: References: Message-ID: Hi, On Tue, Feb 3, 2015 at 5:54 PM, Marcello Lorenzi wrote: > Hi All, > do someone notice if the varnish cache can be affected by Ghost security > issue? > No, it isn't. However, you probably want to restart Varnish after upgrade to get the old glibc binary out of your system. -- *Per Buer* CTO | Varnish Software AS Cell: +47 95839117 We Make Websites Fly! www.varnish-software.com [image: Register now] -------------- next part -------------- An HTML attachment was scrubbed... URL: From numard at gmail.com Wed Feb 4 10:02:02 2015 From: numard at gmail.com (Norberto Meijome) Date: Wed, 4 Feb 2015 21:02:02 +1100 Subject: error purging URLs In-Reply-To: References: Message-ID: ...maybe because that process restarted varnish... On 03/02/2015 10:37 am, "Tim Dunphy" wrote: > Hi Norberto, > > Thanks. I actually tried doing a 'yum reinstall varnish' command. And > after that it did start working again. > > Thanks, > Tim > Sent from my iPhone > > On Feb 2, 2015, at 3:45 PM, Norberto Meijome wrote: > > If you changed hostname after starting varnish, you need to restart the > service - the hostname is used in the path for internal control structures. > If you can't restart, you can try symlinking.. > On 31/01/2015 9:44 am, "Tim Dunphy" wrote: > >> Hey guys, >> >> For some reason when I go to purge the varnish cache on my second >> varnish node, I get this error: >> >> [root at varnish2:~] #varnishadm ban "req.url ~ /" >> Cannot open /var/lib/varnish/varnish2/_.vsm: No such file or directory >> Could not open shared memory >> >> Can someone please explain to me what this error means and how to correct >> that? >> >> Thanks! >> Tim >> >> -- >> GPG me!! >> >> gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B >> >> >> _______________________________________________ >> varnish-misc mailing list >> varnish-misc at varnish-cache.org >> https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc >> > -------------- next part -------------- An HTML attachment was scrubbed... URL: From contact at jpluscplusm.com Wed Feb 4 16:46:03 2015 From: contact at jpluscplusm.com (Jonathan Matthews) Date: Wed, 4 Feb 2015 16:46:03 +0000 Subject: Is there a recent security problem? In-Reply-To: <20150129104615.56f15f4f@gdr-desktop.gdr.name> References: <20150129104615.56f15f4f@gdr-desktop.gdr.name> Message-ID: On 29 January 2015 at 09:46, Andrzej Godziuk wrote: > Hello, > > I'm administrating a few servers, some of them running Varnish, set up > and running in different companies by different people. [snip] > The only thing these systems have in common is that they're running > Varnish 3.0.6 on CentOS 6 - and that they have a mysterious problem > which is only solved by restarting Varnish. Configuration has not been > changed in any of them recently, except for standard CentOS updates (not > on all of them). One other thing these systems have in common is that you can log in to them. Are you confident your desktop/laptop has not been compromised? J From bluethundr at gmail.com Fri Feb 13 06:35:40 2015 From: bluethundr at gmail.com (Tim Dunphy) Date: Fri, 13 Feb 2015 01:35:40 -0500 Subject: varnish won't keep site up Message-ID: Hi all, I seem to be getting a pretty good cache / hit ratio on my current VCL config. Hitrate avg: 0.9077 0.9242 0.9242 However I notice that if I stop my web server and go to the site I'm working with, instead of seeing a cached copy of the site, I instead see a varnish guru meditation error. I thought that the key to getting the site cached in such a way that you could completely stop the webserver and still view the site via the cache had a lot to do with this following line: if(req.http.cookie ~ "cc_loggedin" || req.http.cookie ~ "PHPSESSID"){ return(pass); } I had a look at the cookies for the site and put them in the above line. However I get no results with that. Here's the full VCL file: probe healthcheck { .url = "/healthcheck.php"; .timeout = 5s; .interval = 2s; .window = 5; .threshold = 3; } backend web1 { .host = "10.10.10.94"; .port = "80"; .probe = healthcheck; .connect_timeout = 30s; .first_byte_timeout = 30s; .between_bytes_timeout = 30s; .max_connections = 70; } director www client { { .backend = web1 ; .weight = 2; } } sub vcl_recv { set req.backend = www; if(req.http.cookie ~ "cc_loggedin" || req.http.cookie ~ "PHPSESSID"){ return(pass); } if (req.backend.healthy) { set req.grace = 30s; } else { set req.grace = 4h; } return (lookup); } sub vcl_fetch { if ( req.http.host == "www.ref.mydomain.com" || req.http.host == " www.beta.mydomain.com" ) { set beresp.ttl = 3600s; } if ( req.url ~ "^/index.php$" || req.url ~ "^/cometchat/cometchat_receive.php$") { set beresp.ttl = 3600s; } set beresp.grace = 4h; return (deliver); } sub vcl_deliver { if (obj.hits> 0) { set resp.http.X-Cache = "HIT"; } else { set resp.http.X-Cache = "MISS"; } } Could someone have a look at this VCL and give some opinion as to why this is happening? Thanks Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B -------------- next part -------------- An HTML attachment was scrubbed... URL: From perbu at varnish-software.com Fri Feb 13 07:31:21 2015 From: perbu at varnish-software.com (Per Buer) Date: Fri, 13 Feb 2015 08:31:21 +0100 Subject: varnish won't keep site up In-Reply-To: References: Message-ID: Hi Tim, On Fri, Feb 13, 2015 at 7:35 AM, Tim Dunphy wrote: > Hi all, > > I seem to be getting a pretty good cache / hit ratio on my current VCL > config. > > Hitrate avg: 0.9077 0.9242 0.9242 > Not bad. You should note that a high traffic site can typically get quite a bit higher than this. 97% and up should be achievable unless your content production is off the chart. > However I notice that if I stop my web server and go to the site I'm > working with, instead of seeing a cached copy of the site, I instead see a > varnish guru meditation error. > > I thought that the key to getting the site cached in such a way that you > could completely stop the webserver and still view the site via the cache > had a lot to do with this following line: > > if(req.http.cookie ~ "cc_loggedin" || req.http.cookie ~ "|"){ > return(pass); > } > This line will just pass requests that have a cookie that matches cc_loggedin or PHPSESSID (btw; it could be simplified into req.http.cookie ~ "cc_loggedin| PHPSESSID". Do that and shave one microsecond of your response time. :-). If a page isn't available in cache Varnish will turn to backend and if the backend is down you'll get a guru meditation page. Those users who have their requests passed will never encounter a cached version so for them the site will be down the moment your backend is offline. However, for 99% of the users the site can stay up. Look into "grace mode" in the docs, it will show you how to enable this. If you want further advice on what is happening you should have a look at the logs from varnish when handling a particular request. Please note that these logs might contain sensitive information such as sessions, ip addresses and such. Per. -- *Per Buer* CTO | Varnish Software AS Cell: +47 95839117 We Make Websites Fly! www.varnish-software.com [image: Register now] -------------- next part -------------- An HTML attachment was scrubbed... URL: From paul.wolstenholme at cbc.ca Wed Feb 18 20:59:10 2015 From: paul.wolstenholme at cbc.ca (Paul Wolstenholme) Date: Wed, 18 Feb 2015 12:59:10 -0800 Subject: Escape query string for varnishncsa/varnishlog Message-ID: I'd like to run varnishncsa with some query options on startup: varnishncsa -a -w ${LOGFILE} -D -P ${PIDFILE} -q 'RespStatus >= 400'" I can't seem to get the special character escaped properly in /etc/default/varnishncsa using Ubuntu LTS 14.04. I have tried quite a few variation of things like: DAEMON_OPTS=" -a -w ${LOGFILE} -D -P ${PIDFILE} -q \\\'RespStatus \\\>\\\= 400\\\'" I can get it to work by adding a string in /etc/init.d/varnishncsa : QUERY="'RespStatus >= 400'" And modifying the start function: if start-stop-daemon --start --quiet --pidfile ${PIDFILE} -q ${QUERY} \ Anyone have any suggestion on how to properly escape a query string in the /etc/default/varnishncsa Cheers, Paul -- Paul Wolstenholme CBC Music - System Administrator CBC Vancouver 604.662.6632 -------------- next part -------------- An HTML attachment was scrubbed... URL: From bluethundr at gmail.com Thu Feb 19 04:13:29 2015 From: bluethundr at gmail.com (Tim Dunphy) Date: Wed, 18 Feb 2015 23:13:29 -0500 Subject: 304 resource moved showing in varnish logs Message-ID: Hey varnish folks, It's been brought to my attention at the company that I work for that entries with '304' status in them keep turning up in the varnish log (/var/log/varnish.log). Such as what you see here: 198.173.160.79 - - [18/Feb/2015:22:57:21 -0500] "GET http://www.mycompany.com/sites/all/themes/adaptivetheme/at_core/css/at.layout.css?njxh61 HTTP/1.1" 304 0 "http://www.mycompany.com/privacy/mobile-apps/" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 Safari/600.1.4" 198.173.160.79 - - [18/Feb/2015:22:57:21 -0500] "GET http://www.mycompany.com/sites/all/themes/company/css/global.base.css?njxh61 HTTP/1.1" 304 0 "http://www.mycompany.com/privacy/mobile-apps/" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 Safari/600.1.4" 198.173.160.79 - - [18/Feb/2015:22:57:21 -0500] "GET http://www.mycompany.com/sites/default/files/adaptivetheme/company_files/company.default.layout.css?njxh61 HTTP/1.1" 304 0 "http://www.mycompany.com/privacy/mobile-apps/" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 Safari/600.1.4" 198.173.160.79 - - [18/Feb/2015:22:57:21 -0500] "GET http://www.mycompany.com/sites/all/libraries/superfish/style/default.css?njxh61 HTTP/1.1" 304 0 "http://www.mycompany.com/privacy/mobile-apps/" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 Safari/600.1.4" 198.173.160.79 - - [18/Feb/2015:22:57:21 -0500] "GET http://www.mycompany.com/sites/all/themes/company/css/global.styles.css?njxh61 HTTP/1.1" 304 0 "http://www.mycompany.com/privacy/mobile-apps/" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 Safari/600.1.4" 198.173.160.79 - - [18/Feb/2015:22:57:21 -0500] "GET http://www.mycompany.com/sites/all/themes/company/css/global.styles2.css?njxh61 HTTP/1.1" 304 0 "http://www.mycompany.com/privacy/mobile-apps/" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 Safari/600.1.4" I tried obscuring the company name as you can tell. But what I'm wondering is, is this a problem we should be concerned about? And if so, is there a best way to go about correcting it? I'm not really sure the best place to start looking in my VLC file. But I've included it as an attachment in case that helps. Not sure if people really look at attachments you send to mailing lists. But it's there if you want to see it! :-) Thanks! Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: default.vcl-for-list Type: application/octet-stream Size: 19493 bytes Desc: not available URL: From andrew.langhorn at digital.cabinet-office.gov.uk Thu Feb 19 08:26:51 2015 From: andrew.langhorn at digital.cabinet-office.gov.uk (Andrew Langhorn) Date: Thu, 19 Feb 2015 08:26:51 +0000 Subject: 304 resource moved showing in varnish logs In-Reply-To: References: Message-ID: Hi Tim, What headers are you passing in a typical request? Usually a 304 is returned when you pass If-Modified-Since and/or If-None-Match as HTTP headers since that is the server's default response assuming a copy already exists client side. Andrew On Thursday, 19 February 2015, Tim Dunphy wrote: > Hey varnish folks, > > > It's been brought to my attention at the company that I work for that > entries with '304' status in them keep turning up in the varnish log > (/var/log/varnish.log). > > Such as what you see here: > > 198.173.160.79 - - [18/Feb/2015:22:57:21 -0500] "GET > http://www.mycompany.com/sites/all/themes/adaptivetheme/at_core/css/at.layout.css?njxh61 > HTTP/1.1" 304 0 "http://www.mycompany.com/privacy/mobile-apps/" > "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) > AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 > Safari/600.1.4" > 198.173.160.79 - - [18/Feb/2015:22:57:21 -0500] "GET > http://www.mycompany.com/sites/all/themes/company/css/global.base.css?njxh61 > HTTP/1.1" 304 0 "http://www.mycompany.com/privacy/mobile-apps/" > "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) > AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 > Safari/600.1.4" > 198.173.160.79 - - [18/Feb/2015:22:57:21 -0500] "GET > http://www.mycompany.com/sites/default/files/adaptivetheme/company_files/company.default.layout.css?njxh61 > HTTP/1.1" 304 0 "http://www.mycompany.com/privacy/mobile-apps/" > "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) > AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 > Safari/600.1.4" > 198.173.160.79 - - [18/Feb/2015:22:57:21 -0500] "GET > http://www.mycompany.com/sites/all/libraries/superfish/style/default.css?njxh61 > HTTP/1.1" 304 0 "http://www.mycompany.com/privacy/mobile-apps/" > "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) > AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 > Safari/600.1.4" > 198.173.160.79 - - [18/Feb/2015:22:57:21 -0500] "GET > http://www.mycompany.com/sites/all/themes/company/css/global.styles.css?njxh61 > HTTP/1.1" 304 0 "http://www.mycompany.com/privacy/mobile-apps/" > "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) > AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 > Safari/600.1.4" > 198.173.160.79 - - [18/Feb/2015:22:57:21 -0500] "GET > http://www.mycompany.com/sites/all/themes/company/css/global.styles2.css?njxh61 > HTTP/1.1" 304 0 "http://www.mycompany.com/privacy/mobile-apps/" > "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) > AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 > Safari/600.1.4" > > > I tried obscuring the company name as you can tell. But what I'm wondering > is, is this a problem we should be concerned about? And if so, is there a > best way to go about correcting it? > > I'm not really sure the best place to start looking in my VLC file. But > I've included it as an attachment in case that helps. Not sure if people > really look at attachments you send to mailing lists. But it's there if you > want to see it! :-) > > Thanks! > Tim > > -- > GPG me!! > > gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B > > -- -------------- next part -------------- An HTML attachment was scrubbed... URL: From perbu at varnish-software.com Thu Feb 19 08:27:35 2015 From: perbu at varnish-software.com (Per Buer) Date: Thu, 19 Feb 2015 09:27:35 +0100 Subject: 304 resource moved showing in varnish logs In-Reply-To: References: Message-ID: Hi Tim, On Thu, Feb 19, 2015 at 5:13 AM, Tim Dunphy wrote: > Hey varnish folks, > > > It's been brought to my attention at the company that I work for that > entries with '304' status in them keep turning up in the varnish log > (/var/log/varnish.log). > > Such as what you see here: (..) > Don't worry about it. The client did a conditional request and Varnish just confirmed that the content they have is valid. Hence no need to retransmit the content (note the zero length body). Per. -- *Per Buer* CTO | Varnish Software AS Cell: +47 95839117 We Make Websites Fly! www.varnish-software.com [image: Register now] -------------- next part -------------- An HTML attachment was scrubbed... URL: From bluethundr at gmail.com Thu Feb 19 22:20:11 2015 From: bluethundr at gmail.com (Tim Dunphy) Date: Thu, 19 Feb 2015 17:20:11 -0500 Subject: 304 resource moved showing in varnish logs In-Reply-To: References: Message-ID: > > Don't worry about it. The client did a conditional request and Varnish > just confirmed that the content they have is valid. Hence no need to > retransmit the content (note the zero length body). Thanks for that feedback, Per! Makes perfect sense. Best regards, Tim On Thu, Feb 19, 2015 at 3:27 AM, Per Buer wrote: > Hi Tim, > > On Thu, Feb 19, 2015 at 5:13 AM, Tim Dunphy wrote: > >> Hey varnish folks, >> >> >> It's been brought to my attention at the company that I work for that >> entries with '304' status in them keep turning up in the varnish log >> (/var/log/varnish.log). >> >> Such as what you see here: (..) >> > > Don't worry about it. The client did a conditional request and Varnish > just confirmed that the content they have is valid. Hence no need to > retransmit the content (note the zero length body). > > Per. > > -- > *Per Buer* > CTO | Varnish Software AS > Cell: +47 95839117 > We Make Websites Fly! > www.varnish-software.com > [image: Register now] > > -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B -------------- next part -------------- An HTML attachment was scrubbed... URL: