#5833 cli: "gateway time out" with long running task
Closed: Duplicate None Opened 8 years ago by pvoborni.

If a CLI command takes longer time ~ 8s, CLI ends with "gateway time out" error.

It still runs on a server therefore it finishes but CLI is never notified.

We need to find out why.


Testing shows that it can be configured using mod_wsgi's socket-timeout directive:

WSGIDaemonProcess ipa processes=2 threads=1 maximum-requests=500 display-name=%{GROUP} socket-timeout=160

Default value is 60, or more precisely the value of the Apache Timeout directive as stated in
Add socket-timeout option to WSGIDaemonProcess to allow the timeout on indvidual read/writes on the socket connection between the Apache child worker and the daemon process to be specified separately to the Apache Timeout directive.

If this option is not specified, it will default to the value of the Apache Timeout directive.
http://modwsgi.readthedocs.org/en/develop/release-notes/version-4.1.0.html

  • pv: 4.4, would increase the timeout so that it would not return before api returns
  • pspacek: +1 for disabling the timeout completely, it was added only in later version of WSGI. The timeout does not terminate the ipa process on server so it does nothing to prevent DoS anyway.
  • H: +1, may be related to #5827

From the documentation it seems that there's no easy way to turn the socket-timeout argument off. From the source code it seems that 0 is the default value which means that the Apache TimeOut directive is used, negative values won't be accepted.
My proposal is to set the socket-timeout value to 2^31-1 then.

master:

  • 12d8a0c Increased mod_wsgi socket-timeout

master:

  • 5cb0312 Upgrade mod_wsgi socket-timeout on existing installation

Metadata Update from @pvoborni:
- Issue assigned to stlaz
- Issue set to the milestone: FreeIPA 4.4

7 years ago

Login to comment on this ticket.

Metadata