1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Problem PHP/IIS CGI timeout problem

Discussion in 'Software' started by zebulebu, Oct 10, 2009.

  1. zebulebu

    zebulebu Terabyte Poster

    3,748
    330
    187
    Got an odd little issue with the web console I use for Snort (IDS) reporting (BASE) - running on IIS. I'm trying to archive a large number of alerts (from a rule I stupidly left on and forgot about). After five minutes I get a CGI timeout error - which I would normally resolve by setting a higher timeout value in 'Process Options'. However, doing this makes no difference - the script still times out after 5 minutes of execution, no matter what I set the timeout to.

    I thought it might be an issue with PHP itself, so went through the php.ini file and have set every variable I can find under 'Resource Limits' to a much higher value than the default (max_execution_time, max_input_time, memory_limit) but the script still times out after five minutes.

    I've gone through the PHP configuration of the BASE app itself and changed the max_script_runtime variable to 9999 - same thing happens, 5 minute timeout.

    It seems that there is nothing in the configuration of PHP that is preventing scripts from running for longer than five minutes - and the only setting I can find in IIS that would affect this has been set to 9999 seconds, but it doesn't appear to have made any difference.

    Anyone got experience of CGI timeouts with PHP on IIS 5.1 and have any pointers?

    Cheers muchly!
     
    Certifications: A few
    WIP: None - f*** 'em
  2. Fergal1982

    Fergal1982 Petabyte Poster

    4,196
    171
    211
    I assume you've done [url="http://www.iisadmin.co.uk/?p=7]this[/url] stuff already, right?

    I know in ASP you can set the timeout on a specific page, theres not something like that in the php file for the specific page is there?
     
    Certifications: ITIL Foundation; MCTS: Visual Studio Team Foundation Server 2010, Administration
    WIP: None at present
  3. zebulebu

    zebulebu Terabyte Poster

    3,748
    330
    187
    Cheers Fergal - yep, done that (first thing I tried LOL)

    I've gone through the config of BASE and there is a couple of variables in there that deal with timeouts, but I've set them both way up (9999 in each case) and it's not made a shred of difference.

    A firebug capture shows the script timing out at 300 (5 minutes) - there is a keep-alive setting set to five minutes which is displayed in the POST method, but I can't figure out where this can be changed - I bet this is what's causing it though.
     
    Certifications: A few
    WIP: None - f*** 'em
  4. zebulebu

    zebulebu Terabyte Poster

    3,748
    330
    187
    A-ha! Sorted. Using MetaEdit, I had amended the timeout setting for the website under the 'root' node, but not actually added a 'CGITimeout' value for the site itself. Set that, refrooted... all is well with the world :)

    Now all I have to do is tell my manager why the web console is unavailable for reporting for about eight hours whilst 293,422 alerts are deleted :oops:
     
    Certifications: A few
    WIP: None - f*** 'em
  5. Fergal1982

    Fergal1982 Petabyte Poster

    4,196
    171
    211
    thats one hell of a downtime. Take it you cant do it back end somehow? If its in a DB, and you know what its doing, would have been quicker to do it directly inside the DB.
     
    Certifications: ITIL Foundation; MCTS: Visual Studio Team Foundation Server 2010, Administration
    WIP: None at present
  6. zebulebu

    zebulebu Terabyte Poster

    3,748
    330
    187
    Tru dat. However, I don't know what its doing - and its quicker (and easier) for me to just have the console unavailable for 8 hours on a Saturday night than it is for me to faff around trying to figure out how to archive everything without breaking it :) The IDS will still be logging alerts, and I've got an internal IDS anyway (this one is in the DMZ) so nothing should get inside without me knowing about it. Also, our firewalls are nice and tight ('cos I run 'em LOL) so I pretty much know we're not getting compromised.

    Incidentally, somewhat unsurprisingly, this doesn't happen on a Linux build (God, I'm glad Freddie's not around any more to read that!) - I have the exact same version of Base running on a Ubuntu box with Apache and it archives hundreds of thousands of alerts in two minutes flat.

    Now... Beer O'Clock methinks!
     
    Certifications: A few
    WIP: None - f*** 'em
  7. Bluerinse
    Honorary Member

    Bluerinse Exabyte Poster

    8,871
    167
    256
    Oh god yeah, i can almost see his reply before my very eyes :lolbang
     
    Certifications: C&G Electronics - MCSA (W2K) MCSE (W2K)
  8. Fergal1982

    Fergal1982 Petabyte Poster

    4,196
    171
    211
    "God, you moronic windows techie. WHy are you so content to pay for software thats rubbish. You must be one of those useless point and click plebs who couldnt do their job if their life depended on it, unless windows provides you a simple button to press!"
     
    Certifications: ITIL Foundation; MCTS: Visual Studio Team Foundation Server 2010, Administration
    WIP: None at present
  9. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,191
    299
    319
    Not bad, 8 outta 10. :biggrin
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  10. zebulebu

    zebulebu Terabyte Poster

    3,748
    330
    187
    No - I give that a 9. Everything present and correct, but need to tone up the 'I'm better than you because I stare at a CLI all day' angle
     
    Certifications: A few
    WIP: None - f*** 'em
  11. Fergal1982

    Fergal1982 Petabyte Poster

    4,196
    171
    211
    "God, you moronic windows techie. WHy are you so content to pay for software thats rubbish. You must be one of those useless point and click plebs who couldnt do their job if their life depended on it, unless windows provides you a simple button to press!

    You guys can all suck my balls. If im so wrong, why is everyone else saying the things I said two months before, whilst you were all laughing about it from your GUI?"

    Better?
     
    Certifications: ITIL Foundation; MCTS: Visual Studio Team Foundation Server 2010, Administration
    WIP: None at present
  12. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,191
    299
    319
    Aye, 10 outta 10! :clap
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010

Share This Page

Loading...