The mailing list for listmasters using Sympa

[Steve Rich <address@concealed>]

Hi everyone,

I’ve asked this before but I haven’t been able to get anywhere on my own, so I thought I would ask again.  We just upgraded to 6.2.12 from 5.1.4 and began using mod_fcgid in lieu of mod_fastcgi at the recommendation of the Sympa documentation.  The issue that we are running into is timeouts on certain operations, listed below:

• Listing all lists
• Soap calls
• Close lists

What I have determined is that this is an issue with my apache configuration, specifically when relating to mod_fcgid.  I’m including our current configuration at the bottom of the email.  Apologies for the way they are broken out but all of our *nix hosts are managed by puppet which likes to modularize everything.

As for what we are experiencing, the problem seems to stem from the above listed operations taking an exceedingly long time to complete.  One thing that I have noted that seems related is that the close list operation ran using the cli (sympa.pl —close_list=listname@robot) takes upwards of 10 minutes to complete.  This seems be due to the fact that the close list operation does a lot of checking to see if closing the list will impact other lists (i.e. Closing list A when it is used as an include for list B would prevent list A from being closed). It is important to note that we do have a lot of ldap includes so that may be impacting performance to some degree.

I suppose what it all boils down to is that with my current configuration, the fastcgi servers seem to be dynamically generated on a per request basis and do not persist following the completion of the request.  That means that the process has to do all of that checking on the fly per request and when the one of the above requests is made, it takes too long to complete and times out.  I’ve looked into using mod_fcgid directives like FcgidIOTimeout, as well as others but the problem really seems to be that these simply take too long to run.  Does anyone have any advice on how to start these fcgi servers at apache start and keep them alive?

/etc/httpd/conf/httpd.conf

# Security

ServerTokens OS

ServerSignature On

TraceEnable On

ServerName "lists-app-01.oit.duke.edu"

ServerRoot "/etc/httpd"

PidFile run/httpd.pid

Timeout 120

KeepAlive Off

MaxKeepAliveRequests 100

KeepAliveTimeout 15

User sympa

Group sympa

AccessFileName .htaccess

<FilesMatch "^\.ht">

    Require all denied

</FilesMatch>

<Directory />

  Options FollowSymLinks

  AllowOverride None

</Directory>

DefaultType none

HostnameLookups Off

ErrorLog "/var/log/httpd/error_log"

LogLevel warn

EnableSendfile On

#Listen 80

Include "/etc/httpd/conf.d/*.load"

Include "/etc/httpd/conf/ports.conf"

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

LogFormat "%h %l %u %t \"%r\" %>s %b" common

LogFormat "%{Referer}i -> %U" referer

LogFormat "%{User-agent}i" agent

IncludeOptional "/etc/httpd/conf.d/*.conf”

/etc/httpd/conf.d/25-lists.duke.edu-ssl.conf

<VirtualHost *:443>

  ServerName lists.duke.edu

  ## Vhost docroot

  DocumentRoot "/var/www/"

  

  ## Alias declarations for resources outside the DocumentRoot

  ScriptAlias /sympa "/srv/sympa/bin/wwsympa-wrapper.fcgi"

  ScriptAlias /sympasoap "/srv/sympa/bin/sympa_soap_server-wrapper.fcgi"

  Alias /static-sympa "/srv/sympa/static_content_duke"

  ## Directories, there should at least be a declaration for /var/www/

  <Directory "/var/www/">

    Options Indexes FollowSymLinks MultiViews

    AllowOverride None

    Require all granted

  </Directory>

  ## Logging

  ErrorLog "/var/log/httpd/lists.duke.edu-ssl_error_ssl.log"

  ServerSignature Off

  CustomLog "/var/log/httpd/lists.duke.edu-ssl_access_ssl.log" combined

  ## RedirectMatch rules

  RedirectMatch 301  ^/$ /sympa

  ## SSL directives

  SSLEngine on

  SSLCertificateFile      "/etc/pki/tls/certs/lists.duke.edu.crt"

  SSLCertificateKeyFile   "/etc/pki/tls/private/lists.duke.edu.key"

  SSLCACertificatePath    "/etc/pki/tls/certs"

  SSLCACertificateFile    "/etc/pki/tls/certs/incommon-2015.crt"

  ## Custom fragment

  <Location /sympa/sso_login/shibboleth>

    AuthType shibboleth

    ShibRequestSetting requireSession true

    require shibboleth

  </Location>

</VirtualHost>

Thanks,

Steve