The mailing list for listmasters using Sympa

[IKEDA Soji <address@concealed>]

Hi,

On the server with large number of lists, these might be considered,
too:


- There is a difference between mod_fastcgi and mod_fcgid.  Former
  launched FastCGI instances when HTTPd starts, OTOH latter launches
  them as necessity, i.e. when the client accesses to web interface.
  As a result, now WWSympa and SOAP server take long time to respond
  to earlier requests.

  Some times of idle requests just after (re)starting of HTTPd will
  launch FastCGI instances in advance.  Please let me know if there
  are better ways.

- Closing lists were made slow in exchange of enhancement: Recent
  version of Sympa scans all lists to ensure that any lists are not
  included in the list to be closed.

  This problem will be coped with by near future version of Sympa
  (maybe).


Regards,

-- Soji

On Wed, 10 Feb 2016 17:31:00 +0000
Steve Rich <address@concealed> wrote:

> Hi everyone,
> 
> I’ve asked this before but I haven’t been able to get anywhere on my own, 
> so I thought I would ask again.  We just upgraded to 6.2.12 from 5.1.4 and 
> began using mod_fcgid in lieu of mod_fastcgi at the recommendation of the 
> Sympa documentation.  The issue that we are running into is timeouts on 
> certain operations, listed below:
> 
>   *   Listing all lists
>   *   Soap calls
>   *   Close lists
> 
> What I have determined is that this is an issue with my apache 
> configuration, specifically when relating to mod_fcgid.  I’m including our 
> current configuration at the bottom of the email.  Apologies for the way 
> they are broken out but all of our *nix hosts are managed by puppet which 
> likes to modularize everything.
> 
> As for what we are experiencing, the problem seems to stem from the above 
> listed operations taking an exceedingly long time to complete.  One thing 
> that I have noted that seems related is that the close list operation ran 
> using the cli (sympa.pl ―close_list=listname@robot) takes upwards of 10 
> minutes to complete.  This seems be due to the fact that the close list 
> operation does a lot of checking to see if closing the list will impact 
> other lists (i.e. Closing list A when it is used as an include for list B 
> would prevent list A from being closed). It is important to note that we do 
> have a lot of ldap includes so that may be impacting performance to some 
> degree.
> 
> I suppose what it all boils down to is that with my current configuration, 
> the fastcgi servers seem to be dynamically generated on a per request basis 
> and do not persist following the completion of the request.  That means 
> that the process has to do all of that checking on the fly per request and 
> when the one of the above requests is made, it takes too long to complete 
> and times out.  I’ve looked into using mod_fcgid directives like 
> FcgidIOTimeout, as well as others but the problem really seems to be that 
> these simply take too long to run.  Does anyone have any advice on how to 
> start these fcgi servers at apache start and keep them alive?
> 
> /etc/httpd/conf/httpd.conf
> 
> # Security
> ServerTokens OS
> ServerSignature On
> TraceEnable On
> 
> ServerName "lists-app-01.oit.duke.edu"
> ServerRoot "/etc/httpd"
> PidFile run/httpd.pid
> Timeout 120
> KeepAlive Off
> MaxKeepAliveRequests 100
> KeepAliveTimeout 15
> 
> User sympa
> Group sympa
> 
> AccessFileName .htaccess
> <FilesMatch "^\.ht">
>     Require all denied
> </FilesMatch>
> 
> <Directory />
>   Options FollowSymLinks
>   AllowOverride None
> </Directory>
> 
> DefaultType none
> HostnameLookups Off
> ErrorLog "/var/log/httpd/error_log"
> LogLevel warn
> EnableSendfile On
> 
> #Listen 80
> 
> 
> Include "/etc/httpd/conf.d/*.load"
> Include "/etc/httpd/conf/ports.conf"
> 
> LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" 
> combined
> LogFormat "%h %l %u %t \"%r\" %>s %b" common
> LogFormat "%{Referer}i -> %U" referer
> LogFormat "%{User-agent}i" agent
> 
> IncludeOptional "/etc/httpd/conf.d/*.conf”
> 
> /etc/httpd/conf.d/25-lists.duke.edu-ssl.conf
> 
> <VirtualHost *:443>
>   ServerName lists.duke.edu
> 
>   ## Vhost docroot
>   DocumentRoot "/var/www/"
> 
>   ## Alias declarations for resources outside the DocumentRoot
>   ScriptAlias /sympa "/srv/sympa/bin/wwsympa-wrapper.fcgi"
>   ScriptAlias /sympasoap "/srv/sympa/bin/sympa_soap_server-wrapper.fcgi"
>   Alias /static-sympa "/srv/sympa/static_content_duke"
> 
>   ## Directories, there should at least be a declaration for /var/www/
> 
>   <Directory "/var/www/">
>     Options Indexes FollowSymLinks MultiViews
>     AllowOverride None
>     Require all granted
>   </Directory>
> 
>   ## Logging
>   ErrorLog "/var/log/httpd/lists.duke.edu-ssl_error_ssl.log"
>   ServerSignature Off
>   CustomLog "/var/log/httpd/lists.duke.edu-ssl_access_ssl.log" combined
> 
>   ## RedirectMatch rules
>   RedirectMatch 301  ^/$ /sympa
> 
>   ## SSL directives
>   SSLEngine on
>   SSLCertificateFile      "/etc/pki/tls/certs/lists.duke.edu.crt"
>   SSLCertificateKeyFile   "/etc/pki/tls/private/lists.duke.edu.key"
>   SSLCACertificatePath    "/etc/pki/tls/certs"
>   SSLCACertificateFile    "/etc/pki/tls/certs/incommon-2015.crt"
> 
>   ## Custom fragment
> 
>   <Location /sympa/sso_login/shibboleth>
>     AuthType shibboleth
>     ShibRequestSetting requireSession true
>     require shibboleth
>   </Location>
> </VirtualHost>
> 
> Thanks,
> Steve
> 


-- 
株式会社 コンバージョン  セキュリティ&OSSソリューション部   池田荘児
〒140-0014 東京都品川区大井1-49-15 アクセス大井町ビル4F
e-mail address@concealed  TEL 03-6429-2880
http://www.conversion.co.jp/