Error 408 User-agent timeout returned by logsearch

  • Article ID: 42887
  • Updated: 26 Sep 2013

Issue

When running 'pmx-logsearch', you get a "408 User-agent timeout" error, like the following:

pmx@striatum:> pmx-logsearch --to=john@sophos.com
We were unable to query remote servers:
https://192.168.1.111:28443/services/logsearch/query?count=10&offset=0&to=john@sophos%5C.com:
408 User-agent timeout (select)
Your search did not return any results.

First seen in

PureMessage for Unix

Cause

This error means that the amount of time that 'pmx-logsearch' has been waiting for a response from the remote server has exceeded the value of 'remote_search_timeout' (from /opt/pmx/etc/logsearch.conf). This value defaults to 10 seconds.

The usual reason for this is that the /opt/pmx/var/log/search folder on the remote server has grown too large to be searched fast enough. If this is the case, then after starting a new search, you should be able to see 'pmx-grep' or similar utilities (see /opt/pmx/etc/product.conf) running on the remote server. These utilities are used to search the /opt/pmx/var/log/search directory tree.

What To Do

In this situation, there are a few possible remedies by changing the values in /opt/pmx/etc/logsearch.conf:

  • Increase the value of 'remote_search_timeout' on the querying server:
    This will give the search more time to finish, but will mean that queries from both the command line and Groups UI will take longer. (Default : 10 seconds)

  • Decrease the 'max_disk_usage' on the remote server:
    This will limit the overall size of '/opt/pmx/var/log/search', but means that there will be less information stored. (Default : 2GB)

  • Decrease the 'index_expire_days' on the remote server:
    This will limit the amount of time that information is kept in '/opt/pmx/var/log/search', but means that there will be less information stored. (Default : 7 days)

 
If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent

Comments