4.1 PDF Rendering timeout for realtime search-based view

[jhardeman]

I am getting a firefox timeout error in the python.log file when trying to schedule pdf delivery. Here is the log entry.

2010-04-12 09:05:56,466 INFO pdfhandler:456 - Generated pdf file. bytes=19218 time=332.44 2010-04-12 09:05:56,466 INFO Generated pdf file. bytes=19218 time=332.44 2010-04-12 09:05:56,478 WARNING pdfhandler:572 - Firefox timed out while waiting for the report to be rendered - Incomplete snapshot generated 2010-04-12 09:05:56,478 WARNING Firefox timed out while waiting for the report to be rendered - Incomplete snapshot generated 2010-04-12 09:05:56,478 WARNING xvfb:132 - Stopping X Server 6 2010-04-12 09:05:56,478 WARNING Stopping X Server 6

I've tried upping the timeout duration in the pdfhandler.py, and that didnt help at all. I've confirmed a pdf can be generated in the pdf server status page.

[afont]

Hi,

Happens the same, I also tried with no realtime dashboard and no luck:

INFO pdfhandler:628 - Generated pdf file. bytes=38571 time=301.91
2012-01-17 13:00:06,786 INFO Generated pdf file. bytes=38571 time=301.91
2012-01-17 13:00:06,791 DEBUG pdfhandler:746 - statuslog: ['startup', 'setsize', 'setsize', 'setsize', 'setsize', 'setsize', 'timeout', 'delayedshow', 'settings', 'print', 'success']
2012-01-17 13:00:06,791 DEBUG statuslog: ['startup', 'setsize', 'setsize', 'setsize', 'setsize', 'setsize', 'timeout', 'delayedshow', 'settings', 'print', 'success']
2012-01-17 13:00:06,791 WARNING pdfhandler:749 - Firefox timed out while waiting for the report to be rendered - Incomplete snapshot generated
2012-01-17 13:00:06,791 WARNING Firefox timed out while waiting for the report to be rendered - Incomplete snapshot generated
2012-01-17 13:00:06,791 WARNING xvfb:132 - Stopping X Server 5
2012-01-17 13:00:06,791 WARNING Stopping X Server 5
2012-01-17 13:00:08,830 DEBUG Preloading from '/opt/splunk/var/run/splunk/merged/server.conf'.
2012-01-17 13:00:08,830 DEBUG Preloading from '/opt/splunk/var/run/splunk/merged/web.conf'.
2012-01-17 13:00:08,831 DEBUG simpleRequest > GET https://127.0.0.1:8089/servicesNS/nobody/search/admin/alert_actions/email [] sessionSource=direct
2012-01-17 13:00:08,836 DEBUG simpleRequest < server responded status=200 responseTime=0.0047s
2012-01-17 13:00:08,837 INFO sendemail opening PDF request to appserver at http://splunk:80/en-US/report/
2012-01-17 13:00:09,073 DEBUG cli_common:226 - Preloading from '/opt/splunk/var/run/splunk/merged/server.conf'.
2012-01-17 13:00:09,073 DEBUG Preloading from '/opt/splunk/var/run/splunk/merged/server.conf'.
2012-01-17 13:00:09,074 DEBUG cli_common:226 - Preloading from '/opt/splunk/var/run/splunk/merged/web.conf'.
2012-01-17 13:00:09,074 DEBUG Preloading from '/opt/splunk/var/run/splunk/merged/web.conf'.
2012-01-17 13:00:09,108 DEBUG cli_common:229 - Running btool for 'pdf_server.conf'.
2012-01-17 13:00:09,108 DEBUG Running btool for 'pdf_server.conf'.
2012-01-17 13:00:09,156 INFO pdfhandler:646 - Starting PDF App Renderer Version 1.3
2012-01-17 13:00:09,156 INFO Starting PDF App Renderer Version 1.3
2012-01-17 13:00:09,161 INFO xvfb:45 - Started new X server. Now 1 active
2012-01-17 13:00:09,161 INFO Started new X server. Now 1 active
2012-01-17 13:00:09,161 INFO pdfhandler:558 - Executing /opt/splunk/etc/apps/pdfserver/bin/firefox-x86_64/firefox -print http://splunk:80/app/search/sms_operadors -printmode pdf -printfile /tmp/tmppnPl4E -title Splunk Alert: sms_operadors -orientation landscape -paperwidth 297 -paperheight 219 -mode splunk -timeout 300 -windowsize 1075x768 -footer_right Generated by Splunk at &D -cookie session_id_80=e20f804384c89a8bc67b293db2c92a1dbddd7db9
2012-01-17 13:00:09,161 INFO Executing /opt/splunk/etc/apps/pdfserver/bin/firefox-x86_64/firefox -print http://splunk:80/app/search/sms_operadors -printmode pdf -printfile /tmp/tmppnPl4E -title Splunk Alert: sms_operadors -orientation landscape -paperwidth 297 -paperheight 219 -mode splunk -timeout 300 -windowsize 1075x768 -footer_right Generated by Splunk at &D -cookie session_id_80=e20f804384c89a8bc67b293db2c92a1dbddd7db9
2012-01-17 13:00:09,166 INFO xvfb:205 - Assigned DISPLAY :5
2012-01-17 13:00:09,166 INFO Assigned DISPLAY :5
2012-01-17 13:00:09,166 INFO xvfb:115 - Starting X Server: ['/usr/bin/Xvfb', ':5', '-screen', '0', '3000x768x24', '-nolisten', 'tcp']
2012-01-17 13:00:09,166 INFO Starting X Server: ['/usr/bin/Xvfb', ':5', '-screen', '0', '3000x768x24', '-nolisten', 'tcp']
2012-01-17 13:00:09,167 INFO xvfb:116 - Starting X Server env: {'XAUTHORITY': '/opt/splunk/var/run/splunk/xvfb/xauth-5/Xauthority'}
2012-01-17 13:00:09,167 INFO Starting X Server env: {'XAUTHORITY': '/opt/splunk/var/run/splunk/xvfb/xauth-5/Xauthority'}
2012-01-17 13:00:11,170 INFO xvfb:122 - X Started
2012-01-17 13:00:11,170 INFO X Started
2012-01-17 13:00:38,858 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: Splunkd daemon is not responding: ('The read operation timed out',)
2012-01-17 13:00:38,859 DEBUG simpleRequest > GET https://127.0.0.1:8089/services/search/jobs/scheduler__admin__search_X1NjaGVkdWxlZFZpZXdfX3Ntc19vcGV... [] sessionSource=direct
2012-01-17 13:00:38,865 DEBUG simpleRequest < server responded status=200 responseTime=0.0061s
2012-01-17 13:00:38,865 DEBUG getStatus - elapsed=0.00634121894836 nextRetry=0.0500000020399
2012-01-17 13:00:38,888 INFO Sending email. subject="Splunk Alert: sms_operadors", results_link="http://splunk:80/app/search/@go?sid=scheduler__admin__search_X1NjaGVkdWxlZFZpZXdfX3Ntc19vcGVyYWRvcnM...", recepients="['xxxxx@xxxxx.com']"

Any clues??

Thanks in advance!
Alex

[jhardeman]

Well I think I have it figured out.

I changed the dashboard to not be realtime, and it works great. That's probably someplace in the wiki or the manual and I overlooked it.

[jrodman]

Yeah, this is the answer to your question -- I tossed it in the question subject to try to guide people to the issue. The PDF server doesn't really know that much about Splunk, it just knows more or less that the view has finished rendering. For realtime searches it's sort of a current wart that they pause for a while then emit results. It's unclear, however, that you'd want anything else to happen, since you probably want to see some data in the chart in the pdf. Essentially, it's an area we have to explore.

[gareth]

If you click on the link to the results in the email that's sent to you, how long does it take for the resulting page to completely finish loading, and does it load without error?

The PDF server by default will wait for up to 4 minutes for the page to finish loading all search results that the dashboard needs and at that time will generate a snapshot of whatever has finished loading so far, so if you find your dashboard is taking longer than that to load in your browser you should increase the firefox_timeout limit in the pdf_server.conf file.

[Johnvey]

What is the content of the PDF that is generated? Generally speaking, PDF timeouts are a result of either 1) a dashboard that takes a really long time to complete, or 2) a misconfigured view.