Hello,
An optional value can be set in
/usr/share/co3/conf/scripting-server.properties to control how many simultaneous Python 3 scripts can be run. The value to set is
resPython3MaxProcesses. The default value is 20. If circumstances dictate that more script executions are executed than this value, then the latecomers are queued until previously started scripts finish. In order for a change to the
scripting-server.properties file to take effect, you must restart the scripting service. I would have thought that the throughput for 20 simultaneous scripts that each take 0.1 seconds to execute, over 5 seconds, would be sufficient for most scenarios. Do you know what the demand on the system is?
Is there the line number where the script timed out mentioned in the logs? It's presence or absence could be informative. If the Python 3 process crashes, it might look like a timeout from the perspective of the Resilient appliance, but no line number would be recorded. There could be information in the scripts service log file that would indicate what's happening.
Is your script performing an incident lookup using helper.findIncidents()? In theory, on a heavily loaded system, that search could take a long time.
Which version of SOAR/Resilient are you running?
-P.J.
------------------------------
Patrick (PJ) McKenna
SOAR Development
------------------------------
Original Message:
Sent: Mon February 07, 2022 10:07 AM
From: Leonardo Kenji Shikida
Subject: com.resilient.scripting.exception.TimeoutScriptingException: Script timeout error
Hi
Python 3
Appliance
Same scripts, higher request load
------------------------------
[]
Leonardo Kenji Shikida
Original Message:
Sent: Mon February 07, 2022 08:21 AM
From: Ben Lurie
Subject: com.resilient.scripting.exception.TimeoutScriptingException: Script timeout error
Are you using Python2 or Python3? Are you using CP4S or Appliance based SOAR? Are these scripts that used to run in under 5 seconds or new scripts?
The setting should only applies to how long the actual python code takes.
Ben
------------------------------
Ben Lurie
Original Message:
Sent: Fri February 04, 2022 01:38 PM
From: Leonardo Kenji Shikida
Subject: com.resilient.scripting.exception.TimeoutScriptingException: Script timeout error
Hi Patrick
The script was not supposed to take long to complete. They are the python scripts before and after the call of fn_utilities REST call.
Maybe, the delay is not in the script itself, I am still investigating if the delay is in the execution of the REST call, or if there are too many simultaneous REST calls and they are competing for the same resources in the resilient-scripting service.
From what I've noticed from the resilient-scripting.service logs, the python scripts are completed pretty fast (0.1 secs avg), but since each request to the scripting service seems to have an ETA, I wonder if the issue is just too many python scripts requests that are filling the service scripting queue.
If that's the case, is there any setting I can change in order to allow the resilient-scripting service to use more processes to handle the throughput (which seems better than increasing the timeout)?
TIA
Leonardo Kenji Shikida
Security Delivery Specialist
Original Message:
Sent: 2/4/2022 11:13:00 AM
From: PATRICK MCKENNA
Subject: RE: com.resilient.scripting.exception.TimeoutScriptingException: Script timeout error
Hi,
Yes, this is the right file, and the right setting, and the right denominator.
However, I am concerned that scripts, which are meant to be short in execution time, are taking longer than five seconds. Rule (and hence script) execution ties up at least one database connection and these are finite resources.
Are the scripts that were failing with the timeout error now passing? Can you see from the logs how long they are taking? What is your script doing?
-P.J.
------------------------------
Patrick (PJ) McKenna
Resilient Development
Original Message:
Sent: Fri February 04, 2022 07:41 AM
From: Leonardo Kenji Shikida
Subject: com.resilient.scripting.exception.TimeoutScriptingException: Script timeout error
Hi
I was getting this error and I've figured out that
/usr/share/co3/conf/scripting-server.properties
Allows to change the value of resScriptTimeout from 5 to something else (I've set to 60)
I am curious if this is the right way to fix this and what's the maximum value allowed for this parameter.
I understand that it must be responsive, but at the same time, 5 may be too little for some situations.
It's in seconds, right?
------------------------------
[]
Leonardo Kenji Shikida
------------------------------