Apply Configuration hangs forever, might be SSL related

[nauessp]

Good afternoon!

We just updated from 2009R1.4b to 2011R1.3. Our environment looks like:
1) Red Hat Enterprise Linux Server release 5.6
2) x86_64
3) Manual Install
4) Using SSL
5) This is working the same on our development machine as it is for our production machine. (Same OS and install type.)

Now whenever we click "Apply Configuration" it will sit forever although everything looked like it had been applied and the snapshot showed no errors.

I looked at the php.ini setting and changed the to recommended values. No change. I tried everything I could find in the forums and then stumbled on this thread. I think I am having SSL related issues as well, but cannot seem to figure out what to change to get things working.

We do not use the "SSLRequireSSL" setting, but we do require all non-localhost connections to use SSL. We do this by using apache rewrite rules, and this has worked well for us until upgrading. However, even if I turn off the rewrite rules but use port 443 for my connection, I get the hanging behavior.

(It's only when I connect with port 80 to nagiosxi does the "Apply Configuration" work like normal.)

Here's what I see in the ssl_request_log over and over while the "Apply Configuration" spins:

[26/May/2011:13:05:56 -0700] XXX.XXX.XXX.XXX SSLv3 AES128-SHA "GET /nagiosxi/ajaxhelper.php?cmd=getxicoreajax&opts=%7B%22func%22%3A%22get_tray_alert_html%22%2C%22args%22%3A%22%22%7D&nsp=a63678c3485231dabaf438c8f5db16cd HTTP/1.1" 288

And in the ssl_access_log:
XXX.XXX.XXX.XXX - - [26/May/2011:13:03:56 -0700] "GET /nagiosxi/ajaxhelper.php?cmd=getxicoreajax&opts=%7B%22func%22%3A%22get_tray_alert_html%22%2C%22args%22%3A%22%22%7D&nsp=a63678c3485231dabaf438c8f5db16cd HTTP/1.1" 200 288

I do not see any connection refused errors or the like. I've no idea why using port 443 for my connection would make the backend try to use SSL as well. Any help would be great!

Thank you!

[admin]

There are some SSL-related issues that happen on the backend with cron jobs that run wget requests. I know one of our developers was working on full support for SSL, so I'll check in with him mid-next week when he is back to see if there is new code that you can test.

[nauessp]

That would be great! Thank you!

[achudson]

I am experiencing this exact same issue.

When applying configuration, it forever prints the dots on the "Waiting for configuration verification................................................................................"

I am running everything in SSL, and this occurred after the 2011R1.3 update.

Thanks!

Adam

[mguthrie]

In this last update, we attempted to fix any bugs that would prevent strict SSL, but it's possible that something may have gotten missed. My test box was using mod_rewrite to force everything to https on port 443. Are you guys using similar setups?

https is also generally slower, can I also have you guys do the following steps to make sure that your php scripts aren't timing out?

http://support.nagios.com/wiki/index.ph ... _Completes

[nauessp]

I did add the options for php and it seemed to make no difference. It also happened on both our production server with hundreds of hosts configured and our development server with only two or three hosts configured.

We do use rewrite to make enforce SSL for users. We have an exemption for localhost so the older version of XI worked okay:

RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} !localhost [NC]
RewriteRule ^(.*) https://%{SERVER_NAME}$1 [R]

[mguthrie]

Ok, as I'm thinking about it, are you using a DNS name or an IP address for your XI server?

[nauessp]

We use a DNS name.

[mguthrie]

We're currently working on some potential fixes for this. Would you be willing to help us test to verify that our patches resolve the issue?

[nauessp]

I wouldn't mind a bit.

We have a test server set up with the same RHEL/Apache/Nagios configuration (except we only have a few hosts set up and use a free license on it), so testing is very non-disruptive.