github-actions[bot] commented on issue #13735: URL: https://github.com/apache/cloudstack/issues/13735#issuecomment-5356778106
## ๐ฏ Triage report `iptables_check.py` (a VR/VPC router health check) uses `Popen(..., stdout=PIPE)` followed by `wait()` before draining the pipe. On routers with large rule sets (>64KB `iptables-save` output), this deadlocks, leaking a stuck process chain every health-check interval until the router exhausts RAM/swap (~9h) and self-reboots โ and redundant VPC router pairs fail together, defeating redundancy. A precise root cause, suggested code fix, and workaround are already provided. ### ๐ Assessment | Dimension | Value | Reasoning | |---|---|---| | **Type** | type:bug | Classic subprocess pipe-deadlock bug with clear reproduction and root cause | | **Component** | component:virtual-router | Affects the systemVM/VPC virtual router health-check scripts | | **Severity** | Severity:Critical | Causes full VPC outages (both redundant routers fail near-simultaneously) roughly every 9 hours on affected routers until worked around | | **Labels** | type:bug, component:virtual-router, Severity:Critical | See above | | **Coding agent** | Suitable | Root cause, exact file/line, and a concrete suggested fix (`communicate()` before checking `returncode`) are already provided; fix is small, self-contained, and testable | ### ๐ Similar issues No closely related open duplicates found. <details><summary>๐ก Notes and suggestions</summary> The maintainer already asked the reporter to submit a PR. The suggested fix (call `communicate()` first, then check `returncode`, instead of `wait()` before draining stdout) is correct and matches Python's documented subprocess deadlock hazard. The reporter also notes the same `Popen(stdout=PIPE)` + `wait()` anti-pattern exists in `gateways_check.py` and `cpu_usage_check.py` โ worth auditing and fixing in the same PR since those are dormant but latent hazards. Also flagged: the exclusion setting `router.health.checks.to.exclude` apparently requires the `.py` extension to match โ worth verifying/fixing that matching logic too. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/32375697891) ยท sonnet50 224.8K ยท [โท](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) > <details> <summary>Add this agentic workflows to your repo</summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9 ``` </details> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, version: 1.0.52, model: claude-sonnet-5, id: 32375697891, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/32375697891 --> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
