Error when sending Custom PDF Reports using Email Scheduler - "mail send: curl_easy_perform() failed: Timeout was reached"

[Nick_Davis1639]

Hello,

I am runnning a mix of PA-820 and PA-850 firewalls, and I have a daily report group setup with about 8 different reports in it that fails to email me successfully. Everyday the error "mail send: curl_easy_perform() failed: Timeout was reached" is shown in the System log.  The reports are actually generated daily and I can view them under Monitor > Reports however they are just not emailed to me.

I have found that if I reduce the number of reports on that report schedule, or even if I trim down the reports (changing from Sort By: Count Top 500 to Sort By: Count Top 50) the email is received successfully. I am not hitting a max attachment size on my email server with the reports at their original size. I exported each report separately as PDF's and added up their total size and it's about 1 MB.

I have also played with the CLI command debug reportd set-timeout and increased that to max value "18000" but that made no change. I think this command is more for the actual reports being generated, which again is not an issue. The issue specifically is the email scheduler and actually sending the PDF reports off to me.

I do have a TAC case open for about 2 weeks now with no progress. Does anyone know if there is a way to adjust the email scheduler timeout or get around this error without having to reduce the size of my reports?

[kiwi]

Hi @Nick_Davis1639 ,

Seems to be the same issue as https://live.paloaltonetworks.com/t5/general-topics/failed-to-send-email-reports/td-p/456431

Workaround in this case was also to reduce the number of reports.

Kind regards,

-Kiwi

[Nick_Davis1639]

It does seem like the same issue, and like I mentioned in my original post I was able to get them to send by trimming down the reports. I also determined last night that if I split the large reports into many individual report groups / schedules they also send.

However that is just a workaround and I am searching for a real solution to the issue. I am hoping there is a way to increase this timeout so that I can email the current size of the reports in a single report group.

If there is limitations on these firewalls for how many reports / size of reports before it will trigger a timeout then Palo Alto needs to do a better job at documenting that for customers.