Web UI timeout too short

[vendorbender_apc]

This was originally posted on APC forums on 5/26/2015

---

On all the web UI's for APC devices I have seen so far, the maximum idle time before auto-logoff is 10 minutes.

This drives me nuts. Not only is "security by obscurity" not particularly useful (especially if the session is already running over SSL/TLS), the glacial performance of the webserver in the APC cards means that every time I get auto logged-off on a device while I'm busy doing something else that is part of the same task and have to log back on, it takes an interminable time to get the management interface back up again.

I don't mind if you make some silly short timeout the default setting, but can you please offer some longer options for when we're multitasking and can't always get back to that page in time to avoid an auto-logoff?

(I have browsers that can be set to auto-reload pages but this is a PITA to have to do every time I touch an APC device)

Thanks.

[BillP]

This reply was originally posted by Angela on APC forums on 5/26/2015

---

Hi Phil,

Based on your comment about glacial speed using SSL/TLS, I assume you're talking about the older AP9617/18/19 cards? If so, these likely won't be updated to support longer than 10 minutes.

On v6.X.X firmware for AP9630/31/35 Network Management Card 2, user sessions work differently and now on a per user basis, you can now set this to a maximum of 60 minutes. (The default is still 10 minutes.) We also offer multiple users logged in at a time as well on that newer firmware platform. 

[voidstar_apc]

This was originally posted on APC forums on 5/26/2015

---

Those older cards only supported a single log-in, which could be a problem if you lose your session! The short timeout makes the session available again. Things are much better on the newer cards with multiple sessions and longer timeouts that Angela mentions.

[vendorbender_apc]

This was originally posted on APC forums on 5/26/2015

---

Yes, the older cards are what I have in my sites so far. (The last time I updated some hardware at a client site [this week] it was formerly using a 9619 linked with a custom temperature control device I had built around it, and I did not feel like billing to re-design and test that whole mechanism again just because the UPS went bad. So the new UPS went somewhere else and I used an older one and the 9619 card to keep all that working.)

However I did try your "test drive" page for the 963x cards the other day and I think I see what happened. I wanted to look at the environmental monitoring aspects and the 9631 page was basically dead (you may want to look into that, it's still that way today), so I went to the "UPS NMC with Environmental Monitoring & Out of Band Management" page - but it appears to be running a 9618 rather than a 9635. I had also looked at one of the dedicated environmental monitoring device's test drive page [http://159.215.9.66/] - same issues/older firmware. (I also did look at the 9630 page as well and saw the new UI, but didn't check the session timeout on it. I just looked again and found the new 60-min session timeout setting, thanks.)

Re: the overall interface performance - while it's certainly snappier than the 961x's and the other management UI's on your testdrive page, considering it's only running HTTP it was hard to accurately assess. So I'll take your word on that. 😉

PS: One other issue, while on the subject of the mgmt card UI - which looks very similar in this respect in the 963x cards - is in the event action page. It takes a ridiculously long time, IMHO, to configure those things because you have to drill down page-by-page into each subset of those events and actions, and then back-back-back to the beginning each time to adjust another one, and there is little "situational awareness" of what you end up with because there is no grid or matrix where you can view all the events/actions on one page and see which ones are eg set to non-default settings and what they are. So my wish list would include some sort of matrix with tickboxes where I can adjust a bunch of those at the same time and see them all in columns showing which are changed from defaults etc. Would save a huge amount of time if you're doing a lot of customization.

[Terry_Kennedy_apc · Accepted solution]

This was originally posted on APC forums on 5/27/2015

---

For the events and actions, I find it is a lot easier to FTP the config.ini file from the device, make mass edits using a text processor (cutting out all but the event section) and then FTP it back to the device. The only "gotcha" is that if you have alerts for configuration changes enabled, you will get an alert for every item that changes (but you'd also get that if you changed them one at a time via the web interface).