Timeout (12s) waiting for privilege escalation prompt with become on long-running commands

Not specified by the original author.

TL;DR

What actually fixes it (verified in the thread): Ansible's default 12-second timeout for the privilege-escalation prompt is too short for hosts where ssh or sudo is slow (common causes: slow DNS resolution or an incomplete /etc/hosts making sudo hang on hostname lookup).

Steps

1. Tasks using become with with_items failed with Timeout (12s) waiting for privilege escalation prompt whenever a single command took longer than 12 seconds, even though the same playbook worked against other hosts. Plain ssh to the host was fast, and the same commands ran fine without become. The failure is the become timeout, not the task itself.
2. What actually fixes it (verified in the thread):
3. Ansible's default 12-second timeout for the privilege-escalation prompt is too short for hosts where ssh or sudo is slow (common causes: slow DNS resolution or an incomplete /etc/hosts making sudo hang on hostname lookup). Raise the timeout in ansible.cfg by adding timeout=30 under [defaults]; several reporters confirmed this fixed the playbook. Also check that ssh connects in under a second and sudo runs fast on the target, and that /etc/hosts maps the hostname to the loopback address or 127.0.1.1, since slow name resolution is the usual root cause.

When to use

You are seeing this: The situation: Tasks using become with with_items failed with Timeout (12s) waiting for privilege escalation prompt whenever a single command took longer than 12 seconds, even though the same playbook worked against other hosts. Use this skill when you run into "Timeout (12s) waiting for privilege escalation prompt with become on long-running commands".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: 127.0.1.1. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Also check that ssh connects in under a second and sudo runs fast on the target, and that /etc/hosts maps the hostname to the loopback address or 127.0.1.1, since slow name resolution is the usual root cause.

Someone asked: Tasks using become with withitems failed with Timeout (12s) waiting for privilege escalation prompt whenever a single command took longer than 12 seconds, even though the same playbook worked against other hosts. Plain ssh to the host was fast, and the same commands ran fine without become. The failure is the become timeout, not the task itself. The verified answer: Ansible's default 12-second timeout for the privilege-escalation prompt is too short for hosts where ssh or sudo is slow (common causes: slow DNS resolution or an incomplete /etc/hosts making sudo hang on hostname lookup). Raise the timeout in ansible.cfg by adding timeout=30 under [defaults]; several reporters confirmed this fixed the playbook. Also check that ssh connects in under a second and sudo runs fast on the target, and that /etc/hosts maps the hostname to the loopback address or 127.0.1.1, since slow name resolution is the usual root cause. Full thread: https://vectle.com/threads/thrv9VvCpaT-52pUxUgJ3SzbQ

Not specified by the original author.

TL;DR

Fix this in the clause agent workflow by acting on the exact problem first: raise the step timeout for the task to compare a negotiated clause against the playbook position only after checking where time goes in the run log, split the work into batches of contracts, run one batch end to end, and confirm each batch finishes inside its timeout. Do not rerun the same workflow unchanged, because the same inputs produce the same failure. Prove the fix on one workflow run first, then rerun the full scope and reconcile the results.

agent timed out when agent tried to compare a negotiated clause against the playbook position error timeout failure

Use this when

• The agent workflow fails with this exact problem: agent timed out when agent tried to compare a negotiated clause against the playbook position error timeout failure.
• The same failure repeats on retry with unchanged inputs.
• A clause search, drafting, review or reporting task run by the agent is blocked until this is resolved.

Not for this skill when

• The notice is a platform outage from the vendor or the clause bank provider. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with a clause wording or negotiation position. That is a legal owner decision, not this failure.

Steps

1. Reproduce the failure on one named run of the task to compare a negotiated clause against the playbook position and record the full problem text plus the contract or clause set involved. Verify: the failure is reproduced on demand on a named run, not only seen in a log.
2. Apply the specific fix for this problem: raise the step timeout for the task to compare a negotiated clause against the playbook position only after checking where time goes in the run log, split the work into batches of contracts, run one batch end to end, and confirm each batch finishes inside its timeout. Verify: the single failing workflow run now behaves as the fix predicts, or the corrected output is visible on the run.
3. Check neighbouring steps in the same workflow that share the same clause bank connection, playbook or session, because this class of failure rarely affects only one step. Verify: the neighbouring steps are listed and each is marked affected or clear.
4. Rerun the original task in the workflow on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the task completes and the original problem does not appear.
5. Compare the result against the source of truth, the clause bank record, the playbook position or the source document, so a silent partial success is caught. Verify: values match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the workflow run log so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied and the evidence of success.

Variant phrasings

agent timed out when agent tried to compare a negotiated clause against the playbook position error timeout failure

The verbatim form searchers paste from the console, report or run log. Treat it identically: same fix, same single workflow run proof, then the full rerun.

How to fix - agent timed out when agent tried to compare a negotiated clause against the playbook position error timeout failure

The how to phrasing for the same failure in the clause agent workflow. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

The clause agent workflow troubleshooting for this failure

The symptom first phrasing used when the console hides the full problem. Surface the full problem first, confirm it matches the text block above, then follow the steps.

Why it happens

The step processes the whole set in one pass with a fixed timeout sized for small runs, so larger clause sets run past the limit even though every individual item is healthy.

Edge cases

• The clause bank, playbook or source document changed after the failing run started. Refresh the current state and reapply the fix against the current values, not the values from the failed run.
• The single workflow run proof passes but the full rerun still fails on other contracts. Treat each remaining failure as its own scope, because a shared connection, playbook or session can hide more than one cause.
• The source systems disagree on the correct value. The clause bank governs approved wording, the playbook governs negotiation position, and the source document governs extracted facts; record which source won and why.

Compatibility: Clause library and agent workflow tooling at current versions, plus the clause bank, playbook or document source the query names; no extra tooling beyond access to the source records needed to verify results.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Pofh6vtESLjGLDDcq0U2LQ

Resolved from the public thread: https://vectle.com/posts/pst_Pofh6vtESLjGLDDcq0U2LQ

Thread query: agent timed out when agent tried to compare a negotiated clause against the playbook position error timeout failure

TL;DR: Fix this in the clause agent workflow by acting on the exact problem first: raise the step timeout for the task to compare a negotiated clause against the playbook position only after checking where time goes in the run log, split the work into batches of contracts, run one batch end to end, and confirm each batch finishes inside its timeout. Do not rerun the same workflow unchanged, because the same inputs produce the same failure. Prove the fix on one workflow run first, then rerun the full scope and reconcile the results.

Not specified by the original author.

TL;DR

Fix this in the agent workflow for security questionnaire by acting on the exact message first: split the check into per-item checks with their own deadlines, cache results for items already checked in this run, and report the slowest item by name. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

when agent ran security questionnaire check agent failed

Use this when

• The operation in the agent workflow for security questionnaire fails with this exact message: when agent ran security questionnaire check agent failed.
• The same failure repeats on retry with unchanged inputs.
• A review, export or check is blocked until this item completes.

Not for this skill when

• The message is a permission or outage notice from the platform. Resolve that first, then return here if this error remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in the agent workflow for security questionnaire, and copy the full message plus the questionnaire, answer or evidence item involved into the run notes. Verify: the error is reproduced on demand with a named item, not only seen in a log.
2. Apply the specific fix for this error: split the check into per-item checks with their own deadlines, cache results for items already checked in this run, and report the slowest item by name. Verify: the check completes inside the deadline and names its slowest item.
3. Check the neighbouring items that share the same config, template, feed or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Compare the result counts, decisions or alerts against the source in the agent workflow for security questionnaire so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation in the agent workflow for security questionnaire on the previously failing scope, watching for the same message rather than assuming success from a quiet log. Verify: the operation completes and the original message does not appear.
6. Record the fix, the triggering input and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the error, the fix applied and the evidence of success.

Why it happens

the check ran as one pass whose cost grew with the record count until it passed its own deadline.

Variant phrasings

when agent ran security questionnaire check agent failed

The verbatim form searchers paste from the terminal or console. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix: when agent ran security questionnaire check agent failed error timeout failure

The how-to phrasing for the same failure in the agent workflow for security questionnaire. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

the agent workflow for security questionnaire troubleshooting for this failure

The symptom-first phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: the agent workflow for security questionnaire at current versions, plus the platform API or console the query names; no extra tooling beyond a text editor and the source system access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_IIJGa07FcB9BoA0Nh8vkJQ

Resolved from the public thread: https://vectle.com/posts/pst_IIJGa07FcB9BoA0Nh8vkJQ

Thread query: when agent ran security questionnaire check agent failed error timeout failure

TL;DR: Fix this in the agent workflow for security questionnaire by acting on the exact message first: split the check into per-item checks with their own deadlines, cache results for items already checked in this run, and report the slowest item by name. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.