VNC console fails to connect

[KamalaVenkatesh]

Description:
When try to open an instance VNC console, we get an error message (such as "failed to connect server; code=1006) after some time.For the initial 5 min it work successfully.(pike release)

Workaround:
browser refresh it eventually works.

Logs:
nova-consoleauth.log
INFO nova.consoleauth.manager [req-0db1a667-bba0-427d-ba0b-4f03ecf1bcca - - - - -] Checking Token: f2c6eac1-ad7a-4bbf-8952-7e7fd5c4ae75, False

nova-novncproxy.log
INFO nova.console.websocketproxy [req-0db1a667-bba0-427d-ba0b-4f03ecf1bcca - - - - -] handler exception: The token 'f2c6eac1-ad7a-4bbf-8952-7e7fd5c4ae75' is invalid or has expired

Environment
-3 compute nodes and 2 controller nodes
-nova.conf on compute node has,
 vnc_enabled = True
 novnc_enabled = True
 vnc_keymap = en-us
 vncserver_listen = 0.0.0.0
 vncserver_proxyclient_address = 10.20.0.137
 novncproxy_base_url = http://10.20.3.101:6080/vnc_auto.html

-nova.conf on controller node has [cache] section
 [cache]
 enabled = true
 backend = oslo_cache.memcache_pool
 memcache_servers = 10.20.0.142:11211,10.20.0.164:11211,10.20.0.152:11211

Steps to reproduce
login to the dashboard as a project user, spawn a VM, from the drop down - select VNC console. Able to connect to vnc console for initial 5-7 min after this not able to connect.An empty VNC window appears but cannot connect to the VM with an error "Failed to connect to server(code:1006)".
100% repeatable

any guidance on resolve this would be really appreciated

[Takashi Natsume (natsume-takashi)]

There is the 'token_ttl' parameter in nova configuration file (nova.conf).
It defines expiration time of vnc console token.
The default is 600 seconds (10 minutes).
You can change this value.

[consoleauth]

#
# From nova.conf
#

#
# The lifetime of a console auth token.
#
# A console auth token is used in authorizing console access for a user.
# Once the auth token time to live count has elapsed, the token is
# considered expired. Expired tokens are then deleted.
# (integer value)
# Minimum value: 0
# Deprecated group/name - [DEFAULT]/console_token_ttl
#token_ttl = 600

[KamalaVenkatesh (kamala)]

i have tried by adding following content to nova.conf

[consoleauth]
token_ttl = 1200

in controller nodes as well as in compute nodes, and restarted services, expected that issue will reproduce after 20 min(acc to above changes)
But i dint find any time changes(issue was reproducible within 10 min only).

correct me if i am doing any wrong things here.

Is there any way can i remove this token_ttl logic, so that vnc console will be available all time.

[Sylvain Bauza (sylvain-bauza)]

Have you restarted the specific nova-consoleauth service ?

TBC, the VNC console is one way to quickly access the instance, but if you need more, there are other ways to connect the guest :
https://docs.openstack.org/nova/pike/admin/remote-console-access.html

Putting it as Invalid since I don't really see a clear Nova issue, but let's reopen the bug by marking it as "New" if you can explain more what's the specific issue you have.