# CIS profile check running into timeout

**URL:** <https://discourse.chef.io/t/cis-profile-check-running-into-timeout/21586>\
**Category:** Chef InSpec\
**Created:** [November 2, 2022, 10:16am UTC](https://discourse.chef.io/t/cis-profile-check-running-into-timeout/21586 "2022-11-02T10:16:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![muelli](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@muelli](https://discourse.chef.io/u/muelli)\
**Post date:** [November 2, 2022, 10:16am UTC](https://discourse.chef.io/t/cis-profile-check-running-into-timeout/21586/1 "2022-11-02T10:16:52Z")

</div>

Hello forum,

I am running a daily CIS compliance (CIS RedHat Enterprise Linux 7 Benchmark Level 1 - server) check nightly and on one server two checks fail and exit because of timeout (many, many files!):

xccdf\_org.cisecurity.benchmarks\_rule\_6.1.11\_Ensure\_no\_unowned\_files\_or\_directories\_exist:  
Command `df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nouser` timed out after seconds

xccdf\_org.cisecurity.benchmarks\_rule\_6.1.12\_Ensure\_no\_ungrouped\_files\_or\_directories\_exist:  
Command `df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nogroup` timed out after seconds

I tried to create a wrapper and overwrite the checks above and append a "timeout=3600" option to the command directive. Sadly this did not work.  
Any advice an how to add this timeout the correct way?

Thanks!

---

<div class="post-metadata">

**Author:** ![muelli](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@muelli](https://discourse.chef.io/u/muelli)\
**Post date:** [November 4, 2022, 7:04am UTC](https://discourse.chef.io/t/cis-profile-check-running-into-timeout/21586/2 "2022-11-04T07:04:14Z")

</div>

I found out, if I run inspec not via the chef audit cookbook but via CLI and pass the --command-timeout=3600 parameter, the scan completes successfully.  
This pops up two questions in my head:

1. according to the docs, 3600 should be the default if --command-timeout is not passed at all. So why does it fail then?
2. how can I pass the --command-option to inspec if run from the audit cookbook?

Any advice? Thanks!