These errors appear in log files for Windows Agents. Where can I find the log files?Where can I find the log files?
Windows Agent log files are in:
C:\ProgramData\Qualys\QualysAgent
On XP and Windows Server 2003, log files are in:
C:\Documents and Settings\All Users\Application Data\Qualys\QualysAgent
|
Common errors |
|
Scan errors |
|
Communication Layer errors |
|
Information Status |
Usually an agent error code that is coerced from a server-side HTTP(s) 409 reply indicating that the client should delete the client-side snapshot, delta, and change-list files. This happens when an inconsistency with the state of the client’s snapshot is detected.
This error is also generated after a successful reprovision. In this case the error code does not indicate failure. After a reprovision the agent will start a new snapshot for the client as if it were installed for the first time. Old snapshots are disassociated with the client when an agent reprovisions. Therefore agents must rebuild its client echo from scratch when the agent rejoins the network under a new ID.
This error should never happen outside of a cloning situation. It is not a critical error however root-cause analysis must be performed to understand the purpose for the scorch.
Agent would request a resource download from the server. If the resource download request is not successfully completed (i.e. the HTTP result is not 200), this code is used by agent.
Usually an agent error code that is coerced from a server-side HTTP(s) 424 reply indicating that the client should be reprovisioned. This is typically the case when an agent is cloned during a system image and deploy scenario. Agents that assume the identity of another agent (e.g. a clone) are detected by our cloud platform backend processes and rejected. Part of that rejection is to inform the agent that it should request a new ID from the system. This is the concept of a reprovision. A new agent ID is created during the provisioning process.
This error should never happen outside of a cloning situation. It is not a critical error however root-cause analysis must be performed to understand the purpose for the reprovision.
Whenever a new config is received from the server, Agent internally uses this code. The current config-GUID is checked against the latest one received, if they mismatch it is considered as new config, and this error code is used. On reception of a new config, further processing is stopped and new config will be applied first. Currently, this error code may not appear in logs.
An unrecoverable error occurred attempting to read, write, open, or close the snapshot, delta, or change-list databases during a scan. The issue may be resolved by deleting the snapshot, delta, and change-list files on the client. After one scan phase the agent should repair itself.
An unrecoverable error occurred attempting to read or write to the snapshot, delta, or change-list databases during a scan. The issue may be resolved by deleting the snapshot, delta, change-list, and all manifest files on the client. The agent will automatically download new manifests and after one scan phase the agent should repair itself.
An error generated by the scanner indicating that the client’s echo on the server is not in sync with the client. This should result in a 30004 (QAGENT_ERROR_SCORCH_EARTH) error subsequently to generate a new snapshot.
50011 (Error) - ERROR_HASH_ENTRY_NOT_FOUND
50100 (Error) - ERROR_INSERT_CONSTRAINT_FAILED
50120 (Error) - ERROR_MANIFEST_PARSE_FAILED
This should subsequently result in a 30004 error (QAGENT_ERROR_SCORCH_EARTH) to generate a new snapshot.
An error while executing the command manifest.
This error indicates that the agent has resolved the DNS name of the cloud endpoint but cannot establish a connection to that endpoint. One reason for this is intermittent or faulty connectivity between the client and the cloud. Also, slow or congested networks and some firewall rules may also intermittently cause this error. Learn moreLearn more
This WinHTTP error causes the agent to connect to the cloud endpoint using a fallback (or backup) URI that has been previously determined and stamped into the cloud agent. This is typically the same URI that the Agent used when it was first installed on the client.
This indicates an internal error.
This error indicates that the agent cannot resolve the FQDN of the cloud endpoint. This often indicates a network route issue between the client and the cloud which can be attributed to no network interfaces available on the client, no connectivity to DNS servers, or a misconfigured cloud endpoint FQDN. Learn moreLearn more
This WinHTTP error causes the agent to connect to the cloud endpoint using a fallback (or backup) URI that has been previously determined and stamped into the cloud agent. This is typically the same URI that the Agent used when it was first installed on the client.
This error indicates that the URL is not valid.
This error may occur due to various factors, such as malformed responses or unexpected content from the server.
This error indicates that the agent has resolved the DNS name of the cloud endpoint but cannot establish a connection to that endpoint. One reason for this is that cloud endpoint URI may be incorrect or there is no network route currently available between the client and the cloud. Learn moreLearn more
This WinHTTP error causes the agent to connect to the cloud endpoint using a fallback (or backup) URI that has been previously determined and stamped into the cloud agent. This is typically the same URI that the Agent used when it was first installed on the client.
This error indicates that the agent has resolved the DNS name of the cloud endpoint but cannot establish a connection to that endpoint. Possible reasons for this error include firewall configurations that actively block or disallow connections from the client to the cloud. Also, route issues that prevent TCP/IP connections from getting created between client and cloud will also generate this error. Learn moreLearn more
This WinHTTP error causes the agent to connect to the cloud endpoint using a fallback (or backup) URI that has been previously determined and stamped into the cloud agent. This is typically the same URI that the Agent used when it was first installed on the client.
This error indicates that the certificate required for Secure Sockets Layer (SSL) communication is not present on the client. This issue may be resolved once the SSL certificate is installed on the client.
This error indicates that the server does not recognize the snapshot the agent has created. This error indicates a conflict with another agent on the network. This has specifically been implemented to respond not to VM or deployment machine cloning scenarios. The agent will reprovision (e.g. rejoin the Cloud Agent network), consume a new client license/key/seat, and retrieve a new ID from the server. This will also scorch (e.g. start fresh) a new client echo of the machine.
This error indicates that a configuration profile file for the agent does not yet exist on our cloud platform. This error is benign and is simply logged to indicate that the agent is operating under a default profile plan.
This error indicates that the target resource does not have a current representation that would be acceptable to the user agent.
This error indicates that the server is refusing to process a request because the request content is larger than the server is willing or able to process.
This error indicates the user has sent too many requests in a given amount of time.
This error indicates that the server while acting as a gateway or proxy, received an invalid response from an inbound server it accessed while attempting to fulfill the request.
Rare HTTP error code (424) that might occur while delta is being uploaded to server. This error code, along with following mentioned HTTP error codes would cancel the delta upload and would log "Unrecoverable error during delta upload". Error codes:
HTTP_STATUS_NO_CONTENT (204)
HTTP_STATUS_BAD_REQUEST (400)
HTTP_STATUS_CONFLICT (409)
The error code 424 is supposed to happen only with WebDAV and is mentioned in RFC 4918. Other three mentioned error codes, however, may also cause delta upload to be cancelled.
This information status code indicates that no errors have occurred during the processing of an operation. It is a generic information-only indicator of success or successful operation.
The Agent received a service stop and is aborting the current operations i.e. HTTP request, scan, upload, download, etc.
This information status code is found in two places: 1) during snapshot/delta upload, and 2) during snapshot processing.
During snapshot/delta upload this status code indicates that the agent is currently uploading snapshot/delta file fragments to the cloud. There may be one or more ERROR_IO_PENDING messages depending on the size of the snapshot/delta being uploaded. After the last file fragment has been uploaded a successful status code of 0 (zero) will get returned from this process.
During snapshot/delta processing this status code indicates that the agent is currently waiting for the cloud to finish processing the last uploaded snapshot/delta. The agent will remain in this state until the server informs the agent that it has completed its work.
Additional Resource
You can check out the tutorial for Troubleshooting - Common Errors.