Troubleshooting Common Communication Error
Click to view navigation pane

Home

Troubleshooting Common Communication Errors

If you do not utilize a proxy and the agent is to communicate to our platform directly via the internet (WinHTTP error code: 12180), you can try the following the steps below to validate successful communication to our platform from the impacted agent host: 

  1. Open a browser and navigate to your respective platform URL. As depicted by the attached image for US Platform 1 as an example, the arrows/boxes indicate that the connection is successful and secure.

    connection to Qualys platform

    If it is then it means that the browser is able to connect with Qualys Cloud Platform over port 443, correct certificate, TLS, and cipher support.

    If this is unsuccessful, then another application (browser) on impacted host is not able to connect. Please contact your network team as your assets must be able to reach your Qualys Cloud Platform (or the Qualys Private Cloud Platform) over HTTPS port 443.

    If this is successful but Agent is still unable to connect, perform Step 2. 

  2. Execute curl –vvv <platform URL> 

Example for IN Platform 1  

curl –v https://qagpublic.qg1.apps.qualys.in/status

Use the following if using proxy:

curl -x < proxy url:port> -v https://qagpublic.qg1.apps.qualys.in/status

Use the following with Cloud Agent header:

curl -i -v -H "User-Agent:QAgent" -x < proxy url:port> https://qagpublic.qg1.apps.qualys.in/status

This is useful for Patch Management troubleshooting to download patch using curl while passing Cloud Agent header.

If curl is not installed and cannot be installed, then following PowerShell command can be used, however, this will not provide output that shows DNS resolution/ SSL Handshake.

Invoke-WebRequest -Uri 'https://qagpublic.qg1.apps.qualys.in/status' -UseBasicParsing -DisableKeepAlive -Proxy <proxy url:port>
‎

Successful CURL Output 

Expected Result

The highlighted 200 response is expected. 

Troubleshooting Steps 

If a 200 response is not received, please check network connectivity/speed, firewalls, and any anti-virus / HIPS software for any activity that could disrupt the curl/agent service connection to the platform. 
‎
‎If this is successful but the agent is still unable to connect then restriction in your environment is specifically for Qualys Cloud Agent. Take a PCAP capture or TCP Dump while restarting cloud agent service.

Capture Network Traffic

Wireshark/Network Monitor

  1. Download Wireshark from https://www.wireshark.org/download.html and Install.

  2. Enable Wireshark packet capture on the machine.

  3. Restart the Agent service and wait till the issue gets reproduced, that is,  verify that the Agent has generated the latest logs with the error code 12002/12152/12175, and so on.

  4. Once the latest error logs are generated, stop packet capture and save this capture.

    /

  5. Compare the capture with the working capture screenshots presented here. Check where the request for qagpublic.qg1.apps.qualys.com domain is failing/getting Reset/finished.

You can capture network traffic without installing any third-party tool on Windows assets.

Capture Network Trace

  1. Open an elevated command prompt and run the following command:

    "netsh trace start persistent=yes capture=yes tracefile=c:\temp\nettrace-boot.etl"

    Ensure that you have a \temp directory or choose another location. Using persistent=yes will ensure that the packet tracing session resumes upon restarting the computer and continues to function until the “Netsh trace stop” command is issued. If unspecified, the default entry for persistent is no.

  2. Reproduce the issue by restarting the Cloud Agent service and wait till the issue gets reproduced, that is, verify that the agent has generated the latest logs with the error code 12002/12152/12175, and so on.

  3. Once the latest error logs are generated, open an elevated command prompt and run: "netsh trace stop"

Your trace will be stored in c:\temp\nettrace-boot.etl**or wherever you saved it.

Example of a successful connection between Cloud Agent and Qualys Platform

Once the connection is validated to be successful if the agent is reporting a backoff multiplier, which is the amount of time (in seconds) the agent must wait for connection retry, please stop and restart the Cloud Agent service as this will refresh the multiplier and retry connection. 

Steps to Restart Cloud Agent for Windows Service

From a command prompt, execute the following commands as an administrator to stop and restart the Qualys Cloud Agent service on Windows OS: 

Steps to Restart Cloud Agent for Linux/Mac Service

Terminal Commands to restart Cloud Agent for UNIX service: