Debugging and Troubleshooting

In this topic, we have provided troubleshooting solutions for issues you may face while installing and configuring the Qualys Container Security Scanning Connector.

HTTP codes in API response

All API calls and their responses are logged by the plugin and are visible in the Console Output. Here are the HTTP response codes you may see during plugin execution.

Code	Error	Description
204	No content	Qualys sensor is processing data. You’ll see 200 OK when complete.
200	OK	You would see this code in two situations: You might have received partial data from Qualys where image details are available, but vulnerability data is not available. Vulnerability data is also available. This is usually the last call, after which the thread for that image ID stops.
500	Internal server error	Qualys service is down or there was an issue processing data.
400	Bad request	Qualys API server is unable to understand the request.
401	Unauthorized	The credentials used for Qualys API server are incorrect or the user does not have access to the APIs.

If you do not see any API calls being made...

Make sure you’re correctly passing image Ids to the plugin. When the plugin starts the execution, it prints the image Ids provided and you can see this in the Console Output. Check that the container image Ids you provided are printed.

Plugin times out, no report seen

The plugin is designed to keep polling the Qualys API until the configured timeout period is reached. If it does not get vulnerability data from Qualys within this period, it stops. In this case, the plugin fails the build only if you have set any fail-on conditions. Otherwise, it does not fail the build. You cannot see any report links since the plugin could not get vulnerability data, and could not prepare a report.

How to fix this?

On the Qualys Enterprise TruRisk™ Platform, go to Container Security > Assets > Images and verify if the image for which you are checking the vulnerabilities is present in the Images list.

If the image is not present, console logs have the following entry:

Get scan result API for image e0111ddfea06 returned code : 404;

HTTP Code: 404. Image: Not known to Qualys. Vulnerabilities: To be processed.. API Response : {"errorCode":"CMS-2002","message":"Data not available for given Image Id.","timestamp":1554568122039}

Ensure that the Qualys Container Sensor is installed on the host where image is being built.

If the image is present, console logs have the following entry:

Get scan result API for image cef4ca723229 returned code : 200;

Waiting for vulnerabilities data from Qualys for image id cef4ca723229

HTTP Code: 200. Image: known to Qualys. Vulnerabilities: To be processed.

Wait for the vulnerabilities data to be uploaded to the Qualys Enterprise TruRisk™ Platform.