Events Raised by NPS Appliances

The NPS appliance raises this event when a user edits the settings of the NPS virtual machine to add or remove a network adapter while the machine is running. For example, if the user wants to create yet another sniffing interface, the user must reboot the virtual machine for the changes to take effect.

Applicability: Virtual Appliance

Action Required:

1. Shut down the NPS appliance. 
2. Power on the NPS appliance. 

The NPS appliance raises this event when a user edits the NPS VM appliance settings to add a network adapter but does not configure the network adapter type to vmxnet3.

Applicability: Virtual Appliance

Action Required: 

1. Shut down the NPS appliance. 
2. Change the network adapter type to vmxnet3.
3. Power on the NPS appliance. 

The NPS appliance raises this event if it was inventorying assets but, for some reason, is unable to inventory any assets for a continuous duration of 2 hours. This can happen due to various reasons such as, a traffic tap configuration change altered the traffic that is mirrored to the NPS appliance and appliance can no longer see traffic needed for inventorying assets.

Applicability: Physical and Virtual Appliances

Action Required:

1. Ensure the correctness of the mirroring configuration on the tap.

   For example, check if both Tx/Rx traffic is mirrored from source VLANs/ports and any ACL that filters out protocols such as HTTP, SSH, DNS, DHCP, FTP, ARP, SSDP, WSD, SNMP, SIP, mDNS, SMB, Netbios, Kerberos is applied. The Passive Sensor deployment guide contains mirroring configurations that can be used for reference. Refer to the Network Passive Sensor Deployment Guide.

2. Verify that there are no connectivity issues in the physical cable or in the ERSPAN configuration and that the NPS appliance is receiving all mirrored traffic containing the relevant protocols on the sniffing interface.
3. Check that the NPS appliance internal asset configuration is proper according to the mirror traffic fed to the appliance.

The NPS appliance raises this event when any appliance module is restarted, caused by factors such as high memory consumption or a runtime module exit and restart.

Applicability: Physical and Virtual Appliance

Action Required:

• If the cause of the event is high memory consumption, then:

1. Increase the CPU and memory of the NPS resources as mentioned in Virtual Network Passive Sensor Throughput Capacity Based on Hardware.

OR

2. Reduce the amount of mirrored traffic fed to the NPS appliance, for example, by removing a few VLANs from the source mirror.

• If the cause of the event is not high memory consumption and these events occur repeatedly, contact Qualys customer support for further assistance and investigation.    

The NPS appliance raises this event when it exceeds its capacity in terms of active asset count.
Refer to the Virtual Network Passive Sensor Throughput Capacity Based on Hardware for the asset capacity of the virtual appliance.
Refer to the Appendix A - Product Specification for the asset capacity of hardware appliance models.

Applicability: Physical and Virtual Appliance

Action Required: 

You can perform one of the following option to resolve the issue:

1. Increase CPU and Memory of NPS resources for NPS VM as mentioned in the Virtual Network Passive Sensor Throughput Capacity Based on Hardware.
   
2. Reduce the amount of mirrored traffic fed to the NPS appliance.  For example, by removing a few VLANs from the source mirror.
   
3. Deploy multiple NPS appliances and split the mirrored traffic to be fed to different NPS appliances.
   

The NPS appliance raises this event when a user adds or removes a network adapter <intf no> with MAC address <mac-address> as a sniffing interface.

Applicability: Virtual Appliance

Action Required: No action required.

The NPS appliance raises this event for any of the following conditions:

• When a user connects or disconnects the interface for a virtual NPS.
• When a network cable is plugged in or unplugged for a hardware NPS.

Applicability: Physical and Virtual Appliance

Action Required: For hardware appliances, ensure the network cable is securely connected to the interface at both ends. If the issue persists, consider replacing the cable.

The NPS appliance raises this event due to the following conditions:

• When IP address configuration is changed for the sniffing interfaces.
• When the appliance is rebooted by the user from the NPS console, PS UI, or due to a software upgrade.
  

Applicability: Physical and Virtual Appliance

Action Required: No action required.

The NPS appliance raises this event when the configuration changes made from the UI cannot be applied to the appliance.

Applicability: Physical and Virtual Appliance

Action Required: Reconfigure and apply the changes after some time.

The NPS appliance raises this event when a user tries to apply any configuration changes during a software upgrade. 
Configuration changes include:

• Configuration of IP address to the sniffing interface.
• Changes to asset configuration, including inventory updates, monitor-external settings, or excluding assets from the UI.
• Changing the appliance state from sensing to paused or vice versa.
• Using the option of send feedback from the Asset Details page.
  

Applicability: Physical and Virtual Appliance

Action Required: Reconfigure and apply the changes after the appliance software upgrade process is completed.

The NPS appliance raises this event as soon as a software upgrade is successfully completed.

Applicability: Physical and Virtual Appliance

Action Required: No action required

The NPS appliance raises this event when the internal data pipeline cache memory grows beyond 3.8 GB, which could indicate an impact on the appliance's performance or resource management.

Applicability: Physical and Virtual Appliance

Action Required: 

1. Reduce the amount of mirrored traffic fed to the NPS appliance. For example, by removing a few VLANs from the source mirror.
   
2. Make sure the asset count in the traffic is under the limit as per the appliance model.
   

The NPS appliance raises this event when the appliance services are restarted as part of an upgrade process.

Applicability: Physical and Virtual Appliance

Action Required: No action required.

The NPS appliance raises this event when configuration changes are applied while the SQLite database is in a locked state. The database enters this state when multiple processes or threads try to access or modify it at the same time.

Applicabiity: Physical and Virtual Appliance

Action Required: 

1. Reconfigure and apply the changes after some time.
   
2. If the issue is not resolved and these events are seen whenever config changes are done, contact Qualys customer support.
   

The NPS appliance raises this event when the allocated CPU or RAM for the virtual appliance is below the specified requirement.

Applicability: Virtual Appliance

Action Required: The user must reallocate the virtual appliance to ensure it meets the minimum required CPU and RAM specifications.

The NPS appliance raises this event when its software upgrade fails, notifying the system that the upgrade process was unsuccessful and may require further attention or troubleshooting to resolve the issue.

Applicability: Physical and Virtual Appliance

Action Required: Contact Qualys customer support for assistance and guidance on resolving the software upgrade failure.

The NPS appliance raises this event when a user attempts to reboot the appliance while a software upgrade is in progress, ensuring that the reboot is prevented to avoid interrupting the upgrade process.

Applicability: Physical and Virtual Appliance

Action Required: No action required. The appliance automatically reboots once the ongoing upgrade process is completed.