topic Re: qualys add-on 500 error in Splunk Enterprise

qualys add-on 500 error

aasabatini — Thu, 08 Apr 2021 14:17:10 GMT

Hi All,

I configured the qualys add-on to receive data from a qualys cloud platform.
He worked fine but today we didn't receive any event from qualys and on the internal logs we found this message.

TA-QualysCloudPlatform (ioc_events): 2021-04-08 14:04:08 PID=12050 [MainThread] ERROR: Unsuccessful while calling API [500 : Internal Server Error]. Retrying after 300 seconds:

someone can help me?

Re: qualys add-on 500 error

cmorenobuitrago — Mon, 17 May 2021 07:46:43 GMT

Hi @aasabatini,

Do you have more info in log? I had a similar message and I had to modify a time parameter in the POST that performs the script.

Kind regards

Re: qualys add-on 500 error

aasabatini — Mon, 17 May 2021 07:52:27 GMT

Hi @cmorenobuitrago

I understood if the qualys server receive a lot of requests it can block and start to send 500 server error.

I resolved the issue filtering the requests here on the qualys add on settings

delete and create the inputs again, restart the splunk server and should works.

hope can help