Errors running Qualys TA

[responsys_cm]

I'm seeing two different errors with the Qualys TA. When I try and setup the app, I see the following:

Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/TA-QualysCloudPlatform/qualys/qualys_configure/setupentity

When I look in the qualys.conf, I can see the password in clear text rather than being encrypted...

I'm also seeing this error message when running the TA on a search head cluster:

TA-QualysCloudPlatform: 2018-07-20 18:19:05 PID=23510 [MainThread] ERROR: TA-QualysCloudPlatform - This setup is configured as Search Head. You should not run %s on Search Head. I am Exiting.

Why can't the TA run on a search head? That makes no sense considering that all of the searches in the Qualys app depend on the knowledge base lookup table. Do I have to run this on a separate box, have it input the knowledge base and then summary index the results so the search heads can build the KB?

[frankwayne]

My solution to this problem was to comment out lines 89-91 of qualys.py in the bin directory in the Add-on. This (bad) code checks to see if it is running on a search head and skips the work that we want done.

It would be nice if Qualys fixed the code with a ", input_name" before the closing parenthesis in line 90 so that %s gets filled in, but they can't even find the time to respond to your question. And we're commenting it out anyway. 🙂

For reference, the code to be removed is:

if server_info and server_info.is_search_head() and input_name != "qualys://knowledge_base":
    qlogger.error("This setup is configured as Search Head. You should not run %s on Search Head. I am Exiting.")
    continue

I hope this helps.

[ayushchoudhary]

The below document will help you to configure Qualys

https://www.qualys.com/docs/qualys-ta-for-splunk.pdf

[frankwayne]

I downvoted this post because it does not address the question at all.