All Apps and Add-ons

Qualys-TA: Error during knowledgebase-run

New Member

First time installer of Qualys-TA.

After completing all the setup in UI, i ran the command (as mentioned in page 26 of the docs:😞


cd $SPLUNK_HOME/etc/apps/TA-QualysCloudPlatform

$SPLUNK_HOME/bin/splunk cmd python ./bin/ -k -s -u   <qualys username> -p <qualys password>


This throws an error in log ($SPLUNK_HOME/var/log/splunk/ta_QualysCloudPlatform.log)  as follows:

qualysModule.splunkpopulator.basepopulator.BasePopulatorException: could not load API response. Reason: 'Event' object has no attribute 'write_event'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/", line 240, in _run
AttributeError: 'BasePopulatorException' object has no attribute 'message'

When i added more debug info to the various python scripts, i saw that the error pointed to "NoneType" for self.EVENT_WRITER.


The above log contained more info as below:

TA-QualysCloudPlatform: 2021-11-24 15:09:52 PID=564017 [MainThread] INFO: Python interpreter version = 3
TA-QualysCloudPlatform: 2021-11-24 15:09:52 PID=564017 [MainThread] INFO: Qualys TA version=1.8.11
TA-QualysCloudPlatform: 2021-11-24 15:09:52 PID=564017 [MainThread] INFO: Running for policy_posture_info. Host name to be used: $decideOnStartup. Index configured: main. Run duration: 9 * * * *. Default start date: 1999-01-01T00:00:00Z.
TA-QualysCloudPlatform: 2021-11-24 15:09:52 PID=564017 [MainThread] INFO: TA-QualysCloudPlatform using username trann3ls73 and its associated password.
TA-QualysCloudPlatform: 2021-11-24 15:09:52 PID=564017 [MainThread] INFO: API URL changed to for policy_posture_info data input
TA-QualysCloudPlatform: 2021-11-24 15:09:52 PID=564017 [MainThread] INFO: Another instance of policy_posture_info is already running with PID 508724. I am exiting.


on doing ps-ax | grep splunk, i could see many instances running as below:


root@splunktest:/opt/splunk/etc/apps/TA-QualysCloudPlatform/tmp# ps ax | grep splunk
12657 ? Sl 15:28 splunkd -p 8090 start
12658 ? Ss 0:00 [splunkd pid=12657] splunkd -p 8090 start [process-runner]
508681 ? S 0:00 /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/
508724 ? S 0:00 /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/
508734 ? S 0:00 /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/
508908 ? S 0:21 /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/
555183 ? S 0:00 /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/
555192 ? S 0:00 /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/
555219 ? S 0:00 /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/
565505 ? Sl 0:15 splunkd -p 8089 restart
565506 ? Ss 0:00 [splunkd pid=565505] splunkd -p 8089 restart [process-runner]


Finally, after killing those PIDs , i could get rid of the error.

This really needs to be fixed or a proper troubleshooting must be documented as it caused me headaches for 2 whole days! 🙂


Labels (3)
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...