While trying to setup TA-QualysCloudPlatform, I'm getting the below error. I have the correct proxy and the Qualys server details set up.
Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/TA-QualysCloudPlatform/qualys/qualys_configure/setupentity
Why it is giving this error and how to resolve this?
I only needed to rename the passwords.conf file and restart the service to update the password:
$SPLUNK_HOME$/etc/apps/TA-QualysCloudPlatform/local/passwords.conf
Similar to justinbarta, this is what worked for me:
0) Make a note of the settings that are currently working from the TA setup page (I copy and pasted it into Word)
1) Delete or move to a temp directory, the config files in: $SPLUNK_HOME$/etc/apps/TA-QualysCloudPlatform/local
(app.conf and qualys.conf)
2) Restart Splunk
3) Enter information in TA setup page again with new credentials
Re-installation of the TA was not needed.
There's a new version 1.1.0 of Qualys TA for Splunk available in Splunkbase. I would suggest you upgrade to that. There's a major difference between 1.1.0 and earlier versions regarding how the API credentials are stored. That would help you get rid of this error.
I'm on 1.1.0 and have this error.
Any suggestions?
Do you see any error being reported in _internal index (or anywhere else)?
As a second thought, have you tried deleting app.conf, qualys.conf from your /local directory, then restarting the Splunk and then trying to set it up again?
This worked for me. Deleting the conf files, restarting, and resetting up the app Worked !!
I did not need to reinstall.
Thank you
FYI this still occurred with 1.1.0 and still occurs with 1.2.3.
Qualys requires a password changed every 60-90 days.
Each time I'm forced to delete the the conf files and re-setup the app.