Security

Qualys app is having an issue in retrieving the password from the app file ?

Hemnaath
Motivator

Hi All Currently we are facing an issue in retrieving the password from the app file and we are getting the below error in
/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log

Error Details:

TA-QualysCloudPlatform: 2017-10-18T00:10:46Z PID=20224 [MainThread] ERROR: TA-QualysCloudPlatform - Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/TA-QualysCloudPlatform/admin/passwords: [Errno 111] Connection refused',)
TA-QualysCloudPlatform: 2017-10-18T00:11:46Z PID=20229 [MainThread] ERROR: TA-QualysCloudPlatform - Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/TA-QualysCloudPlatform/admin/passwords: [Errno 111] Connection refused',)
TA-QualysCloudPlatform: 2017-10-19T14:09:40Z PID=64521 [MainThread] ERROR: TA-QualysCloudPlatform - Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/TA-QualysCloudPlatform/admin/passwords: [Errno 111] Connection refused',)
TA-QualysCloudPlatform: 2017-10-19T14:10:39Z PID=64533 [MainThread] ERROR: TA-QualysCloudPlatform - Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/TA-QualysCloudPlatform/admin/passwords: [Errno 111] Connection refused',)
TA-QualysCloudPlatform: 2017-10-20T01:40:56Z PID=12944 [MainThread] ERROR: TA-QualysCloudPlatform - Error during request to /msp/about.php, [None] Tunnel connection failed: 503 Service Unavailable.

Qualys add-on version : 1.1.0.20161024
Add-on is installed in the Heavy forwarder instance and search head cluster members.

Kindly guide me how to fix this issue.

0 Karma

PCT80000
Explorer

Hello,

Is it worth checking permissions to the .conf file containing the password? Our installation holds this in \local\passwords.conf

0 Karma

Hemnaath
Motivator

Hi we have set the passwords.conf file under this location "/opt/splunk/etc/apps/TA-QualysCloudPlatform/local/passwords.conf " its owned by splunk

-rw-r--r-- 1 splunk splunk 46 Jul 7 11:39 passwords.conf

0 Karma

PCT80000
Explorer

That matches our perms. Apologies but I can't think of any other suggestions here.

0 Karma

Hemnaath
Motivator

hey I had raised a splunk support ticket but it seem splunk is not supporting this app and they informed to contact the APP developer. Not sure how to raise a ticket with the app developer.

can you guide on this.

thanks in advance.

0 Karma

Hemnaath
Motivator

Hi All, Can anyone guide me how to raise a ticket with the app developer ?

thanks in advance.

0 Karma

Hemnaath
Motivator

Hi All, We are able to get the qualys data in to splunk, after re-installing / re -configuring the app completely. We have update the TA-Qualys Add-on with the latest version 1.2.3.

0 Karma

Hemnaath
Motivator

Hi All, Can anyone guide me how to fix this issue.
thanks in advance.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...