Splunk Enterprise

qualys add-on 500 error

aasabatini
Motivator

Hi All,

I configured the qualys add-on to receive data from a qualys cloud platform.
He worked  fine but today we didn't receive any event from qualys and on the internal logs we found this message.

TA-QualysCloudPlatform (ioc_events): 2021-04-08 14:04:08 PID=12050 [MainThread] ERROR: Unsuccessful while calling API [500 : Internal Server Error]. Retrying after 300 seconds: 

someone can help me?

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Labels (2)
Tags (3)
0 Karma

cmorenobuitrago
Explorer

Hi @aasabatini,

Do you have more info in log? I had a similar message and I had to modify a time parameter in the POST that performs the script.

Kind regards

0 Karma

aasabatini
Motivator

Hi @cmorenobuitrago 

 

I understood if the qualys server receive a lot of requests it can block and start to send 500 server error.

I resolved the issue filtering the requests here on the qualys add on settings

aasabatini_0-1621237898066.png

 

delete and create the inputs again, restart the splunk server and should works.

hope can help

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...