Hi All,I configured the qualys add-on to receive data from a qualys cloud platform.He worked fine but today we didn't receive any event from qualys and on the internal logs we found this message.
TA-QualysCloudPlatform (ioc_events): 2021-04-08 14:04:08 PID=12050 [MainThread] ERROR: Unsuccessful while calling API [500 : Internal Server Error]. Retrying after 300 seconds:
someone can help me?
Do you have more info in log? I had a similar message and I had to modify a time parameter in the POST that performs the script.
I understood if the qualys server receive a lot of requests it can block and start to send 500 server error.
I resolved the issue filtering the requests here on the qualys add on settings
delete and create the inputs again, restart the splunk server and should works.
hope can help