qualys add-on 500 error

[aasabatini]

Hi All,

I configured the qualys add-on to receive data from a qualys cloud platform.
He worked  fine but today we didn't receive any event from qualys and on the internal logs we found this message.

TA-QualysCloudPlatform (ioc_events): 2021-04-08 14:04:08 PID=12050 [MainThread] ERROR: Unsuccessful while calling API [500 : Internal Server Error]. Retrying after 300 seconds: 

someone can help me?

[cmorenobuitrago]

Hi @aasabatini,

Do you have more info in log? I had a similar message and I had to modify a time parameter in the POST that performs the script.

Kind regards

[aasabatini]

Hi @cmorenobuitrago 

I understood if the qualys server receive a lot of requests it can block and start to send 500 server error.

I resolved the issue filtering the requests here on the qualys add on settings

delete and create the inputs again, restart the splunk server and should works.

hope can help