Asset Groups not Syncing with Cloud

Good evening. I have a few asset groups I created some time last week that don’t seem to be syncing with the cloud as I am unable to use them for queries. On the local console I can see that the asset group exists and that assets are assigned to it but when I try and use the asset.group function in a query and start typing in the name of this asset group it does not populate in the list of selectable asset groups. I also tried just copying and pasting the name of the asset group into a query and that doesn’t work either. This seems to only be happening with asset groups created recently. Has anyone else run into this issue? We have our console set to sync every hour and I tried manually having it sync via the console commands but I’m still not able to build a query off these asset groups.

Any help would be appreciated. Thanks

Hi Gabe,

I would suggest that you open a case with our support team, I’ve definitely seen this happen before but it would be too hard to narrow down over an exchange within this discussion. There’s likely something interfering with the ability of the asset docs getting uploaded back to the platform (those docs are generated by the console and sent to the platform, which is how the two stay in sync) and this could be causing the discrepancy you’re seeing between the systems. Sometimes it’s something you wouldn’t expect like ingesting millions of tags accidentally from an AWS/Azure discovery sync which causes a backlog of information on the console to be synced but it’s never able to ‘catch up’ due to the sheer volume. Support should definitely be able to help you out here! :slight_smile:

Cheers,
Gina

Gina,

Thanks for your reply. I have opened a case with support because we are also seeing the last scan time and vulnerability data not sync between the local console and the cloud for all assets. For instance I have one sever that when I view its last scan on the local console it shows the last scan as 5/6 and in the dashboards in the cloud it shows the last scan as 4/29. Some assets seem to be syncing up between the console and the cloud but not all. We will see what I get back from support.

On that note does anyone know a way to determine from the console if the cloud sync is completing or to view the status of the cloud sync?

So we did get some replies on the support case for this issue. The support rep mentioned that since we have a large number of jar_cache files in the Rapid7>Nexpose>Shared>Temp directory we may be having a problem with the cloud sync.

Is it correct that InsightVM only syncs with Exposure Analytics once every 24 hours? Is there a way to increase the frequency of that sync or to check on the status of the last sync? It seems that if it only syncs once every 24 hours our dashboards in Exposure analytics would not be showing valid data to our users.

Good Afternoon Gabe,

I’m sorry to hear that you’re having a trouble syncing with our cloud/platform! I’ll see if I can take a look at that case for a second set of eyes :slight_smile:.

In regards to your question on console and cloud/platform (Exposure Analytics) syncing interval, that is something that you or any console global administrator can control for agents and the documentation listed here talks through how this works and how to make this change should you choose to do so.

Looking at your case it seems you were particularly interested in the daily job of EA_SyncCloud_Job, as this runs every 24 hours. This is not germane to the normal sync functionality of the product; this is there as an exhaustive task when the embedded collector is in a healthy state as a way of checking for any inconsistency issues by comparing console asset docs to the existing platform docs.

Customers cannot modify the sync interval of the console and the platform for any other data other than the agents. Normally, you can expect it to be just a few minutes (depending on your bandwidth constraints and assessment activity) for items to sync between your console and your platform.

I hope this helps, please let me know if you have any other questions I might be able to help with!

/edit: I’ve made some edits for clarity after reviewing your case.

Cheers,
Gina