Scan failed to start on engine [ID: X]: java.lang.RuntimeException: org.xml.sax.SAXException java.lang.NullPointerException

InsightVM
1

When I run a scheduled or manual scan from a distributed scan engine I am getting the following error:
2023-05-22T09:00:15 [ERROR] [Thread: sched-new-1544803905-76-1] Unexpected error communicating with engine.
java.lang.RuntimeException: org.xml.sax.SAXException
java.lang.NullPointerException
at com.rapid7.nexpose.nsc.NSEConnection.checkResponseCode(Unknown Source) ~[nsc.jar:na]
at com.rapid7.nexpose.nsc.NSEConnection.scanStartCustom(Unknown Source) ~[nsc.jar:na]
at com.rapid7.nexpose.nsc.NSEScanManager.lambda$startSubScan$15(Unknown Source) [nsc.jar:na]
at com.rapid7.nexpose.nsc.NSEConnectionPool.execute(Unknown Source) [nsc.jar:na]
at com.rapid7.nexpose.nsc.NSEScanManager.startSubScan(Unknown Source) [nsc.jar:na]
at com.rapid7.nexpose.nsc.scan.multiengine.op.ScanStartService.run(Unknown Source) [nsc.jar:na]
at com.rapid7.nexpose.nsc.scan.multiengine.ExecutiveScanManager.launchScanOnMultiEngines(Unknown Source) [nsc.jar:na]
at com.rapid7.nexpose.nsc.scan.multiengine.ExecutiveScanManager$1.call(Unknown Source) [nsc.jar:na]
at com.rapid7.nexpose.nsc.scan.multiengine.ExecutiveScanManager$1.call(Unknown Source) [nsc.jar:na]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) [na:1.8.0_332]
at com.rapid7.nexpose.scan.NexposeScanContextFutureTask.run(Unknown Source) [nxshared.jar:na]
at com.rapid7.nexpose.scan.NexposeScanContextFutureTask.runSynchronously(Unknown Source) [nxshared.jar:na]
at com.rapid7.nexpose.nsc.scan.ScanService.startScheduledScan(Unknown Source) [nsc.jar:na]
at com.rapid7.nexpose.nsc.scan.ScanService$$FastClassBySpringCGLIB$$e3806b39.invoke() [nsc.jar:na]
at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204) [spring-core-4.2.4.RELEASE.jar:4.2.4.RELEASE]
at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:720) [spring-aop-4.2.4.RELEASE.jar:4.2.4.RELEASE]
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) [spring-aop-4.2.4.RELEASE.jar:4.2.4.RELEASE]
at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92) [spring-aop-4.2.4.RELEASE.jar:4.2.4.RELEASE]
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) [spring-aop-4.2.4.RELEASE.jar:4.2.4.RELEASE]
at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:655) [spring-aop-4.2.4.RELEASE.jar:4.2.4.RELEASE]
at com.rapid7.nexpose.nsc.scan.ScanService$$EnhancerBySpringCGLIB$$458ff398.startScheduledScan() [nsc.jar:na]
at com.rapid7.nexpose.nsc.scheduler.NewScanDispatchable.lambda$dispatch$0(Unknown Source) [nsc.jar:na]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) [na:1.8.0_332]
at com.rapid7.multitenant.task.ThreadLocalTask.run(ThreadLocalTask.java:146) ~[multitenancy-0.0.4.jar:na]
at com.rapid7.multitenant.task.ThreadLocalTask.runSynchronously(ThreadLocalTask.java:99) ~[multitenancy-0.0.4.jar:na]
at com.rapid7.nexpose.nsc.scheduler.NewScanDispatchable.dispatch(Unknown Source) [nsc.jar:na]
at com.rapid7.nexpose.nsc.scheduler.ScheduleDispatchable.run(Unknown Source) ~[nsc.jar:na]
at com.rapid7.nexpose.scheduler.QueueDispatcher.run(Unknown Source) ~[nxshared.jar:na]
at java.lang.Thread.run(Thread.java:750) ~[na:1.8.0_332]
2023-05-22T09:00:15 [INFO] [Thread: sched-new-1544803905-76-1] [Silo ID: default] [Scan ID: 13677] Scan failed: Scan failed to start on engine [ID: 12]: java.lang.RuntimeException: org.xml.sax.SAXException
java.lang.NullPointerException
2023-05-22T09:00:15 [INFO] [Thread: sched-new-1544803905-76-1] [Silo ID: default] [Scan ID: 13677] Scan discovered 0 live devices, 0 vulnerabilities.

This scan was running with success until some days ago. Can someone give me a hint on this?

2

So the log indicates an issue communicating with the engine so there could be a couple things to check. First you can check your engine management to ensure that the engine is showing as online and operational. If it’s not then most likely the service has been stopped on the engine or some new firewall rule or something has been introduced that blocks the traffic.

If the engine is actually showing as connected and working then you still may need to go to that engine and do some port testing. If you’ve introduced some new endpoint protection or something into your environment it’s possible that some of the scan engine files were quarantined.