Hi, new customer here. I’m having a hard time getting the scan engine on Ubunutu to complete a scan. The scan result says it shuts down despite the stats within Ubuntu stating it is still up and not shut down occurred. There are connectivity issues as well (we use Engine to Console). It’s my first foray into Linux administration, but I’m not seeing any issues with the OS that I can tell.
What’s the communities recommended setup? Linux? Windows? Are there known issues with newer version of Ubuntu?
We switched all of our windows scan engines to Redhat to improve performance and get away from weak windows baseline configs etc. Ubuntu would have been my preference as it seemed to work well when we tested it but we got blocked from using the Ubuntu even though we would be patching and maintaining it… On the odd occasion we did have to rebuild a Linux sever from scratch to ensure everything worked properly after installing the IVM components. Sometimes it just would not play ball. I will add that if you are pushing a lot of scans via a scan engine set the below to queue jobs / scans which combats resource exhaustion and would give better performance. Very useful in large environments.
Locate the CustomEnvironment.properties file within the Scan Engine installation directory. If it does not exist create it.
Default locations for this directory are as follows:
Thanks! This lines up nicely with the issues correlating to when I utilize “Scan Now”.
You’re saying that setting this would limit concurrent scans to 2 and would queue the remaining sites if I were to have say, 3 sites set to scan at one time?
You’re welcome, yes correct. Setting this on each scan engine enables queuing of jobs sent to that scan engine. Please note 2 concurrent scans was my starting point, if you have well resourced scan engines it would most likely do much more. Here is the R7 doc which gives more detail Set maximum concurrent scans per engine | Vulnerability Management Documentation
FYI It also helps ease of scheduling. You can set the many jobs to start at the same time if required and they just queue and run sequentially.