Re: [Openvas-discuss] Receiving reports even though task not finished for some hosts
Dear Allyn, thanks a lot for your detailed report. Until today, we was not able to recreate the unfinished hosts on our side, but we appreciate that you took the time and reported your solution to us, this will help future users who report the same problem, as we now have a aprooved fixing guide for the occurance of this. Further more, we will investigate deeper on the cause of this and will take care to avoid such scan behaviour in future. Thank you very much for your Report! Kind Regards, Michael (Eissele). On 07.10.2016 20:08, Allyn Baskerville wrote: Last try. Here is a link to the image… http://i1067.photobucket.com/albums/u422/baskervi/image1_zpshtvhid4p.png [1] FROM: Allyn Baskerville SENT: Friday, October 07, 2016 11:32 AM TO: 'michael.eiss...@greenbone.net' CC: 'openvas-discuss@wald.intevation.org' SUBJECT: RE: [Openvas-discuss] Receiving reports even though task not finished for some hosts I guess the moderator was never going to approve the previous message I sent out as the images were too large. I've only attached one this go around, but the other one showed the same hosts that were scanned by had different hosts that showed were not finished. I am now scanning four different public networks - two here in Oklahoma, one in Texas, and one in northern California. The ISPs are different, but three of the four have hosts that say are not finished scanning when the report is sent. The one below I've included images for has ICMP blocked, so I have modified that scan using "Full and fast" and chose the always alive option. The other ones are using unmodified scan templates. One scan job only has 3 hosts, and it completes OK. The other three (11 hosts on one, 18 hosts on the another, and 20 on the last) scans have hosts that show up as not finished, and the specific hosts and number of hosts that show are still being scanned will change between scans. Most of the hosts are Windows, but a Linux host here and there will show up as not being completed. All are using the OpenVAS Default scanner They are behind different vendor firewalls. All jobs are tied to schedules. I'll try cloning the task and removing the email alert tonight. Yes, I can reproduce this consistently. Since this isn't being widely reported, I've thought about rebuilding the system. Although I didn't encounter anything odd during the installation, I did have a problem after a few days getting tasks to run (see posts on 9/14/2016). I was able to perform the following on 9/16, and I thought it was working fine. However, it wasn't until after this point that I had more than a very few IP addresses to scan. I wonder f this might be problematic. I found the solution, or I should say I'm able to run the tasks now. The answer lies in the following: http://openvas-discuss.wald.intevation.narkive.com/40QcF1xA/openvasmd-regular-tasks-db-corruption-issue [2] I ran the sqlite command "sqlite3 tasks.db "PRAGMA integrity_check;" And it came back OK. I then stopped redis, commented out the lines that started with "save" in /etc/redis.conf, deleted dump.rdb, then restarted redis and the scanner, and it works. Thanks for your assistance. -Original Message- From: michael.eiss...@greenbone.net [mailto:michael.eiss...@greenbone.net] Sent: Tuesday, October 04, 2016 3:37 AM To: Allyn Baskerville Cc: openvas-discuss@wald.intevation.org Subject: Re: [Openvas-discuss] Receiving reports even though task not finished for some hosts Dear Allyn, thank you for your report about unfinished hosts and sorry for the delay. We are currently investigating the Problem that you have reported, but until now we had no success when trying to reproduce. - Do you have any further details- for example specific situations in which this occurance takes place? - Maybe the issue is limited to specific networks, IP's, OS.. ? - How is your scan setup- is it a normal scan with standard scanconfig? Do you have schedules connected to your tasks? - Does it also occur if you'd clone the task and remove the email alert? - (Anything that differs from a regular standard scan setup could be a key information). - Can you reproduce the behavior constantly? Thanks a lot, we appreciate any information given here. Kind Regards, Michael Eissele. On 23.09.2016 02:44, Allyn Baskerville wrote: I'm using OV-8 on CentOS 7, and since the begging of setting up the server, I consistently receive reports via email, even though not all hosts have completed. The alert is set to generate alert for "Event: Task run status changed (to Done)," and the task shows "done," but 3 of the 18 hosts still show "(not finished)" under the End column. The number of hosts not finished are not the same each time - sometimes I may have 5 hosts, sometimes a coupl
Re: [Openvas-discuss] Receiving reports even though task not finished for some hosts
Last try. Here is a link to the image. http://i1067.photobucket.com/albums/u422/baskervi/image1_zpshtvhid4p.png From: Allyn Baskerville Sent: Friday, October 07, 2016 11:32 AM To: 'michael.eiss...@greenbone.net' Cc: 'openvas-discuss@wald.intevation.org' Subject: RE: [Openvas-discuss] Receiving reports even though task not finished for some hosts I guess the moderator was never going to approve the previous message I sent out as the images were too large. I've only attached one this go around, but the other one showed the same hosts that were scanned by had different hosts that showed were not finished. I am now scanning four different public networks - two here in Oklahoma, one in Texas, and one in northern California. The ISPs are different, but three of the four have hosts that say are not finished scanning when the report is sent. The one below I've included images for has ICMP blocked, so I have modified that scan using "Full and fast" and chose the always alive option. The other ones are using unmodified scan templates. One scan job only has 3 hosts, and it completes OK. The other three (11 hosts on one, 18 hosts on the another, and 20 on the last) scans have hosts that show up as not finished, and the specific hosts and number of hosts that show are still being scanned will change between scans. Most of the hosts are Windows, but a Linux host here and there will show up as not being completed. All are using the OpenVAS Default scanner They are behind different vendor firewalls. All jobs are tied to schedules. I'll try cloning the task and removing the email alert tonight. Yes, I can reproduce this consistently. Since this isn't being widely reported, I've thought about rebuilding the system. Although I didn't encounter anything odd during the installation, I did have a problem after a few days getting tasks to run (see posts on 9/14/2016). I was able to perform the following on 9/16, and I thought it was working fine. However, it wasn't until after this point that I had more than a very few IP addresses to scan. I wonder f this might be problematic. I found the solution, or I should say I'm able to run the tasks now. The answer lies in the following: http://openvas-discuss.wald.intevation.narkive.com/40QcF1xA/openvasmd-regula r-tasks-db-corruption-issue I ran the sqlite command "sqlite3 tasks.db "PRAGMA integrity_check;" And it came back OK. I then stopped redis, commented out the lines that started with "save" in /etc/redis.conf, deleted dump.rdb, then restarted redis and the scanner, and it works. Thanks for your assistance. -Original Message- From: michael.eiss...@greenbone.net [mailto:michael.eiss...@greenbone.net] Sent: Tuesday, October 04, 2016 3:37 AM To: Allyn Baskerville Cc: openvas-discuss@wald.intevation.org Subject: Re: [Openvas-discuss] Receiving reports even though task not finished for some hosts Dear Allyn, thank you for your report about unfinished hosts and sorry for the delay. We are currently investigating the Problem that you have reported, but until now we had no success when trying to reproduce. - Do you have any further details- for example specific situations in which this occurance takes place? - Maybe the issue is limited to specific networks, IP's, OS.. ? - How is your scan setup- is it a normal scan with standard scanconfig? Do you have schedules connected to your tasks? - Does it also occur if you'd clone the task and remove the email alert? - (Anything that differs from a regular standard scan setup could be a key information). - Can you reproduce the behavior constantly? Thanks a lot, we appreciate any information given here. Kind Regards, Michael Eissele. On 23.09.2016 02:44, Allyn Baskerville wrote: > I'm using OV-8 on CentOS 7, and since the begging of setting up the > server, I consistently receive reports via email, even though not all > hosts have completed. The alert is set to generate alert for "Event: > Task run status changed (to Done)," and the task shows "done," but 3 > of the 18 hosts still show "(not finished)" under the End column. The > number of hosts not finished are not the same each time - sometimes I > may have 5 hosts, sometimes a couple, but there are always hosts that > show not finished. Is there a fix for this? Everything else appears to > be working OK. > > Thanks > ___ > Openvas-discuss mailing list > <mailto:Openvas-discuss@wald.intevation.org> Openvas-discuss@wald.intevation.org > <https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-dis> https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-dis > cuss smime.p7s Descri
Re: [Openvas-discuss] Receiving reports even though task not finished for some hosts
Dear Allyn, thank you for your report about unfinished hosts and sorry for the delay. We are currently investigating the Problem that you have reported, but until now we had no success when trying to reproduce. - Do you have any further details- for example specific situations in which this occurance takes place? - Maybe the issue is limited to specific networks, IP's, OS.. ? - How is your scan setup- is it a normal scan with standard scanconfig? Do you have schedules connected to your tasks? - Does it also occur if you'd clone the task and remove the email alert? - (Anything that differs from a regular standard scan setup could be a key information). - Can you reproduce the behavior constantly? Thanks a lot, we appreciate any information given here. Kind Regards, Michael Eissele. On 23.09.2016 02:44, Allyn Baskerville wrote: I'm using OV-8 on CentOS 7, and since the begging of setting up the server, I consistently receive reports via email, even though not all hosts have completed. The alert is set to generate alert for "Event: Task run status changed (to Done)," and the task shows "done," but 3 of the 18 hosts still show "(not finished)" under the End column. The number of hosts not finished are not the same each time - sometimes I may have 5 hosts, sometimes a couple, but there are always hosts that show not finished. Is there a fix for this? Everything else appears to be working OK. Thanks ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
[Openvas-discuss] Receiving reports even though task not finished for some hosts
I'm using OV-8 on CentOS 7, and since the begging of setting up the server, I consistently receive reports via email, even though not all hosts have completed. The alert is set to generate alert for "Event: Task run status changed (to Done)," and the task shows "done," but 3 of the 18 hosts still show "(not finished)" under the End column. The number of hosts not finished are not the same each time - sometimes I may have 5 hosts, sometimes a couple, but there are always hosts that show not finished. Is there a fix for this? Everything else appears to be working OK. Thanks smime.p7s Description: S/MIME cryptographic signature ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
