000034747 - RSA Vulnerability Risk Manager 1.2 getQualysScans job repeatedly fails to process the same scan file: Unexpected EOF; was expecting a close tag for element <SCAN>

Document created by RSA Customer Support Employee on Jan 30, 2017Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000034747
Applies ToRSA Product Set: Security Management
RSA Product/Service Type: Vulnerability Risk Manager
RSA Version/Condition: 1.2
Platform: Linux
IssueVRM getQualysScans repeatedly fails to process the same scan file.
The following error is logged:
 
ERROR - QualysScanXMLTransformation.parseXML(112) | Error while transforming the file:C:\rsa\vrm\incoming\feeds\generic\getQualysScans\[removed]\scan_qualys.scan_[removed].xml to outputFile:C:\rsa\vrm\incoming\feeds\generic\getQualysScans\[removed]\scan_qualys.scan_[removed].generic.xml
com.ctc.wstx.exc.WstxEOFException: Unexpected EOF; was expecting a close tag for element <SCAN>
at [row,col {unknown-source}]: [removed,0]
at com.ctc.wstx.sr.StreamScanner.throwUnexpectedEOF(StreamScanner.java:686)
at com.ctc.wstx.sr.BasicStreamReader.nextFromTree(BasicStreamReader.java:2730)
at com.ctc.wstx.sr.BasicStreamReader.next(BasicStreamReader.java:1019)
at com.rsa.srm.core.conversion.xslt.QualysScanXMLTransformation.parseInternal(QualysScanXMLTransformation.java:145)
at com.rsa.srm.core.conversion.xslt.QualysScanXMLTransformation.parseXML(QualysScanXMLTransformation.java:110)
at com.rsa.srm.collector.batch.XMLTransformTasklet.executeInternal(XMLTransformTasklet.java:92)
at com.rsa.srm.collector.batch.XMLTransformTasklet.execute(XMLTransformTasklet.java:65)
at org.springframework.batch.core.step.tasklet.TaskletStep$ChunkTransactionCallback.doInTransaction(TaskletStep.java:406)
at org.springframework.batch.core.step.tasklet.TaskletStep$ChunkTransactionCallback.doInTransaction(TaskletStep.java:330)
at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:133)
at org.springframework.batch.core.step.tasklet.TaskletStep$2.doInChunkContext(TaskletStep.java:271)
at org.springframework.batch.core.scope.context.StepContextRepeatCallback.doInIteration(StepContextRepeatCallback.java:81)
at org.springframework.batch.repeat.support.RepeatTemplate.getNextResult(RepeatTemplate.java:374)
at org.springframework.batch.repeat.support.RepeatTemplate.executeInternal(RepeatTemplate.java:215)
at org.springframework.batch.repeat.support.RepeatTemplate.iterate(RepeatTemplate.java:144)
at org.springframework.batch.core.step.tasklet.TaskletStep.doExecute(TaskletStep.java:257)
at org.springframework.batch.core.step.AbstractStep.execute(AbstractStep.java:200)
at org.springframework.batch.core.job.SimpleStepHandler.handleStep(SimpleStepHandler.java:148)
at org.springframework.batch.core.job.flow.JobFlowExecutor.executeStep(JobFlowExecutor.java:64)
at org.springframework.batch.core.job.flow.support.state.StepState.handle(StepState.java:67)
at org.springframework.batch.core.job.flow.support.SimpleFlow.resume(SimpleFlow.java:169)
at org.springframework.batch.core.job.flow.support.SimpleFlow.start(SimpleFlow.java:144)
at org.springframework.batch.core.job.flow.FlowJob.doExecute(FlowJob.java:134)
at org.springframework.batch.core.job.AbstractJob.execute(AbstractJob.java:306)
at com.rsa.srm.collector.batch.PasswordAwareSimpleJobLauncher$1.run(PasswordAwareSimpleJobLauncher.java:99)
at org.springframework.core.task.SyncTaskExecutor.execute(SyncTaskExecutor.java:50)
at com.rsa.srm.collector.batch.PasswordAwareSimpleJobLauncher.run(PasswordAwareSimpleJobLauncher.java:93)
at com.rsa.srm.collector.batch.WorkflowJob.executeInternal(WorkflowJob.java:91)
at org.springframework.scheduling.quartz.QuartzJobBean.execute(QuartzJobBean.java:112)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
24 Dec 2016 01:36:16,560 | ERROR - XMLTransformTasklet.executeInternal(112) | Failed while tranforming the inputfile:C:\rsa\vrm\incoming\feeds\generic\getQualysScans\[removed]\scan_qualys.scan_[removed].xml
com.rsa.srm.core.conversion.xslt.XMLTransformationException: com.ctc.wstx.exc.WstxEOFException: Unexpected EOF; was expecting a close tag for element <SCAN>
at [row,col {unknown-source}]: [removed,0]
at com.rsa.srm.core.conversion.xslt.QualysScanXMLTransformation.parseXML(QualysScanXMLTransformation.java:113)
at com.rsa.srm.collector.batch.XMLTransformTasklet.executeInternal(XMLTransformTasklet.java:92)
at com.rsa.srm.collector.batch.XMLTransformTasklet.execute(XMLTransformTasklet.java:65)
at org.springframework.batch.core.step.tasklet.TaskletStep$ChunkTransactionCallback.doInTransaction(TaskletStep.java:406)
at org.springframework.batch.core.step.tasklet.TaskletStep$ChunkTransactionCallback.doInTransaction(TaskletStep.java:330)
at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:133)
at org.springframework.batch.core.step.tasklet.TaskletStep$2.doInChunkContext(TaskletStep.java:271)
at org.springframework.batch.core.scope.context.StepContextRepeatCallback.doInIteration(StepContextRepeatCallback.java:81)
at org.springframework.batch.repeat.support.RepeatTemplate.getNextResult(RepeatTemplate.java:374)
at org.springframework.batch.repeat.support.RepeatTemplate.executeInternal(RepeatTemplate.java:215)
at org.springframework.batch.repeat.support.RepeatTemplate.iterate(RepeatTemplate.java:144)
at org.springframework.batch.core.step.tasklet.TaskletStep.doExecute(TaskletStep.java:257)
at org.springframework.batch.core.step.AbstractStep.execute(AbstractStep.java:200)
at org.springframework.batch.core.job.SimpleStepHandler.handleStep(SimpleStepHandler.java:148)
at org.springframework.batch.core.job.flow.JobFlowExecutor.executeStep(JobFlowExecutor.java:64)
at org.springframework.batch.core.job.flow.support.state.StepState.handle(StepState.java:67)
at org.springframework.batch.core.job.flow.support.SimpleFlow.resume(SimpleFlow.java:169)
at org.springframework.batch.core.job.flow.support.SimpleFlow.start(SimpleFlow.java:144)
at org.springframework.batch.core.job.flow.FlowJob.doExecute(FlowJob.java:134)
at org.springframework.batch.core.job.AbstractJob.execute(AbstractJob.java:306)
at com.rsa.srm.collector.batch.PasswordAwareSimpleJobLauncher$1.run(PasswordAwareSimpleJobLauncher.java:99)
at org.springframework.core.task.SyncTaskExecutor.execute(SyncTaskExecutor.java:50)
at com.rsa.srm.collector.batch.PasswordAwareSimpleJobLauncher.run(PasswordAwareSimpleJobLauncher.java:93)
at com.rsa.srm.collector.batch.WorkflowJob.executeInternal(WorkflowJob.java:91)
at org.springframework.scheduling.quartz.QuartzJobBean.execute(QuartzJobBean.java:112)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
Caused by: com.ctc.wstx.exc.WstxEOFException: Unexpected EOF; was expecting a close tag for element <SCAN>
at [row,col {unknown-source}]: [removed,0]
at com.ctc.wstx.sr.StreamScanner.throwUnexpectedEOF(StreamScanner.java:686)
at com.ctc.wstx.sr.BasicStreamReader.nextFromTree(BasicStreamReader.java:2730)
at com.ctc.wstx.sr.BasicStreamReader.next(BasicStreamReader.java:1019)
at com.rsa.srm.core.conversion.xslt.QualysScanXMLTransformation.parseInternal(QualysScanXMLTransformation.java:145)
at com.rsa.srm.core.conversion.xslt.QualysScanXMLTransformation.parseXML(QualysScanXMLTransformation.java:110)
... 26 more
24 Dec 2016 01:36:16,560 | INFO - PasswordAwareSimpleJobLauncher$1.run(100) | Job: [FlowJob: [name=loadQualysDevicesAndIssuesBatchJob]] completed with the following status: [FAILED]

 
CauseThis is caused when the services are interrupted while a scan file is being retrieved, or only a partial scan is retrieved from the scanner.
The Unified Collector Framework service will attempt to process this file every time the job is scheduled and it will always fail because the file is incomplete.
ResolutionRemove the incomplete scan file using the steps below:
  1. Stop the Unified Collector Framework services.
  2. Note the name of the folder inside of the "getQualysScans" folder that is referenced in the log file.
  3. Manually delete the folder inside of the "getQualysScans" folder that is referenced in the log file.
  4. Manually delete the folder by the same name in C:\rsa\vrm\incoming\feeds\tmp
  5. Rerun the scan to provide a new scan file for the services to process.
To prevent the issue from happening again in the future:
  1. Carefully follow installation instructions to verify there are no running jobs before shutting down the services for upgrades.
  2. Ensure there are no network connectivity issues that may result in an incomplete scan being retrieved.

Attachments

    Outcomes