The sensor log file is located at (by default):
Qualys provides a script to collect diagnostic information about the sensor. You must run the script on the host on which you want to collect the diagnostic information from.
The diagnostic script is present in the QualysContainerSensor.tar.xz that you downloaded for installing the sensor.
The script is called Sensor_Diagnostic_Script.py. You must have Python installed on the host in order to run the script.
The script collects the following information from the host and puts it in a tar file called SensorDiagnostic.tar. You can send that file to Qualys Support for further assistance.
The SensorDiagnostic.tar includes 'ScanInfo.json', 'qpa.log' of qualys-container-sensor from given persistent storage, docker logs of qualys-container-sensor, and all information described below in the 'SensorDiagnostic.log’ file. If ‘ScanInfo.json’ and Sensor logs are not available on the Docker host then this script creates empty ‘ScanInfo.json’ and qpa.log files, and appends “File not found” to them.
- Operating System Information (Type of OS i.e. Linux or Mac and other details)
- Proxy Configuration (Type of proxy set e.g. system, docker, cloud-agent proxy)
- CPU Architecture (Details about model, CPUs, cores, etc)
- RAM Usage (Memory allocation and utilization on host)
- Docker Version (Docker version installed on host)
- Socket Configuration (Docker socket configuration on host e.g. TCP/unix domain)
- Number of docker images (Count of all docker images and their details)
- Number of docker containers (Count of all docker containers and their details)
- CPU and Memory usage of running containers (First result of all resource usage statistics)
Use installsensor.sh to reinstall Qualys container sensor keeping the "Storage" value as it was for earlier Sensor. This will ensure that the new sensor will not be marked as another Sensor and will simply upgrade the existing one.
For help on install command, see Installing Sensors.
Note: At any given point in time, DO NOT delete the persistent storage. Else, the sensor deployed thereafter will be marked as a new sensor.
The Sensor is designed to handle restart scenarios and will continue functioning normally after restart. No customer intervention is needed until the sensor crashes.
Note: The Qualys container sensor will fail to restart if it has exited due to a fatal error before the docker host/service restarts.
While searching for containers you may see duplicates of containers orchestrated by Kubernetes. This is because Kubernetes spins up a monitoring container for every service container it brings up. Qualys container sensor sees them as two different containers and reports and scans both of the containers.
To see results without duplicate containers add the following string to queries used for searching Kubernetes containers.
For example, use this query to find running containers in Kubernetes:
state:"RUNNING" and not label.key:POD