-
|
we are observing frequent errors on Clair logs and also Clair is not detecting any vulns its always showing 0 for all images.
|
Beta Was this translation helpful? Give feedback.
Replies: 12 comments 6 replies
-
|
It looks like none of the updaters were able to run, as signified by and Sounds like some sort of proxy to me. The standard |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, @hdonnay where can we find the list of all updater URLs? |
Beta Was this translation helpful? Give feedback.
-
|
From the code we found this super set |
Beta Was this translation helpful? Give feedback.
-
|
@hdonnay @thomasmckay After adding the above URLs to proxy config,looks like it worked . {"level":"error","component":"libvuln/New","component":"libvuln/Libvuln/loopUpdaters","error":"updating errors:\n\tRHEL8-openstack-16.0: ovalutil: fetcher got unexpected HTTP response: 403 (403 Forbidden)\n\tRHEL6-satellite-tools-6.3: o |
Beta Was this translation helpful? Give feedback.
-
|
HI, Im getting same issue with 4.0.2 image, but proxy is set and working... Have the issue with RH moved anywhere ? No vulnerabilities are detected, but I guess it is because of no CVEs are imported from those dbs. I tried it also from different IP in case of some blacklisting as mentioned somewhere here, but with no luck.
|
Beta Was this translation helpful? Give feedback.
-
|
The 403 returns are out of our hands, as are the alpine errors. A rate limiter would be helpful, but it's annoying because of wrong error code. |
Beta Was this translation helpful? Give feedback.
-
|
That's an issue with the server hosting the file, not Clair. We're trying to hunt it down, but it's an intermittent issue with another Red Hat team's server. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you very much for your response. |
Beta Was this translation helpful? Give feedback.
-
|
I'll take a look if you provide any details to reproduce with. To start, what's the image? |
Beta Was this translation helpful? Give feedback.
-
|
@hbandi is this still an issue? |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for asking @ldelossa |
Beta Was this translation helpful? Give feedback.
-
|
Yes I think it is, my Debian based image was only showing 23 unknown CVEs which on Quay.io was reporting 200+ of different kinds. I waiting a few days for this to change but no change. Not sure what I need to do to get the updater to run. |
Beta Was this translation helpful? Give feedback.
-
|
Are you seeing a similar log message, or just unexpected results? If the latter, that's a separate issue. |
Beta Was this translation helpful? Give feedback.
-
|
Is there a way to extract all URLs from the DB or clair itself in order to test which one is causing problems?
I also see the following one, but again I would need the URL to test if it's related:
|
Beta Was this translation helpful? Give feedback.
-
|
There should be logs before this point that have the URL used, but I would be doubtful that this is a proxy issue as the upstream server returns The alpine issue is due to the upstream data being malformed. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the alpine pointer! If you assume a rate limiting - would it be a possibility to direct Clair to a local RH Satellite nearby? (assuming the oval content is part of the mirrored data) |
Beta Was this translation helpful? Give feedback.
-
|
I think that would work, as the updater consumes a pulp manifest to discover all the individual oval manifests. A stanza like the following should work, unless we messed up wiring the configurable bits around. |
Beta Was this translation helpful? Give feedback.
It looks like none of the updaters were able to run, as signified by
and
Sounds like some sort of proxy to me. The standard
http_proxyenvironment variable should be supported, but it's possible an unconfigured client is in use somewhere.