|
we are observing frequent errors on Clair logs and also Clair is not detecting any vulns its always showing 0 for all images.
|
Replies: 12 comments 6 replies
|
It looks like none of the updaters were able to run, as signified by and Sounds like some sort of proxy to me. The standard |
|
Thanks, @hdonnay where can we find the list of all updater URLs? |
|
From the code we found this super set |
|
@hdonnay @thomasmckay After adding the above URLs to proxy config,looks like it worked . {"level":"error","component":"libvuln/New","component":"libvuln/Libvuln/loopUpdaters","error":"updating errors:\n\tRHEL8-openstack-16.0: ovalutil: fetcher got unexpected HTTP response: 403 (403 Forbidden)\n\tRHEL6-satellite-tools-6.3: o |
|
HI, Im getting same issue with 4.0.2 image, but proxy is set and working... Have the issue with RH moved anywhere ? No vulnerabilities are detected, but I guess it is because of no CVEs are imported from those dbs. I tried it also from different IP in case of some blacklisting as mentioned somewhere here, but with no luck.
|
|
The 403 returns are out of our hands, as are the alpine errors. A rate limiter would be helpful, but it's annoying because of wrong error code. |
|
That's an issue with the server hosting the file, not Clair. We're trying to hunt it down, but it's an intermittent issue with another Red Hat team's server. |
|
Thank you very much for your response. |
|
I'll take a look if you provide any details to reproduce with. To start, what's the image? |
|
Thanks for asking @ldelossa |
|
Yes I think it is, my Debian based image was only showing 23 unknown CVEs which on Quay.io was reporting 200+ of different kinds. I waiting a few days for this to change but no change. Not sure what I need to do to get the updater to run. |
|
Are you seeing a similar log message, or just unexpected results? If the latter, that's a separate issue. |
|
Is there a way to extract all URLs from the DB or clair itself in order to test which one is causing problems?
I also see the following one, but again I would need the URL to test if it's related:
|
|
There should be logs before this point that have the URL used, but I would be doubtful that this is a proxy issue as the upstream server returns The alpine issue is due to the upstream data being malformed. |
|
Thanks for the alpine pointer! If you assume a rate limiting - would it be a possibility to direct Clair to a local RH Satellite nearby? (assuming the oval content is part of the mirrored data) |
|
I think that would work, as the updater consumes a pulp manifest to discover all the individual oval manifests. A stanza like the following should work, unless we messed up wiring the configurable bits around. |
It looks like none of the updaters were able to run, as signified by
and
Sounds like some sort of proxy to me. The standard
http_proxyenvironment variable should be supported, but it's possible an unconfigured client is in use somewhere.