On linux environment is not necessary to install a specific agent to send log to SGBox. The syslog protocol will be used.
If not already present, install rsyslog packet.

apt-get -y install rsyslog

Create file “20-SGBox.conf” file

vi /etc/rsyslog.d/20-SGBox.conf

Add the following row in order to send only authentication logs. Is possible use the IP or the hostname of SGBox

auth,authpriv.* @SGBox-IP

Alternatively, you can add the following row if you want send all logs to SGBox. It will be useful for a in-depth research.

*.* @SGBox-IP

Restart rsyslog deamon to load the new configuration and start to send logs

service rsyslog restart

Troubleshooting on NVS

In this guide, we show you how to perform debugging: to resolve certain issues that may arise on the NVS module and scan it manages.

Troubleshooting “Hosts Not Alive”

Problem
During the host discovery phase, the service checks if the host to be scanned is up and running in order to avoid wasting time on scanning a dead or unreachable host. The “No Host Alive” message displayed on the screen means the scanner did not find the target to be alive during the Discovery phase of the scan. If the host is not “alive” then the scan will not proceed beyond this point and no assessment will be performed.

Error
Hosts are shown under the “Hosts Not Alive” section of scan results

Cause
To determine if the host is “alive”, the service pings each target host using ICMP, TCP, and UDP probes. The TCP and UDP probes are sent to default ports for common services on each host, such as DNS, TELNET, SMTP, HTTP and SNMP. If any of these probes doesn’t trigger any response from the host, the host is considered as not alive.
The types of probes sent, and the list of ports scanned during host discovery are configurable in the option profile (see Host Discovery on the Additional tab in the profile).

Ports used for host discovery:

• TCP SYN packets are sent to these well-known TCP ports: 21, 22, 23, 25, 53, 80, 88, 110, 111, 135, 139, 443, 445.
• TCP ACK packet with a source port of 80 and a destination port of 2869
• TCP ACK packet with a source port of 25 and a destination port of 12531
• TCP SYN-ACK packet with a source port of 80 and a destination port of 41641
• UDP packets are sent to the following well-known UDP ports: 53, 111, 135, 137, 161, 500
• ICMP ‘Echo Request’ packets

Solution

• Ensure that the Qualys scanner is able to reach the concerned target on required ports.
  • For external scans, go to Help > About, to see the IP addresses for external scanners to allow.
  • Users can run the following command on the endpoint during scan to determine what ports are open on the host at that time: netstat -anp
• Enable ICMP to the system, this will allow the system to be discovered alive.
• If there are any other ports open on the target, other than those mentioned above, you may add these ports in TCP Ports/UDP ports in Additional tab of the Option Profile.
• You can choose to scan “dead” hosts through your scan options in the option profile (see Scan Dead Hosts on the Scan tab in the option profile), but this may increase scan time and is not suggested for Class C or larger networks.

Troubleshooting on Collector 6

In this guide, we show you how to perform debugging: to quickly check if the collector has all the main processes active for correct communication with the Host or SGBox appliance.

Docker and containers

Collector 6 introduces the use of docker and containers, to activate them correctly, it is necessary do port forwarding on the firewall. For more details, see: SGBox and Collector network requirements

after opening the Internet connection to our public registry address. You can debug using the CLI tool: to verify that the collector has correctly activated all key containers.

Connect to the Collector appliance via SSH (using Putty,Terminal or console), specifying the user CLI and the password you saved for it.
Go under System > Process Handling > Services status > SGBox Containers
Check if there are 4 active containers. See the image below for an example showing active containers.

Containers are Active: this means that your Collector is ready to be used.
Containers are not Active: this means that something went wrong during network configuration or port opening. We suggest following the Network debugging guide.

Network debugging

You can perform network debugging using the CLI tool.
Connect to the Collector appliance via SSH (using Putty,Terminal or console), specifying the user CLI and the password you saved for it.
Go under Network Configuration > Connect to port
 

For example, let’s check if Collector reaches our registry. You can specify IPv4 or FQDN and Port.

The result may be Server is Responding or Cannot connect to the server.

If the result is Cannot connect to the server, we recommend checking that the firewall managing the network is not blocking communication. For more details, see: SGBox and Collector network requirements or provide the results obtained from debugging to SGBox Support for further assistance.

Dump network traffic

You can use the CLI tool to check if there are any problems with receiving data from the Hosts.
Connect to the Collector appliance via SSH (using Putty,Terminal or console), specifying the user CLI and the password you saved for it.
Go under Stats > Dump network traffic

1. Filter by IP: simple filter on data source IP all ports and protocols
2. Filter SGBox ports: simple filter on ports 514 and 443 from all the data source
3. Expert: you can enter all the tcpdump parameters.

For example, let’s use the Filter by IP option to check if the collector receives the log from the Host.

If the host sends logs to the collector, then you should see traffic passing through, as in the example above.
If you do not see any traffic passing through, double-check that you have correctly configured the source to send logs, or check that there are no firewall blocks between the source and the collector.