Qualys Webスキャナの実行中にAIQUMサーバが応答しなくなります
環境
- ActiveIQ Unified Manager（AIQUM）9.6以降のすべてのプラットフォーム
- 外部Webスキャナ
問題
- QualysがAIQUMサーバをスキャンする特定の時間に、AIQUMが高いCPU使用率で応答しなくなります。
注:これはQualysに限定されません。AIQUMを外部でスキャンすると、この問題を原因できます。この問題の原因となるその他の既知の製品は次のとおりです。- クラウドストライク
- 管理ソフト
- タニウム
- Active IQ Unified Managerスケジュールレポートに現在のデータが表示されない
- 推奨事項に従ってリソースが追加されまし たが、役に立たなかった
audit.logまたはaccess_log.log
[qualysIP] [aiqumIP] [-] [-] [05/Dec/2023:18:01:54 -0700] [GET / HTTP/1.1] [302] [-] [QualysGuard] [-] [-] [0] [1]
[qualysIP] [aiqumIP] [-] [-] [05/Dec/2023:18:03:26 -0700] [GET http://Qualys.null/ HTTP/1.0] [302] [-] [-] [-] [-] [0] [1]
[qualysIP] [aiqumIP] [-] [-] [05/Dec/2023:18:03:28 -0700] [GET /api/?type=keygen&user=qualys2017_7a11b80a&password=qualys_335e HTTP/1.1] [401] [-] [-] [*/*] [text/html;charset=utf-8] [188] [2]
server.log：
ERROR [io.undertow.request] (default task-2165) UT005023: Exception handling request to /: org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the HTTP method "QUALYS" was not included within the list of allowed HTTP methods [HEAD, DELETE, POST, GET, OPTIONS, PATCH, PUT]2023-08-10 22:50:44,708 ERROR [io.undertow.request] (default task-3108) UT005023: Exception handling request to /: org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the HTTP method "BADMTHD" was not included within the list of allowed HTTP methods [HEAD, DELETE, POST, GET, OPTIONS, PATCH, PUT]2023-09-05 00:20:39,465 ERROR [io.undertow.request] (default task-171) UT005023: Exception handling request to /: org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the HTTP method "PROPFIND" was not included within the list of allowed HTTP methods [HEAD, DELETE, POST, GET, OPTIONS, PATCH, PUT]2023-10-05 08:13:26,683 ERROR [io.undertow.request] (default task-4431) UT005023: Exception handling request to /: org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the HTTP method "TRACK" was not included within the list of allowed HTTP methods [HEAD, DELETE, POST, GET, OPTIONS, PATCH, PUT] at deployment.dfm-app.war//org.springframework.security.web.firewall.StrictHttpFirewall.rejectForbiddenHttpMethod(StrictHttpFirewall.java:527) [spring-security-web-5.8.1.jar:5.8.1] at deployment.dfm-app.war//org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:504) [spring-security-web-5.8.1.jar:5.8.1]ログの場所については、KBを参照してください 。Active IQ Unified Managerの注目すべきログファイルとそれぞれの場所は何ですか。