Troubleshooting the BigFix and QRadar Vulnerability Manager integration

Troubleshoot issues that might occur when you configure your BigFix and QRadar® Vulnerability Manager integration.

Troubleshooting contents


BigFix certificate is not imported because of a failed connection to the HCL BigFix server

If the certificate is not imported to QRadar because of a failed connection to the BigFix server, you might see the following error message: 
ERROR [TrustStoreConfig] Failed to configure trust store with peer certificates : 
Connection timed out java.net.ConnectException: Connection timed out.

The configuration is successful, but the certificates are not present in the truststore.

You must manually load the certificates by doing the following steps when you have access to the BigFix server.
  1. Go to the /store/qvm/adaptor directory.
  2. Run the setup script: ./install-cert.sh <truststore_location> <truststore_password><truststore_IP_address:port> The port is the port of service that the certificate belongs to.

Verify connectivity with HCL BigFix

To verify connectivity with HCL BigFix do these steps:

  1. Type the following URL in a web browser:

    https://IP_address or DNS_hostname for BigFix:8080/webreports?page=QNA

  2. Enter the following string on a single line at the command prompt:

    (id of site of it,id of it,name of it,cve id list of it) of fixlets whose (cve id list of it as lowercase contains "cve") of bes sites

  3. Click Evaluate

The following string is an example of the output for one result:

2, 104301, MS01-043: NNTP Service in Windows NT 4.0 
Contains Memory Leak, CVE-2001-0543
The following table describes the breakdown of this result:
Table 1. Query result
Result Query parameter Description
2 (id of site of it) Fixlet site ID
104301 (id of it) Fixlet ID

MS01-043: NNTP Service in Windows NT 4.0 Contains Memory Leak

 (name of it) Fixlet name
CVE-2001-0543 (cve id list of it) CVE ID

Are the most recent scan tools installed?

You must run auto updates to get the most recent scan tools for new installations of QRadar because they are required for this integration to work. Run auto update from the Admin tab, by clicking the Auto Update icon.

For more information about installing QRadar auto updates, see the IBM QRadar Administration Guide.


Is the BigFix scan feature installed?

Run the following command to test whether BigFix scan feature is installed on QRadar:

grep -rl 'BIG_FIX_AGENT_ID' /opt/qvm

The following results are returned if the BigFix scan feature is installed:
  • /opt/qvm/sys/perl/scanner/FusionVM/smb_patch_scanning.pm
  • /opt/qvm/bin/ssh/packages/bin/ssh-packages

If you don't see these files, run auto update from the Admin tab, by clicking the Auto Update icon.


Password reset

If your BigFix details change, you might need to change your password.

  1. Edit the plugin-bigfix.properties file that is in the /opt/qvm/adaptor/config directory.
  2. Replace the following line:

    _decrypt.bes.rest.password=lUb5qzr7FIVH+J319erc+g==

    with the following line:

    _encrypt.bes.rest.password=newpassword

    where newpassword is your new password.

  3. Run the following script to encrypt your new password:

    ./password-property-encrypt.sh plugin-bigfix.properties


Password exception error in the /var/log/iem-cron.log file

You might see the following error in the in the /var/log/iem-cron.log file.

Exception in thread "main" java.lang.NoClassDefFoundError:
com.sun.org.apache.xerces.internal.dom.ElementNSImpl

This password exception error happens when the /opt/qvm/iem/webreports.properties file uses an invalid password.

To fix this error, at the shell prompt, run /opt/qvm/iem/iem-setup-webreports.pl and then enter the correct password.


Vulnerability scan data is not sent to BigFix

Verify that the scanner can authenticate on the asset and access the required information.

  1. Click the Vulnerabilities tab.
  2. In the scan name row, click the number in the Assets column.
  3. Hover over any warning symbols that appear in the column with the flag icon.
  4. Check any credential issues in the scan profile or check asset configuration issues that prevent the scanner from accessing the required information.

Is the asset model updated?

To verify that the asset model is updated with your scan results.
  1. Click the Vulnerabilities tab.
  2. On the navigation menu, click Scan Results.

    If you see a red warning triangle, the asset model is not updated with your scan results.