Hi,
I found "Log.txt" in the folder of "C:\ProgramData\Qualys\QualysAgent" on my PC as below.
It seems that my PC could connect with Qualys server, https://qagpublic.qg1.apps.qualys.com, but failed to send file fragment to the web server service.
I guess the connection was successful but the web server refused it so that the request timed out.
Please let me know how to solve the issue.
Log.txt
01/17/2017 18:02:00.0292 Information: INTERVAL_EVENT_PROVISION Interval: 0 days, -6 hours, -19 minutes, -50 seconds (Disabled)
01/17/2017 18:02:00.0292 Information: INTERVAL_EVENT_CONFIG Interval: 0 days, -5 hours, -40 minutes, -1 seconds
01/17/2017 18:02:00.0292 Information: INTERVAL_EVENT_EXECUTE_SETUP Interval: -365 days, 0 hours, 0 minutes, 0 seconds (Disabled)
01/17/2017 18:02:00.0307 Information: INTERVAL_EVENT_DOWNLOAD_MANIFEST Interval: 0 days, -5 hours, -38 minutes, -26 seconds
01/17/2017 18:02:00.0307 Information: INTERVAL_EVENT_DOWNLOAD_SELF_PATCH Interval: 0 days, -5 hours, -40 minutes, -16 seconds
01/17/2017 18:02:00.0310 Information: INTERVAL_EVENT_CHECK_REVOCATION Interval: 0 days, -5 hours, -43 minutes, -5 seconds
01/17/2017 18:02:00.0470 Information: INTERVAL_EVENT_STATUS Interval: 0 days, -5 hours, -38 minutes, -25 seconds
01/17/2017 18:02:00.0505 Information: INTERVAL_EVENT_SCAN (Manifest: {59B28E4B-9A91-4E24-B23E-D799C9B5B7AA}) Interval: 0 days, -4 hours, -38 minutes, -40 seconds (Enabled)
01/17/2017 18:02:00.0510 Information: INTERVAL_EVENT_SCAN (Manifest: {B00D33C3-B42A-4343-B5FB-9E6A1E9085FD}) Interval: 0 days, -4 hours, -29 minutes, -55 seconds (Enabled)
01/17/2017 18:02:00.0515 Information: INTERVAL_EVENT_UPLOAD_CHANGELIST (Manifest: {DF4385F3-2D82-40CB-90EC-5355EBC8338E}) Interval: 0 days, 0 hours, 0 minutes, 1 seconds (Enabled)
01/17/2017 18:02:00.0520 Information: ** Weekly window (bitmask): FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
01/17/2017 18:02:00.0525 Information: ** Time NOW (0-3 = quarter): 0
01/17/2017 18:02:00.0530 Information: Scheduling Thread: WAITING 1000ms (1 seconds) for event 'INTERVAL_EVENT_UPLOAD_CHANGELIST'.
01/17/2017 18:02:01.0564 Information: Scheduling Thread: RUNNING event 'INTERVAL_EVENT_UPLOAD_CHANGELIST'...
01/17/2017 18:02:01.0564 Information: Detecting proxy for [secure] URI:443 - HTTPS://qagpublic.qg1.apps.qualys.com/CloudAgent/customer/9C0E25E8-BBFF-5AF6-E040-10AC13043F6A/agent/3E4DA36F-97E4-4F08-BB50-65117C87C3E7/Delta/38215B1B-2654-41A3-9AD0-8EF622CC6863/fragment/4...
01/17/2017 18:02:01.0564 Information: No WinHTTP proxies defined. Detecting auto proxy...
01/17/2017 18:02:01.0595 Information: No proxies found.
01/17/2017 18:02:01.0595 Information: Allocating 3145728 bytes (fragment size) for file buffer...
01/17/2017 18:02:01.0611 Information: Read 3145728 bytes from file to transfer to server...
01/17/2017 18:02:01.0626 Information: Tx 1048576 bytes to web service. 0/3145728 completed.
01/17/2017 18:02:01.0704 Information: Tx 1048576 bytes to web service. 1048576/3145728 completed.
01/17/2017 18:03:01.0621 Error: Unable to send file data to web service: Error: 12002, "(WinHttp) The request has timed out".
01/17/2017 18:03:01.0621 Information: Tx 1048576/3145728 completed.
01/17/2017 18:03:01.0621 Error: Unable to send file fragment to web service: Error: 12002, "(WinHttp) The request has timed out".
01/17/2017 18:03:01.0636 Error: Failed to send request to web service: Error: 12002, "(WinHttp) The request has timed out".
01/17/2017 18:03:01.0636 Error: Failed to send delta file fragment to web service: Error: 12002, URI("https://qagpublic.qg1.apps.qualys.com/CloudAgent/customer/9C0E25E8-BBFF-5AF6-E040-10AC13043F6A/agent/3E4DA36F-97E4-4F08-BB50-65117C87C3E7/Delta/38215B1B-2654-41A3-9AD0-8EF622CC6863/fragment/4"), Port(443), Secure(1)
01/17/2017 18:03:01.0636 Error: Unable to send change list file fragment or finalize to web service: error 12002
01/17/2017 18:03:01.0652 Information: Attempting fallback server...
01/17/2017 18:03:01.0652 Error: WinHttpCrackUrl() failed: Error: 12006, "(WinHttp) The URL specified a scheme other than "http:" or "https:""..
01/17/2017 18:03:01.0652 Error: Unable to create communications request object: 12006
01/17/2017 18:03:01.0652 Error: Fallback server: Unable to send change list file fragment or finalize to web service: error 12006
01/17/2017 18:03:01.0667 Information: Set the back-off multiplier to: 1.500
01/17/2017 18:03:03.0414 Information: Scheduling Thread: FINISHED running event 'INTERVAL_EVENT_UPLOAD_CHANGELIST'. Result: Error: 12006, "(WinHttp) The URL specified a scheme other than "http:" or "https:""..
01/17/2017 18:03:03.0414 Error: Scheduling Thread: EVENT 'INTERVAL_EVENT_UPLOAD_CHANGELIST' returned error: Error: 12006, "(WinHttp) The URL specified a scheme other than "http:" or "https:""..
01/17/2017 18:03:03.0416 Information: INTERVAL_EVENT_PROVISION Interval: 0 days, -6 hours, -20 minutes, -23 seconds (Disabled)
01/17/2017 18:03:03.0416 Information: INTERVAL_EVENT_CONFIG Interval: 0 days, -5 hours, -38 minutes, -37 seconds
01/17/2017 18:03:03.0416 Information: INTERVAL_EVENT_EXECUTE_SETUP Interval: -365 days, 0 hours, 0 minutes, 0 seconds (Disabled)
01/17/2017 18:03:03.0432 Information: INTERVAL_EVENT_DOWNLOAD_MANIFEST Interval: 0 days, -5 hours, -37 minutes, -2 seconds
01/17/2017 18:03:03.0448 Information: INTERVAL_EVENT_DOWNLOAD_SELF_PATCH Interval: 0 days, -5 hours, -41 minutes, -19 seconds
01/17/2017 18:03:03.0448 Information: INTERVAL_EVENT_CHECK_REVOCATION Interval: 0 days, -5 hours, -43 minutes, -38 seconds
01/17/2017 18:03:03.0448 Information: INTERVAL_EVENT_STATUS Interval: 0 days, -5 hours, -37 minutes, -1 seconds
01/17/2017 18:03:03.0463 Information: INTERVAL_EVENT_SCAN (Manifest: {59B28E4B-9A91-4E24-B23E-D799C9B5B7AA}) Interval: 0 days, -4 hours, -39 minutes, -43 seconds (Enabled)
01/17/2017 18:03:03.0463 Information: INTERVAL_EVENT_SCAN (Manifest: {B00D33C3-B42A-4343-B5FB-9E6A1E9085FD}) Interval: 0 days, -4 hours, -30 minutes, -58 seconds (Enabled)
01/17/2017 18:03:03.0463 Information: INTERVAL_EVENT_UPLOAD_CHANGELIST (Manifest: {DF4385F3-2D82-40CB-90EC-5355EBC8338E}) Interval: 0 days, 0 hours, 1 minutes, 29 seconds (Enabled)
01/17/2017 18:03:03.0479 Information: ** Weekly window (bitmask): FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
01/17/2017 18:03:03.0479 Information: ** Time NOW (0-3 = quarter): 0
01/17/2017 18:03:03.0479 Information: Scheduling Thread: WAITING 89000ms (89 seconds) for event 'INTERVAL_EVENT_UPLOAD_CHANGELIST'.
Thank you & best regards,
yom
Traditionally periodic timeouts are nothing to get worried about. Common issues that may cause timeouts in your log file are:
1) Intermittent network connectivity
2) Hibernating a device (commonly a laptop) during a network operation
3) Moving the device between wifi hotspots during a network operation
4) Very slow networks (airline networks typically don't support streaming)
5) etc...
The Agent can log a timeout for two reasons:
1) Timeout while transferring data (Yom)
01/17/2017 18:03:01.0621 Error: Unable to send file data to web service: Error: 12002, "(WinHttp) The request has timed out".
This error is due to a networking, bandwidth, or server issue. Your client transferred 1MB of data in 100ms which suggests you're not on an airline network. Your server endpoint or the network between are the best causes of the timeout in this case.
Your Agent will retry the operation again if it receives a timeout so it will recover from the periodic "Internet of things" taking too long. If your log files are flooded with timeouts then it's time to contact Support, but first try your network hosting provider. There's more that can go wrong between all the devices in your route than the device that Qualys Support can help you with.
2) Timeout connecting (John)
03/08/2017 9:57:24.0061 Information: No WinHTTP proxies defined. Detecting auto proxy...
03/08/2017 9:57:24.0076 Information: No proxies found.
03/08/2017 9:57:45.0105 Error: Failed to send request to web service: Error: 12002, "(WinHttp) The request has timed out".
This error indicates that the Agent simply cannot connect to the server. Most of these issues are within the route to the Server. Here are some steps one can take to troubleshoot:
1) Ensure that on-box technology isn't getting in the way. Local firewalls or blocking software may not allow port 443 to egress the client. Wire sniffing can verify this, telnet, or making a call using another application that locally connects to port 443 on the endpoint.
2) Verify your proxy settings. Internet Explorer (and other browsers) may use a proxy without you knowing it; check your browser's proxy settings if you are verifying port 443 end point access from your client. If your browser requires a proxy to connect out then the Cloud Agent will likely have the same requirement.
3) Use the right proxy settings. A very common mistake many make is confusing user proxy settings with system proxy settings. Browsers on Windows typically use the desktop API to connect to web sites; e.g. UrlMon or WinINet. These API store proxy settings under HKCU in the registry which is tied to the user. In contrast, NT Services (like Windows Update and the Cloud Agent) do not run as a user and HKCU doesn't exist when these start running. WinHTTP is used instead - which stores its proxy settings under HKLM. Due to popular demand the Windows Cloud Agent stopped using WinHTTP's proxy location before version 1.4. It stores its proxy information still in HKLM but the tool that sets this information is called QualysProxy.exe located in %PROGRAMFILES(x86)%\Qualys\QualysAgent. The tool is documented and also supports command line help. Consult online documentation for the location of this tool in later versions (> 1.5) of the Cloud Agent.
4) If the Cloud Agent still does not connect to your server then check with your network admin or IT department to ensure that the proper routes exist to your server or to the Internet; depending on your scenario.
Note: Cloud Agent URLs cannot usually be called from within a browser; it's not supported as a troubleshooting aid. With 1.5+ you should always get an HTTP error calling one from a browser. Similarly, the HTTP status codes returned by the server do not necessarily follow the same convention as a typical web site. The following error indicates more of a data format issue than an error the server encountered processing the request:
"This error (HTTP 405 Method Not Allowed) means that Internet Explorer was able to connect to the website, but the site has a programming error."
The Cloud Agent wants to connect and the Server wants to receive that connection. The problem usually lay somewhere in between.