Every time cloud agent get updated we will receive the new version and it make as a duplicate. Each time we try to delete manually.Instead of subscribe with the new version why not updated with the existing agent .Suggest the best way to get rid of it.
We have the same situation. I've not been able to identify a pattern in order to determine the cause, but cloud agents have shown up as having as many as 4 entries in the Cloud Agent list. Thus far, I've been manually checking every few days and deleting the oldest, but without additional guidance, I cannot say if that's the Right Way(tm).
Hi all,
We have same situation and the duplicates (up til 4 times) also takes licenses and we need to have a solution in place as soon as possible. Thank you.
I also would be interested in how to get rid of duplicated agents.
In my case, I should clarify that it is not every machine that shows up duplicated. A select few show up periodically, without enough consistency in any variable I have researched to determine the cause yet. That said, this is, at a high level, how I remove them:
In the AssetView module, go to Assets (white bar), then Assets again (blue bar).
Run the following search: "tags.name: `Cloud Agent`"
Click/tap the gear icon below the asset count on the right, and select "Download...".
Select Comma Separated Value as the format type, and save the file.
Open the .csv in Excel.
Delete rows 1-3.
Create a pivot table from the remaining data.
Drag the "Name" field to the "Rows" and "Values".
Sort by "Count of Name"
Back in Qualys, manually search for each hostname with a count greater than 1, then figure out which one is the "real" one, and delete the rest.
This is probably a very broken way to do it, but it's working without obvious side effects so far.
I have this AND when I look at my assets, anything we are doing Agents and Scanning we get a duplicate. Is this by design?
Some of these issues have been caused by some transient synchronization issues between the Cloud Agent module (UI/data) and the Vulnerability Management module (UI/data). We have just implemented architecture changes to improve both processing rates and data synchronization (Qualys, Inc. Status - US Platform 1 - Cloud Agent ), which has been rolled out to other shared platforms.
If you are (still) experiencing duplicate issues, please contact Customer Support so we can work with you to get the necessary agent logs for troubleshooting. Thanks.
I still have duplicates. I opened a support case, will post when it has been resolved.
Excellent! Always can count on Jason Kent being thorough!
If you are duplicating EVERY agent and scanned asset (or a large proportion) it could indicate that authentication is not working correctly with scanning, or that for *nix the hostid file is not being placed in /etc, or that unified views is not enabled in users->setup
Hey jkent, was this ever resolved for you? I'm seeing duplicate agents on a brand new subscription in US POD 3 at the moment, and it's a real time-waster.
We see the duplicates still as well.
Hi Chris,
We are having this issue, and we have been since we transitioned to Qualys. I logged a support ticket in July about this issue, I kept being told that this was a known issue and a fix will be "coming soon". I have been told that the platform upgrade in my region (Europe) happened in October, but I still have duplicates. I am now being advised that "scripts" may need to be run. That is the level of information I am getting back.
I have been advised that running an authenticated scan against a host that has a cloud agent installed will unify the records under a Qualys Asset ID.
I am just wondering, when you say some of these issues, are there other issues I should be aware of?
Thanks,
Hi Philip,
Please DM me so I can arrange a call or WebEx with you (or provide your Support Case # and I can follow-up that way).
Thanks,
Chris
--
So here is the deal.
I like the agent, I like that I don't have to have credentials to scan a device deeply. The downside is parity with the scanner and the agent isn't 100% and Qualys doesn't publish the delta so there is no way of knowing if you have complete coverage with the Agent.
So, run non-authenticated scans because, as I mentioned, the nice part of the agent is no credentials. If you scan unauthenticated, you will end up with duplicate entries for the agent devices and scanned devices. The answer, if you don't want authenticated scanning, is to uninstall the agents as they don't give complete coverage and generate confusing amounts of data that don't lead to corrective action.
If you use Authenticated Scanning in concert with the Agents you get the best coverage, in theory.
Jason,
The delta is easily available, see the "supported modules" section in the search lists. You can easily generate lists of QIDs supported in different modules and compare them. I'm pretty sure this is covered in VM training, I'd recommend taking the basic and advanced VM training online or in person (free for customers) to get a better understanding of the tool ;-)
I think you're missing the point of the agent. The agent is just another sensor intended for specific use cases. For example mobile/remote workforce, networks where you cannot scan (either technically or administratively prohibited), environments where VM's are spun up and shut down rapidly and may not be around during a scan window, and so on. The idea with Qualys is to mix and match your various sensors (agent, physical scanners, virtual scanners, cloud specific scanners for AWS, Azure, Google, upcoming passive scanners, upcoming docker/container scanners etc) to best fit the need in any specific technical environment. No single sensor type is going meet all the requirements of every environment, but by combining them as appropriate you can achieve the coverage you need.
Yes in many cases, a combination of the agent to give you close to real time visibility (certainly faster than anything other than an automated system can react/remediate) of a substantial portion of the vulnerability posture of assets, AND visibility into the vulnerability posture of assets that are currently offline (remember, no scanner can tell you anything about an offline asset, but the assessment of the agent is continuously performed against the metadata we have in the cloud so it is performed whether the asset is online or not), coupled with a traditional scan using a custom search list to cover the remote checks plus the Qualys Host ID to marry up the results. Soon we'll have a feature to do this for you, until then it's not difficult using search lists. Additionally the agent gives you visibility into assets that you otherwise wouldn't have any visibility into, for example assets that are never on the corporate network or available for traditional scanning. In this case, agent data is vastly better than no data at all.
Today if you have the agent and do NON-authenticated scanning you are going to double up assets in the Qualys host data, simply because there is no way to accurately and definitively marry up agent and scanned assets. MAC address won't work unless we're on the same broadcast domain, IP is certainly not accurate and of course load balancer and firewall NAT/VIP, DHCP, multi-homed and virtual interfaces, IP masquerade, overlapping address space within the organization all make IP highly suspect for matching purposes, DNS name is frequently duplicative and PTR records often deliberately don't match the forward zone or the name the asset knows itself by, DNS trickery for load balancing and geo-location can totally break DNS as a mechanism for combining data from different sources. There may be ways for an organization to do matching offline based on that organization's specific knowledge of the way their network is put together, but not a good way to do that programmatically with reasonable accuracy today.
I agree with you the agent has special use cases and isn't at all the "Works everywhere." solution the website specifies as the uses.
I'd suggest holding training with your support staff so they easily can assist an organization that is generating duplicate data and unable to figure out why. We have gone through the process of pulling agents from the devices we scan as scanning is still the most accurate way of looking at assets that don't have the agent installed.
i am getting swamped with duplicate assets with of course it eats on my vm licenses for agents. i have a ticket opened with Support for this. just today, 4 entries for the same asset in the cloud asset db (and thats just one case) i am also on the eur1 pod. i have to go manually an clean the entries so as you might imagine i am not a happy camper because of this.
We opened a case as well and it turned out that the issue was caused internally.
During our PC re-initialisation procedure we cleaned up the registry, in this way HOST ID was removed from these location (HKEY_LOCAL_MACHINE\SOFTWARE\Qualys for Windows assets and /etc/qualys/hosted for Linux assets). That’s why CA considered the re-initialised PC as completely new one and created the new registry key. So a duplicate was created.
There is also some other cases which could cause a duplicate creation, like switching of tracking method or synchronisation issues between VM and CA modules.
Hope you’ll find more information in the below articles:
https://qualysguard.qualys.com/qwebhelp/fo_portal/host_assets/agent_merge_data.htm
https://discussions.qualys.com/docs/DOC-4141
https://qualys.secure.force.com/articles/How_To/000002696
https://qualys.secure.force.com/articles/Technical_Solutions/000002710
Some of these issues have been caused by some transient synchronization issues between the Cloud Agent module (UI/data) and the Vulnerability Management module (UI/data). We have just implemented architecture changes to improve both processing rates and data synchronization (Qualys, Inc. Status - US Platform 1 - Cloud Agent ), which has been rolled out to other shared platforms.
If you are (still) experiencing duplicate issues, please contact Customer Support so we can work with you to get the necessary agent logs for troubleshooting. Thanks.