search

immauss / openvas

Containers for running the Greenbone Vulnerability Manager. Run as a single container with all services or separate single applications containers via docker-compose.
GNU Affero General Public License v3.0
354 stars 102 forks source link

osp_scanner_feed_version: failed to connect to /var/run/ospd/ospd.sock #128

Closed francesco-loreti closed 2 years ago

francesco-loreti commented 2 years ago

Hi, after a couple of hours that I have started the scan, the task stops showing in the program the message "interrupted at x%" (where x stands for the percentage it has reached). Looking in the logs I find the following errors:

In /var/log/gvm/ospd-openvas.log response = self._parser.read_response() File "/usr/lib/python3/dist-packages/redis/connection.py", line 324, in read_response raw = self._buffer.readline() File "/usr/lib/python3/dist-packages/redis/connection.py", line 256, in readline self._read_from_socket() File "/usr/lib/python3/dist-packages/redis/connection.py", line 222, in _read_from_socket raise ConnectionError("Error while reading from socket: %s" % redis.exceptions.ConnectionError: Error while reading from socket: (104, 'Connection reset by peer') And into /var/log/gvm/gvmd.log md manage:WARNING:2022-06-23 09h44.57 UTC:1403435: osp_scanner_feed_version: failed to connect to /var/run/ospd/ospd.sock

the error is added every 30 seconds to the file

After the first interruption, if I start another task, it stops immediately at 0%

I have pulled latest docker image.

This doesn't seem to happen with the docker image immauss/openvas: 21.4.3

Any solutions?

immauss commented 2 years ago

It sounds like ospd has died. If you restart the container, are you then able to start scans again and possible resume the one that died? Make sure you have enough memory too. ( Check the host logs for OoM entries.) You'll need more memory for larger scans too. The most recent recommendation I've seen is 8GB. This is coincidentally what I have on the host I run my production openvas on as well. I expect if you are scanning small segments or individual hosts, you could get away with less though.

If you've already tried all of that, please let me know and I'll try to dig deeper.

-Scott

francesco-loreti commented 2 years ago

I tried to upgrade the system configuration from 4CPU and 8GB ram to 8CPU and 16GB ram and reduced the concurrent scanner to 8 and now I can confirm that the sock error is not blocking the scan. I don't understand why the sock crashes for only 254 IPs, but now at least everything works.

Thanks and regards

immauss commented 2 years ago

Awesome!! Thanks for the follow up.

-Scott