Overview
Vulnerability Manager is not returning results, showing a failed scan, or not detecting the internal agent, the issue is usually related to setup, connectivity, permissions, or the type of asset being scanned.
This article explains the main checks you can carry out before contacting support.
Start with These Checks
Before troubleshooting a specific error, check the following:
- The IPv4 address has been entered correctly.
- The asset (i.e., server, load balancer, etc.) is online.
- The selected scan type matches the asset setup.
- The asset can be reached from the internet if you are running an external scan.
- The internal agent has been installed if you are running an internal scan.
- The asset has an outbound internet connection.
- Firewalls, security groups, proxies, web application firewalls (WAFs) or content delivery network (CDN) rules are not blocking scan traffic.
- You have allowed enough time for the first scan or internal agent check-in to complete.
If you have completed these checks and the issue continues, use the sections below to narrow down the likely cause.
Issue #1: External Scan Has Failed
An external scan checks the asset from outside your network. If the scan fails after completing the initial checks, the issue is likely to be related to how the asset is exposed publicly.
To fix this:
- Confirm you are scanning the correct public IPv4 address.
- Make sure the public IP points to the asset or service you want to scan.
- Check that the service you expect to scan is exposed on the public endpoint.
- Review any CDN, WAF, hosting platform or load balancer settings that may be changing how traffic reaches the asset.
- Confirm that your hosting or cloud provider allows vulnerability scanning.
- After making any changes, run the external scan again.
External scanning can only assess what is reachable from the internet. If the asset is private or not publicly accessible, use an internal scan instead.
Issue #2: Internal Agent Has Not Connected
For internal scans, the internal agent must be installed on the asset and able to report back to the scanning platform over HTTPS.
If you have already installed the internal agent, the first thing to check is whether the agent is active and running on the asset. To do this, open a terminal or command prompt on the server or device, making sure you have the required admin or root access.
How to Check the Agent Status (Linux and Windows Server)
On Linux servers, run:
sudo systemctl status qualys-cloud-agent
On Windows servers, open Command Prompt or PowerShell as an administrator and run:
sc query qualysagent
If the agent is not running, check the server’s service manager to see whether the agent has stopped or failed to start.
If the agent is running but still has not connected, check whether:
- The asset can make outbound HTTPS connections to the scanning platform.
- A proxy is required for outbound internet access and has been configured correctly.
- Local firewall rules or endpoint security software are blocking the agent.
- The latest agent logs show any service, connection or communication errors.
If the agent was previously installed and connected, check whether anything has changed since installation. For example, firewall rules, proxy settings, endpoint security tools, server network settings or cloud security groups may have been updated and could now be preventing the agent from communicating with the scanning platform.
Internal Scan Is Not Showing Results
If the internal agent is connected but results are not appearing, the scan may still be collecting, uploading or processing the required system information.
Internal results may not appear immediately after the agent first connects. Allow time for the first internal scan cycle to complete and for the results to be processed before they appear in the dashboard.
If results do not appear, check whether:
- The agent has checked in within the last 24 hours.
- The IP asset shown in the dashboard is the server you expect to scan.
- The server has recently been rebuilt, cloned or replaced.
If the server has been rebuilt or replaced, the existing agent may no longer represent the current server and may need to be reinstall. If its been less than 24 hours please give the internal agent a little more time to return the results.
When to Contact Support
Contact support if you have completed the checks above and the scan is still not working.
Include the following information where possible:
- Asset IPv4 address
- Scan type selected
- Approximate time the scan was started
- Any error message shown in the dashboard
- Whether the asset is public or private
- Whether an internal agent is installed
- Operating system of the server
- Whether a proxy, firewall, CDN, WAF or load balancer is in use
- Any recent changes to the server or network
This information will help support identify whether the issue is caused by connectivity, configuration, scan type or agent installation.