SecTeer VulnDetect Support Forum

    VulnDetect

    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Download VulnDetect Installer
    1. Home
    2. nak
    N
    • Profile
    • Following 0
    • Followers 0
    • Topics 0
    • Posts 1
    • Best 0
    • Controversial 0
    • Groups 0

    nak

    @nak

    0
    Reputation
    338
    Profile views
    1
    Posts
    0
    Followers
    0
    Following
    Joined Last Online

    nak Unfollow Follow

    Latest posts made by nak

    • RE: Nothing to see

      I'm having the same issue. There appear to be a few issues that I can see:

      Looking at "c:\windows\logs\secteer\secteer.log" "nextInspectionTime" is always a day ahead (even when the next inspection is set on the web site). For example, if I set the web site "hour of day to run inspection" to be an hour from now, the web site will display "next inspection time" of "an hour", but the local agent thinks it is 25 hours from now.

      (I'm in GMT-7 time zone if that makes a difference).

      The other issue is: after a reboot the nextInspectionTime is set to be more than 24 hours away. Here's the logs from today after a reboot (auth tokens and names removed):

      [2018-12-20 18:54:10.198-0480] SecTeer Agent v0.10.11.0 starting in launch mode^M
      [2018-12-20 18:54:10.198-0480] Launching SecTeer Agent^M
      [2018-12-20 18:54:10.202-0480] Agent main loop starting^M
      [2018-12-20 18:54:10.202-0480] Initial configuration:
                   version:: 0.10.11.0
                    server : agent.vulndetect.com
                     guid1::
                     guid2::
                     guid3::
           checkInInterval:: 3600 seconds
         checkInRetryDelay:: 360 seconds
      maxCheckInRetryCount:: 10
            dataRetryDelay:: 1800 seconds
          inspectionWindow:: 21600 seconds
            timezoneOffset : -480 minutes
                checkInNow:: false
              noFilesystem:: false
                noRegistry:: false
               noWinUpdate:: false
                  noSystem:: false
                 noPackage:: true^M
      [2018-12-20 19:51:50.929-0480] Checking in with server^M
      [2018-12-20 19:51:50.929-0480]  Server = > 'agent.vulndetect.com'^M
      [2018-12-20 19:51:50.929-0480] Waiting 27 minutes before first check-in^M
      [2018-12-20 20:18:59.940-0480] Found 'computerName' = 'xxxx'^M
      [2018-12-20 20:18:59.947-0480] Connecting to server: agent.vulndetect.com^M
      [2018-12-20 20:19:00.652-0480] Server returned 201 =>^M
      [2018-12-20 20:19:00.671-0480] Check-in complete^M
      [2018-12-20 20:19:00.671-0480] Next scheduled check-in is in 3 minutes^M
      [2018-12-20 20:19:00.672-0480] Current configuration:
                   version:: 0.10.11.0
                    server : agent.vulndetect.com
                     guid1::
                     guid2::
                     guid3::
           checkInInterval : 180 seconds
         checkInRetryDelay : 60 seconds
      maxCheckInRetryCount : 2
            dataRetryDelay : 600 seconds
          inspectionWindow : 21600 seconds
            timezoneOffset : -480 minutes
                serverTime : 2018-12-20 20:18:59 (UTC)
        nextInspectionTime : 2018-12-21 14:00:00 (local time)
                checkInNow:: false
              noFilesystem : false
                noRegistry : false
               noWinUpdate : false
                  noSystem : false
                 noPackage:: true^M
      [2018-12-20 20:19:00.672-0480] No tasks to perform.^M
      

      The previous nextInspectionTime was 2018-12-20 14:00:00 (local time). So the next inspection time jumped a day.

      I believe this happens after a hibernate too, but I don't have the logs to prove it. In my case though it means even though the agent has been installed for weeks, my system never gets inspected unless I leave the system running 24x7.

      I think there is a bug in your time arithmetic for setting nextInspectionTime.

      posted in Bugs and issues
      N
      nak