Replies: 3 comments 1 reply
-
|
Supplementing 'Desired Behavior' section as was getting character limit: When I rerun the scan command Trivy debug outputTrivy JSON scan result |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
hello @mix4242 Is it possible to catch both cases, but add the |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
Hi @DmitriyLewen :) Thanks for the response. It is so strange! I have added the recommended |
Beta Was this translation helpful? Give feedback.
-
|
I believe I have identified the cause of my problems to multiple Trivy processes running and scanning in parallel. Bit of further background. The software I was working on is somewhat related to Harbor's Trivy adapter, in that it is also a Harbor adapter for vuln scanning and it also wraps Trivy. The differences are that it further wraps Google's Artifact Registry vuln scanning (as Go vulns were not being picked up by Trivy), is written in Node (TS) and it's architecture was not based on the aforementioned public adapter as we thought we could get away with something much simpler. Over time and lessons learnt, it has become a bit more similar, in that there are multiple processing queues and multiple workers doing the processing for each queue. This allowed for parallel execution of scanning, so we thought hells yeah, let's get this thing flying! Unfortunately, from my log analysis, the errors seemed to always occur right after two scans were started at the same time and overlapped. After setting the worker size to I am not sure if this is a known issue/limitation, but truth be told I haven't had the time to research this further as I've been moved to a different project. Anyways, once again, thanks for Trivy! It's great! And thanks for your help 🙏🏻 |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Description
Hi all,
First time posting here, so let me just say thank you for Trivy. It's a great scanner and it's been great using it so far.
Unfortunately, over past month or so, we've started running into an intermittent issue, where Trivy reports 0 vulnerabilities, even though the image has many known vulnerabilities, and the same scan night before worked fine, as does a subsequent scan in the following morning.
The command we use is
trivy image --scanners vuln -f json -d <IMAGE_NAME_WITH_SHA>I attach debug & json outputs that we normally parse & process, from failure during nightly run and success the following morning.
Please can anyone help in resolving this, or suggest how I can debug the problem further?
More info
0.55.2and re-deployedtrivy clean --allafter 0 vulnerabilities are discovered, and a immediate re-scan, will need to wait for another failure to get result from thisDesired Behavior
When I rerun the scan command
trivy image --scanners vuln -f json -d <IMAGE_NAME_WITH_SHA>in the morning following the issue occurring, I get correct output i.e. vulnerabilities foundActual Behavior
The scan from the command
trivy image --scanners vuln -f json -d <IMAGE_NAME_WITH_SHA>finds no vulnerabilitiesSee the 'Debug Output' below for debug output of trivy.
The Trivy JSON scan result is:
Trivy JSON scan result
Reproduction Steps
Target
Container Image
Scanner
Vulnerability
Output Format
JSON
Mode
Standalone
Debug Output
Operating System
Debian GNU/Linux 12 (bookworm) (in container on k8s)
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions