[Openvas-discuss] updating scap data fails

Timo Pollmeier timo.pollmeier at greenbone.net
Tue Feb 24 11:30:11 CET 2015


Hello,

To me, the problem looks like the out-of-memory error Ben described as 
well. Increasing the amount of memory should help, but if that isn't an 
option you can use the SPLIT_PART_SIZE setting like he suggested.

I mainly wanted to add that for the SPLIT_PART_SIZE setting to work, you 
need to have the python script "xml_split" installed.

It is currently not installed by default, but it can be found in 
tools/extra of the manager sources and it has to be copied to
[...]/share/openvas/scap/, with [...] being the prefix of the OpenVAS 
installation (in Alex' case it should be /usr/local).


Best regards,

Timo

On 02/24/2015 09:36 AM, Benoît Allard wrote:
> I Alex,
>
> On 02/23/2015 10:06 PM, Alexander Rau wrote:
>> Hi:
>>
>> I am running openvas-scapdata-sync during initial install and am getting
>> the following error
>>
>> [i] Updating /usr/local/var/lib/openvas/scap-data/nvdcve-2.0-2011.xml
>> Killed
>> -:1217905: parser error : AttValue: ' expected
>>          <cpe-lang:fact-ref name="c
>>                                    ^
>> -:1217905: parser error : attributes construct error
>>          <cpe-lang:fact-ref name="c
>>                                    ^
>> -:1217905: parser error : Couldn't find end of Start Tag fact-ref line
>> 1217905
>>          <cpe-lang:fact-ref name="c
>>                                    ^
>> -:1217905: parser error : Premature end of data in tag logical-test line
>> 1215810
>>          <cpe-lang:fact-ref name="c
>>                                    ^
>> -:1217905: parser error : Premature end of data in tag
>> vulnerable-configuration line 1215809
>>          <cpe-lang:fact-ref name="c
>>                                    ^
>> -:1217905: parser error : Premature end of data in tag entry line 1215808
>>          <cpe-lang:fact-ref name="c
>>                                    ^
>> -:1217905: parser error : Premature end of data in tag nvd line 2
>>          <cpe-lang:fact-ref name="c
>>                                    ^
>> unable to parse -
>> [e] Update of CVEs failed at file
>> '/usr/local/var/lib/openvas/scap-data/nvdcve-2.0-2011.xml': xsltproc exited
>> with code 137
>>
>> This is for OpenVAS 8 on Debian 7
>
> I bet that if you look in your kernel logs, you will see the famous OOM
> killer acting and killing an xslt process.
>
> In the SCAP scripts, we introduced a setting to process the huge XML
> files in chunks. That setting was introduced some time ago already.
>
> Look for the SPLIT_PART_SIZE setting on top of the scap-sync script, and
> set it to a sensible value, this should prevent your problem from
> happening again.
>
> Regards,
> Ben.

-- 
Timo Pollmeier | Greenbone Networks GmbH | http://www.greenbone.net/
Neuer Graben 17, 49074 Osnabrück, Germany | AG Osnabrück, HR B 202460
Executive Directors: Lukas Grunwald, Dr. Jan-Oliver Wagner



More information about the Openvas-discuss mailing list