Troubleshooting
Use this table to diagnose and resolve common QRA deployment and reporting issues.
| Symptom | Likely cause | Fix |
|---|---|---|
| Task not relevant on endpoints | The QRA_License
client setting is not set, or BigFix Client is below 11.0. |
Set the QRA_License client setting by running the
Configure BigFix Quantum Risk Analyzer Key
Task. Confirm BigFix Client version 11.0 or later. |
| Scan results not arriving in Elasticsearch | DataBridge not installed or not running, or the scan action did not use a "forward to preconfigured Elasticsearch" option. | Check the Root Server upload area (UploadManagerData\BufferDir) and the DataBridge processed and failed folders. Re-run the Install BigFix DataBridge Task if needed. Monitor the transfers in the DataBridge Status tab of the Scan Health report. See also Archive Manager in the BigFix Platform documentation. |
| Web Reports show no scan data | QRA Analyses are not activated. | Activate the QRA Analyses in the BigFix Console. Allow one evaluation cycle. |
| Scan Health report shows failed endpoints | Scanner binary failed, license key invalid, or insufficient disk space. | Check BigFix Action status for error details. Verify the license key. Confirm disk space on the endpoint. The Scan Health report surfaces common causes directly: invalid or expired license, unreachable Elasticsearch, bad Elasticsearch credentials, and aborted scans. |
| Summarized health status is insufficient; raw scanner output needed | Startup, license, connectivity, or scanner-output problems that the Scan Health summary does not explain. | Activate the Quantum Risk Analyzer Log file info
Analysis. Its Std Output property returns the
endpoint's quantum-scans/bigfix_qra.txt (the
scanner's captured standard output). Its evaluation period is six hours,
so it is not real-time status. It is not required for the QRA Dashboard
report and differs from HCL DataBridge Audit Status,
which reports Root Server transfer activity. |
| Endpoint shows score 0 / Not Ready immediately | 32-bit architecture - hard block condition. | 32-bit endpoints cannot be made PQC-ready. Flag for hardware modernization. |
| Kibana dashboard shows no data | DataBridge not configured, or the scan actions used were not Elasticsearch-forwarding options. | Confirm DataBridge is running on the Root Server with the correct Elasticsearch URL and API key. |
| Filesystem scan too slow or high endpoint impact | Filesystem scan is resource-intensive by design. | Schedule during off-peak hours. Use -cputhrottle low
to reduce memory by 75% at the cost of a four times longer scan. |
| Scanner binary flagged by antivirus | Behavioral heuristics trigger on memory and filesystem crypto reads. | Add the certscanner path
to your antivirus exclusion list. The binary is code-signed. See the scanner reference
documentation, available from your HCL account representative, for
platform-specific antivirus configuration. |