TABLE OF CONTENTS


Introduction

The Aqua scanner may log a warning indicating that a secrets detection feed file is missing from the Aqua Server's local storage.


This warning means that the Aqua Server could not find the expected version of the secrets detection feed when the scanner requested the latest security feed information.


The warning does not mean that the scan has failed. The scan continues, but secrets detection may not use the latest available rules until the missing feed is restored.


This article explains why the warning occurs, how it affects scan results, and what to do if it continues to appear.


Applicability

  • Aqua Platform SaaS Edition

  • Aqua Platform Self-Hosted Edition


Symptoms

The scanner logs a warning similar to the following:

Failed fetching security feed
Failed fetching secrets security feed:
Unable to find the feeds in the local file system secrets

The log may also contain a message indicating that a specific JSON file could not be found, for example:

secrets_1a5308sr0db273.json:
no such file or directory

The warning indicates that the expected secrets detection feed file is unavailable on the Aqua Server when requested by the scanner.


Causes

Before scanning an image, the scanner requests the latest security feeds from the Aqua Server, including the feed containing secrets detection rules.


The Aqua Server stores these feeds locally. The warning occurs when the Aqua Server cannot find the expected version of the secrets feed file on disk.


When this happens, the Aqua Server returns an error for the feed request, and the scanner logs the warning.


Impact on scan results

  • Scan execution: The scan continues; the warning does not, by itself, cause the scan to fail.
  • Vulnerability detection: Vulnerability scan results are not affected by this warning.
  • Malware detection: Malware scan results are not affected by this warning.
  • Secrets detection: Detection continues using the scanner's built-in default rules instead of the latest secrets feed rules. Secrets detectable only by newer feed rules may therefore not be reported while the latest feed is unavailable.


Solutions

In most cases, no manual intervention is required.

When the Aqua Server detects that the secrets feed file is missing, it automatically starts downloading the feed again in the background.


Once the download completes, subsequent scans can use the updated secrets detection rules, and the warning should stop appearing.


If the warning continues to appear, further investigation is required.

  1. Confirm whether the warning occurs consistently or intermittently.
  2. Review the Aqua Server logs for errors related to downloading or updating the secrets feed.
  3. If the warning persists, collect the relevant scanner and Aqua Server logs and contact Aqua Support for further investigation.

Until the feed is available, be aware that secrets detection may not identify every secret that the latest rules would detect.


Tips and Tricks

  • Do not assume that the entire scan failed solely because this warning appears.

  • Remember that unaffected vulnerability and malware results do not establish that secrets detection used the latest rules.

  • Check whether subsequent scans stop reporting the warning, which may indicate that the feed has been restored successfully.

  • If the warning recurs, record the time of occurrence and provide the relevant logs to Aqua Support.


Conclusion

The missing secrets feed warning indicates that the Aqua scanner could not retrieve the expected secrets detection feed from the Aqua Server's local storage.


The scan continues, and vulnerability and malware results remain unaffected. However, secrets detection may temporarily rely on built-in default rules, potentially missing secrets detectable only by newer rules.


The Aqua Server automatically attempts to download the missing feed in the background. If the warning continues after the feed should have been restored, contact Aqua Support for further investigation.


Additional Resources

N/A

image