Dealing with Nessus logs. Debugging Nessus scans is a very interesting topic. And it is not very well described even in Tenable University course. It become especially interesting when you see strange network errors in the scan results. Let’s see how we can troubleshoot Nessus scans without sending Nessus DB files to Tenable (which is, of course, the default way 😉 ).
Default logging
Let’s see default Nessus logs. I cleared log nessusd.messages file to have only logs of the latest scan:
# echo "" > /opt/nessus/var/nessus/logs/nessusd.messages
and restarted Nessus:
# /bin/systemctl start nessusd.service
I scan only one host (test-linux-host01, 192.168.56.12) with the Advanced scan profile. No default settings was set.
As you can see from the cpe report, it’s typical Linux host with ssh server:
What’s in the logs?
