An issue with updating the list of vulnerabilities

[redduxi]

Hello everybody,

Recently, I encountered a problem with updating the list of vulnerabilities in the dependency-track tool.
I installed the tool locally and also on an EC2 instance. In both cases, I configured absolutely identical configurations for synchronization with vulnerability databases. I also enabled Snyk analyzer.
However, the list of vulnerabilities is different. A tool installed locally in the list has significantly more vulnerabilities than a tool installed on an instance.

Does someone know what the problem might be and how to solve it?

Thanks

[syalioune]

Hello @redduxi
Can you provide more inputs like ?

• Application logs
• Detailed configuration
• Actual vulnerabilities count on both setup
• Example of missing vulnerabilities

[redduxi]

Hello @syalioune,

I'm unsure where to look at the logs, but I'm attaching all the other information.

Configuration:






The configurations are identical in both cases.

Number of vulnerabilities on localhost:

Number of vulnerabilities on the instance:

Example of missing vulnerabilities:

I can provide a longer list of missing vulnerabilities if needed.

Thanks

[syalioune]

Thank you.

I'm unsure where to look at the logs, but I'm attaching all the other information.

You can find the server logs in ${user.home}/.dependency-track/ folder. Those will really be helpful as the differences could likely due to an error in the asynchronous tasks that performs external databases synchronization.