SonarQube behind WAF - sonarscanners drop randomly

SonarQube Server / Community Build
,
1

Must-share information (formatted with Markdown):

  • which versions are you using (SonarQube Server Enterprise Edition v2026.3.1, Scanner 8.1.0.6389)

  • how is SonarQube deployed: Docker (Fargate behind ALB, F5XC WAF in front)

  • what are you trying to achieve:
    I’m running sonarscans in GitHub CI/CD, and sonarscanner fails abruptly at random stages (Downloading a plugin, getting SonarQube version, getting Java engine version, before uploading results…). What users see is that the scanner fails in the middle for no apparent reason, usually a 404, 403 or 401. Retry usually succeeds.

  • what have you tried so far to achieve this
    I have limited access to our network configuration, thus I need to know if there are particular times when SonarQube web server or compute engine generates (what could be classified as) abnormal traffic that results in a block from WAF. If you have a similar WAF, can you stress test it to see if similar drops occur? Or can you recommend more relevant diagnostic tests that I can run in my setup?

One example error log:

17:13:41.967 ERROR Error during SonarScanner CLI execution
  java.lang.IllegalStateException: Call to URL [https://$BASE_URL/api/v2/analysis/jres/cf5ae9d5-5e4c-4f76-bbe8-e574f469bdf5] failed: closed
  	at org.sonarsource.scanner.lib.internal.http.ScannerHttpClient.callUrlWithRedirectsAndProxyAuth(ScannerHttpClient.java:186)
  	at org.sonarsource.scanner.lib.internal.http.ScannerHttpClient.callUrlWithRedirects(ScannerHttpClient.java:145)
  	at org.sonarsource.scanner.lib.internal.http.ScannerHttpClient.callUrl(ScannerHttpClient.java:141)
  	at org.sonarsource.scanner.lib.internal.http.ScannerHttpClient.downloadFile(ScannerHttpClient.java:92)
  	at org.sonarsource.scanner.lib.internal.http.ScannerHttpClient.downloadFromRestApi(ScannerHttpClient.java:66)
  	at org.sonarsource.scanner.lib.internal.facade.forked.JavaRunnerFactory$JreDownloader.download(JavaRunnerFactory.java:258)
  	at org.sonarsource.scanner.downloadcache.DownloadCache.download(DownloadCache.java:92)
  	at org.sonarsource.scanner.downloadcache.DownloadCache.getOrDownload(DownloadCache.java:80)
  	at org.sonarsource.scanner.lib.internal.facade.forked.JavaRunnerFactory.getJreFromServer(JavaRunnerFactory.java:146)
  	at org.sonarsource.scanner.lib.internal.facade.forked.JavaRunnerFactory.createRunner(JavaRunnerFactory.java:88)
  	at org.sonarsource.scanner.lib.internal.facade.forked.ScannerEngineLauncherFactory.createLauncher(ScannerEngineLauncherFactory.java:61)
  	at org.sonarsource.scanner.lib.ScannerEngineBootstrapper.buildNewFacade(ScannerEngineBootstrapper.java:196)
  	at org.sonarsource.scanner.lib.ScannerEngineBootstrapper.bootstrapServer(ScannerEngineBootstrapper.java:176)
  	at org.sonarsource.scanner.lib.ScannerEngineBootstrapper.bootstrap(ScannerEngineBootstrapper.java:151)
  	at org.sonarsource.scanner.cli.Main.analyze(Main.java:76)
  	at org.sonarsource.scanner.cli.Main.main(Main.java:64)
  Caused by: java.io.IOException: closed

Another one

Error:  Failed to execute goal org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356:sonar (default-cli) on project <github-repo>: Call to URL [https://$base_url/api/v2/analysis/engine] failed: stream was reset: NO_ERROR -> [Help 1]
Error:

Another one

Error:  Error during SonarScanner Engine execution
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jdk.internal.loader.ClassLoaders$AppClassLoader@4c178a76-org.sonar.scanner.bootstrap.ScannerPluginRepository': Fail to download plugin [mulevalidationsonarqubepluginmule] into /home/runner/.sonar/_tmp/fileCache12483532834191685566.tmp

Another one

Error:  Error during SonarScanner Engine execution
java.lang.IllegalStateException: Fail to download plugin [javascript] into /home/runner/.sonar/_tmp/fileCache1817891657807369184.tmp
2

Hi @murat. Thanks for the post.

The API URLs for the example requests you provided are below.

/api/v2/analysis/jres/cf5ae9d5-5e4c-4f76-bbe8-e574f469bdf5
/api/v2/analysis/engine
/api/plugins/download?plugin=mulevalidationsonarqubepluginmule
/api/plugins/download?plugin=javascript

SonarScanner makes requests to these URLs to download the scanner engine and language analyzer .jar files. The contents of these files don’t change until you upgrade. So, if the WAF is sporadically interrupting the download, it isn’t likely to be because of the contents.

There could be something else that the WAF (or ALB) doesn’t like about the requests. For example, the WAF may be configured to block download streams when too many streams are made in parallel.

My recommendation is to gather a few examples of failed requests along with timestamps and send the examples to the team that administers the ALB and WAF and ask them to look into their request logs to see if the requests are being blocked; and, if so: why?