# SonarQube vs SonarScanner : what does what **URL:** \ **Category:** SonarQube Server / Community Build\ **Tags:** sonarqube, dotnet, scanner\ **Created:** [March 21, 2024, 11:54am UTC](https://community.sonarsource.com/t/sonarqube-vs-sonarscanner-what-does-what/111777 "2024-03-21T11:54:34Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Alexandre](https://avatars.discourse-cdn.com/v4/letter/a/a88e4f/32.png) [@Alexandre](https://community.sonarsource.com/u/Alexandre)\ **Post date:** [March 21, 2024, 11:54am UTC](https://community.sonarsource.com/t/sonarqube-vs-sonarscanner-what-does-what/111777/1 "2024-03-21T11:54:34Z")
Hi, I’ve been searching around for information about what exactly role have SonarQube and SonarScanners and still I’m a bit confused. FYI: I’m using SonarQube docker 10.3, sonar-scanner 2.7 and sonar-scanner-msbuild 5.15.0. The two most relevant information I have are from the SonarQube documentation: - [Analyzing source code overview](https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/overview/) and a question from this forum: - [What is the relationship between SonarScanner and Sonar code analyzer](https://community.sonarsource.com/t/what-is-the-relationship-between-sonarscanner-and-sonar-code-analyzer/18302) Yet I still wonder: what actually are doing the SonarScanners ? - Do they simply send the code, the actual text, to SonarQube, and SonarQube runs the analysis and provides graphical display ? - Do they perform the code analysis and send the result to SonarQube ? In this case, is SonarQube just a graphical display of data sent by the wrapper ? My last question depends on the answer to the above questions: - Why do we need wrapper, except for having unit test results, if it just sends files to SonarQube for static code analysis ? The underlaying question here is: wouldn’t it be faster to provide a given branch of a git repository for SonarQube to checkout it and perform its analysis ? Thanks in advance for your time, Alex. ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [March 22, 2024, 9:38am UTC](https://community.sonarsource.com/t/sonarqube-vs-sonarscanner-what-does-what/111777/2 "2024-03-22T09:38:20Z")
Hey there. The `sonar-scanner` orchestrates and runs the analysis, generating all the data (issues) that is sent to SonarQube for processing (tracking issues, computing measures, and integrating with other services such as running Webhooks or decorating pull requests). With the `sonar-scanner` you would just have a list of issues. With SonarQube, you can track the state of your codebase overtime, manage the results, and make sure you focus on, for example, new code. > [@Alexandre](#): > > The underlaying question here is: wouldn’t it be faster to provide a given branch of a git repository for SonarQube to checkout it and perform its analysis ? This is something that’s possible with SonarCloud + GitHub and [Automatic Analysis](https://docs.sonarsource.com/sonarcloud/advanced-setup/automatic-analysis/), although it has some limitations described in the docs. ---
**Author:** ![Alexandre](https://avatars.discourse-cdn.com/v4/letter/a/a88e4f/32.png) [@Alexandre](https://community.sonarsource.com/u/Alexandre)\ **Post date:** [March 22, 2024, 10:01am UTC](https://community.sonarsource.com/t/sonarqube-vs-sonarscanner-what-does-what/111777/3 "2024-03-22T10:01:01Z")
Hi, Thanks a lot 🙂 much clearer now ! Then if I fully understant how Sonar is working: - If I need compatibility with new cybersecurity issues: CWE and new OWASP that would be released after the OWASP-2021 I would have to update both the sonar-scanner for it to properly find the issues and the SonarQube to display the issue with the proper filter ? - If I need compatibility with a new language revision (let’s say C++24 or .Net 8.0) tht was not supported before, I simply need to update the SonarScanner as it is the one performing the analysis and SonarQube only manage the display ? Regards, Alex. ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [March 22, 2024, 11:12am UTC](https://community.sonarsource.com/t/sonarqube-vs-sonarscanner-what-does-what/111777/4 "2024-03-22T11:12:20Z")
The `sonar-scanner` is occasionally updated to interact better with SonarQube, but ultimately it’s downloading all the logic from SonarQube. So you should keep the `sonar-scanner` updated, but for new rules and new language revisions, what really matters is the SonarQube version. ---
**Author:** ![Alexandre](https://avatars.discourse-cdn.com/v4/letter/a/a88e4f/32.png) [@Alexandre](https://community.sonarsource.com/u/Alexandre)\ **Post date:** [March 25, 2024, 8:23am UTC](https://community.sonarsource.com/t/sonarqube-vs-sonarscanner-what-does-what/111777/5 "2024-03-25T08:23:48Z")
Thank you, you answered all my questions 🙂 ---
**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\ **Post date:** [April 1, 2024, 8:24am UTC](https://community.sonarsource.com/t/sonarqube-vs-sonarscanner-what-does-what/111777/6 "2024-04-01T08:24:42Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.