Errors or warnings occur when generating a static analysis IRX file

Symptom

When you generate an IRX file, you might receive errors or warnings, or the generation of the IRX file might fail. When IRX file generation fails, the name of the resulting file is appended with _failed (for example, my_irx_file_failed.irx). When this happens, you have various options for troubleshooting IRX file generation.

Resolution

  • Use a configuration file for troubleshooting IRX file generation

    If you generate an IRX file without using a configuration file and the file generation does not complete (or, if it completes with error), the Static Analyzer Command Line Utility will generate a temporary configuration file for you to use for subsequent scans. This file will look similar to the configuration file template, in that it will contain a Targets element with information that is known about your targets. However, the file will also contain a <TargetSettings> element for you to modify by adding information that will allow the Command Line Utility to generate a complete IRX file. This file is named appscan-config.xml and it is saved to the current directory. This means that the file will automatically be used for the next scan.

    For example, given IRX file generation for a target that contains external dependencies that cannot be located, you might receive a message such as this:

    C:\myTargetDirectory>appscan prepare
                  An IRX file was created, but it may be incomplete.
    C:\myTargetDirectory\myTarget.jar requires the following packages:
          org.apache.jasper.*
    An appscan-config.xml file was created in: C:\myTargetDirectory\appscan-config.xml
    Please update the file and rerun the command.

    The appscan-config.xml file that is generated looks something like this:

    <Configuration>
      <Targets>
        <Target outputs-only="true" path="C:\myTargetDirectory"/>
      </Targets>
      <Settings/>
      <TargetSettings>
        <Target path="C:\myTargetDirectory\myTarget.jar"/>
          <!--Please add the path of the following dependencies to the attribute "additional_classpath" below, separated by semi-colon.
    			  org.apache.jasper.*-->
          <CustomBuildInfo additional_classpath=""/>
        </Target>
      </TargetSettings>
    </Configuration> 

    To resolve the problem, update <CustomBuildInfo additional_classpath=""/> to include org.apache.jasper.* classes on the class path, save the appscan-config.xml file, and then rerun the appscan prepare (Windows) or appscan.sh prepare (Linux and macOS) command. When you specify the path to the JAR file or files, standard Java class path syntax is supported (for example, wildcards are supported).

    If you encounter similar problems while already using a configuration file, you receive the message that indicates the problems. Use this message to update your existing configuration file, and then rerun the command.

    The configuration file is described in Configuring IRX file generation with the CLI.

  • Generate IRX files in debug mode

    If you are generating an IRX file from the CLI, you can issue the appscan prepare (Windows) or appscan.sh prepare (Linux and macOS) command with a debug option. This causes more log files to be generated.

  • Log files associated with IRX file generation

    To see errors or warnings, you can consult the log files that are also generated. Log files are saved to a .zip archive file. By default, the file is saved to the same location that your IRX is saved to - or you can specify another location by using the -l option of the appscan prepare (Windows) or appscan.sh prepare (Linux and macOS) command. The name of the .zip file is based on the name of the IRX file that is generated.

  • Issues with JSP compilation

    If there are issues with JSP compilation, check the compile.log in the <file_name>_logs.zip for compilation errors.