- Debugging DAST jobs
- Running out of memory
- DAST job exceeding the job timeout
- Getting warning message
gl-dast-report.json: no matching files
- Getting error
dast job: chosen stage does not existwhen including DAST CI template
- Lack of IPv6 support
The following troubleshooting scenarios have been collected from customer support cases. If you experience a problem not addressed here, or the information here does not fix your problem, create a support ticket. For more details, see the GitLab Support page.
A DAST job has two executing processes:
- The ZAP server.
- A series of scripts that start, control and stop the ZAP server.
DAST_DEBUG CI/CD variable to debug scripts. This can help when troubleshooting the job,
and outputs statements indicating what percentage of the scan is complete.
For details on using variables, see Overriding the DAST template.
Debug mode of the ZAP server can be enabled using the
The following table outlines examples of values that can be set and the effect that they have on the output that is logged.
Multiple values can be specified, separated by semicolons.
|Log configuration value||Effect|
|Enable all debug logging statements.|
|Log every HTTP request and response made by the ZAP server.|
|Log URLs found during the spider scan of the target.|
|Enable Ajax Crawler debug logging statements.|
|Enable ZAP server proxy debug logging statements.|
|Enable debug logging statements of the general ZAP server code.|
By default, ZAProxy, which DAST relies on, is allocated memory that sums to 25% of the total memory on the host. Since it keeps most of its information in memory during a scan, it’s possible for DAST to run out of memory while scanning large applications. This results in the following error:
[zap.out] java.lang.OutOfMemoryError: Java heap space
Fortunately, it’s straightforward to increase the amount of memory available
for DAST by using the
DAST_ZAP_CLI_OPTIONS CI/CD variable:
include: - template: DAST.gitlab-ci.yml variables: DAST_ZAP_CLI_OPTIONS: "-Xmx3072m"
This example allocates 3072 MB to DAST.
Change the number after
-Xmx to the required memory amount.
If your DAST job exceeds the job timeout and you need to reduce the scan duration, we shared some tips for optimizing DAST scans in a blog post.
For information on this, see the general Application Security troubleshooting section.
To avoid overwriting stages from other CI files, newer versions of the DAST CI template do not
define stages. If you recently started using
DAST.latest.gitlab-ci.yml or upgraded to a new major
release of GitLab and began receiving this error, you must define a
dast stage with your other
stages. Note that you must have a running application for DAST to scan. If your application is set
up in your pipeline, it must be deployed in a stage before the
stages: - deploy # DAST needs a running application to scan - dast include: - template: DAST.latest.gitlab-ci.yml
Due to the underlying ZAProxy engine not supporting IPv6, DAST is unable to scan or crawl IPv6-based applications.