Cortex Cloud Scan Failures - "The workload either timed out or terminated"
265
Created On 12/23/25 13:19 PM - Last Modified 04/21/26 22:56 PM
Symptom
- Agentless Disk Scanning and/or registry scanning displays a warning message in the Data Sources for the onboarded Account.
- Analysis of the cloud_health_auditing dataset or XQL queries reveals that the most common error message is The workload either timed out or terminated.
- XQL:
dataset = cloud_health_auditing | filter capability in ("Registry","ADS") and classification in ("Warning","Error","Failed")
- XQL:
Environment
- Product: Cortex Cloud (CWP module)
- Features: Agentless Disk Scanning (ADS), Registry Scanning
- Cloud Providers: AWS, GCP, Azure
Cause
- Transient Behavior
- The Cortex Cloud scanning architecture is designed to be cloud-native, using ephemeral, cost-optimized virtual machines (often Spot Instances in AWS or Preemptible VMs in GCP) to perform scans.
- These instances can be reclaimed by the cloud provider at any time if the capacity is needed elsewhere. When this happens mid-scan, the workload is terminated, and this error is logged, this is an expected behavior.
- The Cortex Cloud scanning architecture is designed to be cloud-native, using ephemeral, cost-optimized virtual machines (often Spot Instances in AWS or Preemptible VMs in GCP) to perform scans.
Resolution
- No immediate action is required.
- The Cortex Cloud platform is designed to handle this by automatically retrying the scan on the affected asset within the next 24-hour cycle.
- Future platform releases aim to improve logging to reduce the visibility of this expected "noise."