An analysis workflow is stuck

[Dehbiy]

Current Behavior

Context

I have a self deployed instance running, I got OSV enabled and the traffic goes through a proxy to reach storage.googleapis.com. I deployed it with podman quadlets.

My purpose is to store my generated sbom in DT have have the components analyzed with the internal analyzer.

I have set the logging_level to debug.

What happens ?

It seems that the upload happens smoothly, but the analyzer doesn't report any vulnerabilities. I tried everything, after triggering the analysis the scan workflow seems to be stuck and i don't get any relevant or debug info at all.

I left it for a day and still nothing. I have 1100 component for the project.

Relevant logs

2026-07-29 10:04:08,797 INFO [Application] Starting Dependency-Track 5.0.3 (built 2026-07-20T09:25:53Z)
2026-07-29 10:04:08,885 INFO [DataSourceRegistry] Creating data source default
2026-07-29 10:04:09,436 INFO [InitTaskExecutor] Executing init task database-migration
2026-07-29 10:04:10,190 INFO [InitTaskExecutor] Completed init task database-migration in 753ms
2026-07-29 10:04:10,191 INFO [InitTaskExecutor] Executing init task dex-engine-database-migration
2026-07-29 10:04:10,244 INFO [InitTaskExecutor] Completed init task dex-engine-database-migration in 53ms
2026-07-29 10:04:10,245 INFO [InitTaskExecutor] Executing init task database-partition-maintenance
2026-07-29 10:04:11,033 INFO [InitTaskExecutor] Completed init task database-partition-maintenance in 788ms
2026-07-29 10:04:11,033 INFO [InitTaskExecutor] Executing init task database-seeding
2026-07-29 10:04:11,116 INFO [DatabaseSeedingInitTask] Default objects already populated for build 15dc9b57-e7ef-4328-bb62-7d4a69b1f58f (timestamp: 2026-07-20T09:25:53Z); Skipping
2026-07-29 10:04:11,117 INFO [InitTaskExecutor] Completed init task database-seeding in 84ms
2026-07-29 10:04:11,119 INFO [InitTaskExecutor] All init tasks completed in 1694ms
2026-07-29 10:04:11,442 INFO [Server] jetty-12.1.11; built: 2026-07-02T20:57:42.640Z; git: 6c1ced3f077bc633716c54758a743b09b21328e8; jvm 25.0.3+9-LTS
2026-07-29 10:04:11,485 INFO [ContextHandler] Started oeje11s.ServletContextHandler@4a9869a8{ROOT,/,b=jar:file:///opt/owasp/dependency-track/dependency-track-apiserver.jar!/static/,a=AVAILABLE,h=oeje11s.ServletHandler@75e0a54c{STARTED}}
2026-07-29 10:04:11,486 INFO [CacheManagerInitializer] Initializing cache manager for provider 'database'
2026-07-29 10:04:11,493 INFO [FileStorageInitializer] Initializing file storage for provider 'local'
2026-07-29 10:04:11,515 INFO [SecretManagerInitializer] Initializing secret manager for provider 'database'
2026-07-29 10:04:11,595 INFO [DatabaseSecretManager] Loading existing KEK keyset from /data/.dependency-track/keys/secret-management-kek.json
2026-07-29 10:04:11,630 INFO [PersistenceManagerFactory] Initializing persistence framework
2026-07-29 10:04:12,344 INFO [PluginInitializer] Initializing plugin system
2026-07-29 10:04:12,532 INFO [PluginInitializer] Discovering plugins
2026-07-29 10:04:12,542 INFO [PluginInitializer] Loading plugins
2026-07-29 10:04:13,179 INFO [DexEngineInitializer] Registering workflow worker 'default'
2026-07-29 10:04:13,186 INFO [DexEngineInitializer] Registering activity worker 'artifact-import'
2026-07-29 10:04:13,190 INFO [DexEngineInitializer] Registering activity worker 'package-metadata-resolution'
2026-07-29 10:04:13,192 INFO [DexEngineInitializer] Registering activity worker 'notification'
2026-07-29 10:04:13,194 INFO [DexEngineInitializer] Registering activity worker 'vuln-analysis'
2026-07-29 10:04:13,195 INFO [DexEngineInitializer] Registering activity worker 'default'
2026-07-29 10:04:13,197 INFO [DexEngineInitializer] Registering activity worker 'policy-evaluation'
2026-07-29 10:04:13,198 INFO [DexEngineInitializer] Registering activity worker 'metrics-update'
2026-07-29 10:04:13,199 INFO [DexEngineInitializer] Registering activity worker 'vuln-analysis-reconciliation'
2026-07-29 10:04:13,200 INFO [DexEngineInitializer] Starting durable execution engine
2026-07-29 10:04:13,201 INFO [DexEngineImpl] Transitioning from status CREATED to STARTING
2026-07-29 10:04:13,234 INFO [DexEngineLeaderElection] Leadership lease acquired
2026-07-29 10:04:13,302 INFO [DexEngineImpl] Transitioning from status STARTING to RUNNING
2026-07-29 10:04:13,438 INFO [TaskSchedulerInitializer] Starting task scheduler

6-07-29 10:10:13,990 INFO [UpdatePortfolioMetricsWorkflow] No more projects due for metrics update; Refreshing portfolio metrics [workflowInstanceId=update-portfolio-metrics, workflowRunId=019fad5a-7204-71fe-aca4-bf05ef54bcbe, workflowName=update-portfolio-metrics]
2026-07-29 10:35:13,277 INFO [MaintenanceWorker] Deleted 1 completed workflow run(s)
2026-07-29 11:10:14,103 INFO [UpdatePortfolioMetricsWorkflow] No more projects due for metrics update; Refreshing portfolio metrics [workflowInstanceId=update-portfolio-metrics, workflowRunId=019fad91-6180-7e35-8def-9410ff217a3f, workflowName=update-portfolio-metrics]
2026-07-29 11:35:13,277 INFO [MaintenanceWorker] Deleted 1 completed workflow run(s)
2026-07-29 12:00:14,108 INFO [VulnerabilityMetricsUpdateTask] Refreshing vulnerability metrics
2026-07-29 12:00:19,688 INFO [VulnerabilityMetricsUpdateTask] Refreshed vulnerability metrics in PT5.577226718S
2026-07-29 12:10:14,722 INFO [UpdatePortfolioMetricsWorkflow] No more projects due for metrics update; Refreshing portfolio metrics [workflowInstanceId=update-portfolio-metrics, workflowRunId=019fadc8-526e-76b3-8a7e-cd2a9d235c58, workflowName=update-portfolio-metrics]

$ watch -n 2 "psql -U dtrack -d dtrack -c \"SELECT workflow_run_id, status, locked_by, now() - created_at AS age FROM dex_activity_task_q_vuln_analyses ORDER BY created_at DESC LIMIT 5;\""
           workflow_run_id            | status  | locked_by |       age
--------------------------------------+---------+-----------+-----------------
 019fad4b-3d5e-7944-8749-47460760081b | CREATED |           | 02:22:23.956842
 019fad4b-3d5e-7944-8749-47460760081b | CREATED |           | 02:22:23.956842
 019fad34-0a72-7a76-9f39-bf6e583eee6e | CREATED |           | 02:47:44.279842
 019fad34-0a72-7a76-9f39-bf6e583eee6e | CREATED |           | 02:47:44.279842
(4 lignes)

sbom-19aa066d-6530-4db4-9df2-e0fc35380ad4-inventory.cdx.json

Am I missing something ? is there a way to investigate the progress of the scanner or get more logs

Proposed Behavior

What could be nice

Having a way to track down the progress of the scanner or track more debug/error messages from the scheduler

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested

[nscuro]

It doesn't look like debug logging is enabled from your snippets. Here's how to do it: https://dependencytrack.github.io/docs/next/guides/administration/configuring-observability/#adjusting-log-levels

The tasks from your query are in CREATED state which means the scheduler hasn't queued them for execution yet. This would happen when the queue is already saturated according to its capacity (i.e. depth == capacity), or the queue is paused. You can check both of this in the admin panel:

[Dehbiy]

I think i found the issue. In Administration --> Vulnerability Srources --> OSV I had FreeBSD and Docker as parts of the ecosystem and for some reason it seems to crash. I took them off and now it works.

@nscuro thank you for showing the task queues menu, it really helped me !

Is that a known behavior ? I took these ecosystem from the OSV documentation

I have just realized that it's not covered in the google documentation so perhaps that why since im using https://storage.googleapis.com/osv-vulnerabilities

[nscuro]

Hmmm, a borked vulnerability source config should not cause analysis to get stuck. Source mirroring and analysis are decoupled concepts.

[Dehbiy]

I can't explain it myself. I'll be running more tests the upcoming days to see how it goes.

I thought perhaps the workflow would wait for the osv ecosystems to be mirrored completely to start running.

I think it's worth mentioning that I had some other projects on DT with SBOMS that were broken (missing some fields) so i used to get java errors on logs. But on the project i was testing the sbom was ok and i can confirm that because now it's detecting vulnerabilities on it.

I wonder if the existence of broken sboms or uncompleted mirroring could stop the analysis from working.

In anycase, I'll update you if anything shows up

Thanks again @nscuro