XRAY: How to fix the failure of the Xray scan with the error “Warn: Only 500 of the files matching sha256”

Issue

JFrog Xray is a universal software composition analysis (SCA) solution which scans your artifacts for OSS components being used, and detects security vulnerabilities and licenses in your software components. The results of this scan are then displayed across the JFrog Platform.

Sometimes, the Xray scan on some artifacts will fail, and you can find the following INFO level error message in the xray-server-service.log:

[INFO ] Only 500 of the files matching sha256: xxxxxx would be examined

Root cause

The root cause of such failure is there are too many files with the same SHA256 in the artifacts that Xray is scanning.

How to fix the issue? 

You need to modify the system.yaml of the Xray, to increase the limit for the numbers of the files with the same SHA256. 

The Xray system.yaml is in $JFROG_HOME/xray/var/etc/, and you need to modify the following snippet, to increase the default value.

server:
    # default 500 
    scanMaxFilesToCheckPerSha256: 1500

The Xray must be restarted after the modification.