XRAY: Using the UI to scan existing artifacts in bulk

In JFrog’s Xray, there are multiple options to perform Indexing operations. The reason to do these operations is to scan any existing artifacts that were not scanned yet (i.e. you have activated Xray after already using Artifactory repositories for some time). A common request is to Index All artifacts for large repositories; this can be achieved by the below steps via UI:

• "Administration > Xray Settings > Indexed Resources > Index Now > Index Artifacts from Last X Days"

  • The "Index Now" operation will only index & scan the not-scanned items in most newer versions of Xray.

  • It is suggested to do this operation in batches, and wait about 1 day between each batch (or otherwise confirm that the RabbitMQ queues are all reduced to near-zero, which implies there is not much new work to process).

  • “Batches” in this case should be 90 days, 180 days, etc. until the repo reaches the desired amount of indexed artifacts (i.e. 100%).

  • It is safe to use the “Index All Artifacts” button once you complete indexing for most of the repo (i.e 90%). 

  • By doing it in batches, there will be significantly reduced risk of server crashing due to load or RabbitMQ failure.

• "Platform > Xray > Watches & Policies > hover over a Watch's 3-dots menu > Apply On Existing Content > Custom Range > Select unique date range"

  • Treat this one more carefully - you cannot do the same procedure as above, since this scan for Violations will re-scan even on completed artifacts.

  • Instead, pick ranges such as "April to May" and then "March to April" for the batches. This will ensure only necessary items are reviewed for finding Violations of existing artifacts.

• "Platform > Artifactory > Artifacts > open a Repository > find an artifact > Xray > Scan Now"

  • You can find a specific artifact in a repo and scan it immediately if it is not scanned yet.

Throughout the use of the UI to index in batches, we suggest monitoring the RabbitMQ metrics. We expect that by doing the operations in batches, it will not cause server load issues and scanning will happen gracefully.

As always, if you have any doubts about the exact approach and your particular environment, or if any issues arise, please reach out to JFrog Support for additional assistance.