PowerShellTrueSight

TIP: Using TrueSight QueryEventByID and RetrieveQueryResults Complex Types in PowerShell

Recently I was working on piece of code which retrieves TrueSight alert information. I got stuck with “Invalid Long Type:” – Doesn’t make sense right? Come lets see it detail!

Consider you have an alert ID like “mc.pncell_[HOSTNAME].1a5ed3bb.0” using the below snippet you can retrieve the result (resultHandle)

param (
    $AlertID
)

try {
    $Url = "http://HOSTNAME:PORT/imws/services/ImpactManager"
    $QueryEventByID_Body = @"
    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:imap="http://blueprint.bmc.com/ImapiElems">
    <soapenv:Header/>
    <soapenv:Body>
       <imap:QueryEventByID>
          <imap:eventId>$($AlertID)</imap:eventId>
          <imap:imname>IM_TS</imap:imname>
       </imap:QueryEventByID>
    </soapenv:Body>
 </soapenv:Envelope>  
"@
    $QueryEventByID_Params = @{
        Uri         = $Url
        Body        = $QueryEventByID_Body
        Method      = 'POST'
        Headers     = @{
            SOAPAction = 'QueryEventByID'
        }
        ContentType = 'text/xml;charset=UTF-8'
    }
    $QueryEventByID_Request = Invoke-WebRequest @QueryEventByID_Params
    $QueryEventByID_Response = [xml]($QueryEventByID_Request)
    $QueryEventByID_Response.Envelope.Body.QueryResultHandle_output
}
catch {
    $_.Exception
}

We need the resultHandle for RetrieveQueryResults operations. Now let me produce the issue.

param (
    $AlertID
)

try {
    $Url = "http://HOSTNAME:PORT/imws/services/ImpactManager"
    $QueryEventByID_Body = @"
    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:imap="http://blueprint.bmc.com/ImapiElems">
    <soapenv:Header/>
    <soapenv:Body>
       <imap:QueryEventByID>
          <imap:eventId>$($AlertID)</imap:eventId>
          <imap:imname>IM_TS</imap:imname>
       </imap:QueryEventByID>
    </soapenv:Body>
 </soapenv:Envelope>  
"@
    $QueryEventByID_Params = @{
        Uri         = $Url
        Body        = $QueryEventByID_Body
        Method      = 'POST'
        Headers     = @{
            SOAPAction = 'QueryEventByID'
        }
        ContentType = 'text/xml;charset=UTF-8'
    }
    $QueryEventByID_Request = Invoke-WebRequest @QueryEventByID_Params
    $QueryEventByID_Response = [xml]($QueryEventByID_Request)
    $RetrieveQueryResults_Body = @"
  <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:imap="http://blueprint.bmc.com/ImapiElems">
   <soapenv:Header/>
   <soapenv:Body>
      <imap:RetrieveQueryResults>
         <imap:retrieveResultHandle>$($QueryEventByID_Response.Envelope.Body.QueryResultHandle_output.resultHandle)</imap:retrieveResultHandle>
         <imap:startIndex></imap:startIndex>
         <imap:timeout>0</imap:timeout>
         <imap:num_of_events>1</imap:num_of_events>
      </imap:RetrieveQueryResults>
   </soapenv:Body>
</soapenv:Envelope>  
"@
    $RetrieveQueryResults_params = @{
        Uri         = $Url
        Method      = 'POST'
        Body        = $RetrieveQueryResults_Body
        ContentType = 'text/xml;charset=UTF-8'
        Headers     = @{
            SOAPAction = 'RetrieveQueryResults'
        }
    }
    $RetrieveQueryResults_Request = Invoke-WebRequest @RetrieveQueryResults_params
    $RetrieveQueryResults_Response = [xml]($RetrieveQueryResults_Request)
    [pscustomobject]@{
        event_handle = $RetrieveQueryResults_Response.Envelope.Body.RetrieveQueryResults_output.results.NameValueArray_element.NameValue_element.GetValue(1).value.string_value
        mc_ueid      = $RetrieveQueryResults_Response.Envelope.Body.RetrieveQueryResults_output.results.NameValueArray_element.NameValue_element.GetValue(2).value.string_value
        status       = $RetrieveQueryResults_Response.Envelope.Body.RetrieveQueryResults_output.results.NameValueArray_element.NameValue_element.GetValue(43).value.string_value
        mc_owner     = $RetrieveQueryResults_Response.Envelope.Body.RetrieveQueryResults_output.results.NameValueArray_element.NameValue_element.GetValue(48).value.string_value
    }
}
catch {
    $_.Exception
}
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:imap="http://blueprint.bmc.com/ImapiElems">
   <soapenv:Header/>
   <soapenv:Body>
      <imap:RetrieveQueryResults>
         <imap:retrieveResultHandle>$($QueryEventByID_Response.Envelope.Body.QueryResultHandle_output.resultHandle)</imap:retrieveResultHandle>
         <imap:startIndex></imap:startIndex>
         <imap:timeout>0</imap:timeout>
         <imap:num_of_events>1</imap:num_of_events>
      </imap:RetrieveQueryResults>
   </soapenv:Body>
</soapenv:Envelope>

Error: The remote server returned an error: (500) Internal Server Error.

If we redo the same in SOAP UI below error appears

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
   <soapenv:Body>
      <soapenv:Fault>
         <faultcode>soapenv:Server</faultcode>
         <faultstring>Invalid long value:</faultstring>
         <detail/>
      </soapenv:Fault>
   </soapenv:Body>
</soapenv:Envelope>

Solution is very simple – All the parameters are mandatory! Error is bit mis-leading

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:imap="http://blueprint.bmc.com/ImapiElems">
   <soapenv:Header/>
   <soapenv:Body>
      <imap:RetrieveQueryResults>
         <imap:retrieveResultHandle>IMNAME_1533025861817_71587</imap:retrieveResultHandle>
         <imap:startIndex>0</imap:startIndex>
         <imap:timeout>0</imap:timeout>
         <imap:num_of_events>1</imap:num_of_events>
      </imap:RetrieveQueryResults>
   </soapenv:Body>
</soapenv:Envelope>
{
    "event_handle":  "INT",
    "mc_ueid":  "mc.pncell_[SERVER].1a5ed3bb.0",
    "status":  "OPEN",
    "mc_owner":  ""
}

Hope this helps for someone who needs a fix Enjoy PowerShell 🙂 – On a side note I didn’t follow this article.

Leave a Reply

Your email address will not be published. Required fields are marked *