Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
Highlighted
dhones Absent Member.
Absent Member.
526 views

getSecurityEvents API call always returns 500 error

This is an identical question to the one asked here, but that one has no replies so I'm hoping to have better luck.  My Manager ESM is version 6.8.0.1896.

I'm able to login with the Manager API and get a valid auth token, which works to make requests to QueryViewerService, ResourceService, and others.  However, when I make a post request to SecurityEventService/getSecurityEvents, the response is always a 500 Internal Server Error with an error traceback in the body.  The error response indicates it's an IllegalArgumentException, and I'll paste the traceback below. 

This error happens regardless of whether the request content is in JSON or XML.  I'm passing it the data specified in the manager_client_doc (page 3011), and the example in the ESM Service Layer Developer's guide.  Here's the request body (Content and Accept headers are set to "application/json"):

{

  "sev.getSecurityEvents" : {

    "sev.authToken" : token,

    "sev.ids" : [event ids],

    "sev.startMillis" : "-1",

    "sev.endMillis" : "-1",

  },

}

And here's the first few and last few lines of the traceback in the error response:

java.lang.IllegalArgumentException: reader can not be null

com.sun.xml.internal.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal0(UnmarshallerImpl.java:339)

com.sun.xml.internal.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal(UnmarshallerImpl.java:334)

...

com.arcsight.coma.servlet.ServerContextFilter.doFilter(ServerContextFilter.java:56)

com.arcsight.coma.servlet.RestParameterCaseFilter.doFilter(RestParameterCaseFilter.java:213)

com.arcsight.coma.servlet.RestAcceptServletFilter.doFilter(RestAcceptServletFilter.java:76)

I appreciate any help or guidance anyone can provide, thanks.

Labels (2)
Tags (1)
0 Likes
6 Replies
Acclaimed Contributor.. Shaun Acclaimed Contributor..
Acclaimed Contributor..

Re: getSecurityEvents API call always returns 500 error

I just tested this against our 6.5c manager using SOAP rather than REST and it worked.

Have you tried it with a single event ID versus multiple?

0 Likes
dhones Absent Member.
Absent Member.

Re: getSecurityEvents API call always returns 500 error

Thanks for the reply Shaun.  Actually, I just resolved this now after retrying it with your suggestion.  That wasn't the problem, but I discovered that I had a problem with the JSON I was sending in the request body, and it's working now. 

0 Likes
jspaulding1 Absent Member.
Absent Member.

Re: getSecurityEvents API call always returns 500 error

Shaun, can you provide an example of the SOAP message you tested?

0 Likes
jspaulding1 Absent Member.
Absent Member.

Re: getSecurityEvents API call always returns 500 error

Daniel,

How did you resolve this? I'm getting the same 500 error every time.

0 Likes
dhones Absent Member.
Absent Member.

Re: getSecurityEvents API call always returns 500 error

Josh, I haven't checked this site in awhile so hopefully you've already solved the problem.  Just going off memory for this one, the issue was that I was using the Python requests library to make the request, and the request body was being url-encoded rather than in JSON format.  This will happen if you use for example requests.post(url, ..., data={request body}).  You need to either use requests.post(url, json={request body}) or requests.post(url, data=json.dumps(request body)).  In case you're using something else to make the request, double check that the body is actually valid JSON - there are plenty of free JSON validation tools online.  Especially check things like quotes are escaped when necessary and that you have outer brackets around the entire request body (which I think was the error in the question I linked to).

Hope this helps.

0 Likes
Acclaimed Contributor.. Shaun Acclaimed Contributor..
Acclaimed Contributor..

Re: getSecurityEvents API call always returns 500 error

Here's a quick excerpt from using SOAP::Lite in PERL:

$securityEventService->call(

      'getSecurityEvents',

      SOAP::Data->name( 'authToken'   )->value( $authToken ),

      SOAP::Data->name( 'ids'         )->value( 840374113561 ),

      SOAP::Data->name( 'startMillis' )->value( -1 ),

      SOAP::Data->name( 'endMillis'   )->value( -1 ),

   )

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.