Palo Alto XML Response Help

I had to add a .trim() to the wildvalue during discovery to make sure there were not phantom spaces. Once I fixed that, the collection (which was fine the whole time) started working just fine. 

You can drop your version into text-compare.com to see how it differs from mine, which is now running in my portal. I decided to put it up in github because of some odd errors when trying to edit my previous reply. (@A11ey do you know why I can’t edit my previous reply? I’d like to strike out the code and link to the github repo)

Made a little progress.  Here’s where I’m at but now I’m stuck on getting the response trimmed out with my regex.  You can see the first println and the second(which shows the actual output).  What am I doing wrong that I cannot println just “chassis.leds”?

def host = hostProps.get("system.hostname")
def port = hostProps.get("paloalto.port")?: 443
def apikey = hostProps.get("paloalto.apikey.pass")?.trim()
if (apikey == null) {
    println "No paloalto.apikey.pass set"
    return 1
}

def response
def command = URLEncoder.encode("<show><system><state><filter>chassis.leds</filter></state></system></show>", "UTF-8")
def url = "https://${host}:$port/api/?type=op&key=${apikey}&cmd=${command}"
def getRequestConn = url.toURL().openConnection()
if (getRequestConn.responseCode == 200) {
    response = new XmlSlurper().parseText(getRequestConn.content.text)
    def instance = (response=~/(^(.+?):)/)
    println "${instance}##${instance}";
    println response
} 
return 0

If I’m following right, your response object after you use the XmlSlurper on it should return a Groovy Map (similar to Python Dictionary). So you should be able to loop over it without using RegEx:

response.each{k,v-->
  println("${k}==> ${v}")

}

Is this your collection script or the discovery script? I’m not familiar with the original so the output will depend on which part you’re currently building.

Right now I’m working on the discovery portion and haven’t figured out how I want the collection part just yet.  My discovery hopes are for an instance named chassis leds to be created for now.  

This could be very very simple, or just simple.

Option A:

println("chassis_leds##Chassis Leds")

Option B:

def host = hostProps.get("system.hostname")
def port = hostProps.get("paloalto.port")?: 443
def apikey = hostProps.get("paloalto.apikey.pass")?.trim()
if (apikey == null) {
    println "No paloalto.apikey.pass set"
    return 1
}

def response
def command = URLEncoder.encode("<show><system><state><filter>chassis.leds</filter></state></system></show>", "UTF-8")
def url = "https://${host}:$port/api/?type=op&key=${apikey}&cmd=${command}"
def getRequestConn = url.toURL().openConnection()
if (getRequestConn.responseCode == 200) {
    println("chassis_leds##Chassis LEDs")
    return 0
} else {
    return 2
}

You probably don’t need this to be a multi-instance DS. You don’t need discovery. Just make it a SCRIPT DS that’s single instance. Then you only need a collection script that would look like this:

def host = hostProps.get("system.hostname")
def port = hostProps.get("paloalto.port")?: 443
def apikey = hostProps.get("paloalto.apikey.pass")?.trim()
if (apikey == null) {println("No paloalto.apikey.pass set");return 1}

status_map = [
    "off": 0,
    "Green": 1,
    "AnotherColor": 2,
    "YetAnother": 3,
    "AndAnother": 4
]
def response
def command = URLEncoder.encode("<show><system><state><filter>chassis.leds</filter></state></system></show>", "UTF-8")
def url = "https://${host}:$port/api/?type=op&key=${apikey}&cmd=${command}"
def getRequestConn = url.toURL().openConnection()
if (getRequestConn.responseCode == 200) {
    response = new XmlSlurper().parseText(getRequestConn.content.text)
    response.leds.each{k,v->
        println("${k}: ${status_map}")
    }
    return 0
} else {return 2}

I don’t know the possible values of the LEDs, but you’d add them into the status_map and assign them a value. 

What got me to this was we had a failed drive on one of ours and I’m not even sure how it was discovered and no way of telling how long it had been failed.  Using chassis.led’s seemed like a logical all inclusive method to grab this sort of thing.  

Meanwhile you could use a filter like this <show><system><state><filter>env.s0.mp.raid.disk1</filter></state></system></show> and go after the alarm status of disk 1. 

Disk 0 would be <show><system><state><filter>env.s0.mp.raid.disk0</filter></state></system></show>

The response from our device with a bad drive looked like this:

env.s0.mp.raid.disk1-status: { 'alarm': True, 'avg': False, 'desc': Disk Log2 status, 'min': 1, }

Chassis Led’s seem to be color driven however for the disk alerts they look to be using True/False.

You can run <show><system><state></state></system></show> and get back the whole big response if you are interested in seeing everything it returns.  It’s a lot of information though.

I’m going to try out what you have done on my device and see what it returns.  

Ok, this piqued my interest so i tried throwing it against one of my palos. I’m not groovy enough to understand how to work with that response object. Instead, I chose the quick/dirty route of converting to a string and parsing from there. I also now better understand the data, so I retract my original advise of making this single instance and advise instead to make it multi-instance with one instance for each LED (this may have been what you originally meant and I totally misunderstood).

Anyway, here’s the discovery script that’s now working in my environment (again, I didn’t do this the groovy way):

def host = hostProps.get("system.hostname")
def port = hostProps.get("paloalto.port")?: 443
def apikey = hostProps.get("paloalto.apikey.pass")?.trim()
if (apikey == null) {println("No paloalto.apikey.pass set");return 1}

def response
def command = URLEncoder.encode("<show><system><state><filter>chassis.leds</filter></state></system></show>", "UTF-8")
def url = "https://${host}:$port/api/?type=op&key=${apikey}&cmd=${command}"
def getRequestConn = url.toURL().openConnection()
if (getRequestConn.responseCode == 200) {
    body = getRequestConn.content.text
    response = new XmlSlurper().parseText(body)
    data = response.toString()
    data.tokenize("{,}").each{
        kv = it.tokenize(":")
        if ((it.trim() != "chassis.leds:") && (kv.size() > 1)){
            wildvalue = kv[0].replaceAll('\'','')
            println("${wildvalue}##${wildvalue}")
        }
    }
    return 0
} else {return 2}

Here’s the collection script:

def host = hostProps.get("system.hostname")
def port = hostProps.get("paloalto.port")?: 443
def apikey = hostProps.get("paloalto.apikey.pass")?.trim()
if (apikey == null) {println("No paloalto.apikey.pass set");return 1}

status_map = [
    "Off": 0,
    "Green": 1,
    "AnotherColor": 2,
    "YetAnother": 3,
    "AndAnother": 4
]
def response
def command = URLEncoder.encode("<show><system><state><filter>chassis.leds</filter></state></system></show>", "UTF-8")
def url = "https://${host}:$port/api/?type=op&key=${apikey}&cmd=${command}"
def getRequestConn = url.toURL().openConnection()
if (getRequestConn.responseCode == 200) {
    body = getRequestConn.content.text
    response = new XmlSlurper().parseText(body)
    data = response.toString()
    data.tokenize("{,}").each{
        kv = it.tokenize(":")
        if ((it.trim() != "chassis.leds:") && (kv.size() > 1)){
            println("${kv[0].replaceAll('\'','')}.status: ${status_map[kv[1].trim()]}")
        }
    }
    return 0
} else {return 2}

And the datapoint looks like this:

multi-line key-value pairs: ##WILDVALUE##.status

For some reason (maybe new bug in v186) the script output has the right content but LM’s not picking it up:

service.status is definitely in the output, so i’m befuddled. Support chat here I come.

I am seeing the same response in my env.  

Update: needed to trim some non-printable/invisible characters off the wildvalue. I’ve updated the above scripts. It’s working in my portal now against all my palos. If you find out what other values the LEDs can have (besides Off and Green), let me know so I can update it. Or if you have a link to the api docs where this is detailed, i might be able to pull it out of there.