Referencing SWIS variables in powershell for custom action?

UPDATE: I FOUND THE PROBLEM. I had the ExecuteExternalProgram action set to run as NetworkService. I changed that to use a service account we use for Solarwinds and it worked perfectly. Thank you all for the assistance.

# Import the SolarWinds module
Import-Module SwisPowerShell

# Connection string
try {
    $swis = Connect-Swis -Hostname localhost -Trusted
} catch {
    Write-Error "Failed to connect to SolarWinds SWIS: $_"
    exit
}

# Convert Solarwinds Variables to Powershell Variables
$esxHost = ${N=SwisEntity;M=Caption}

# SWQL query to get VMs running on the specified host
$query = @"
SELECT VM.DisplayName AS VM_Name
FROM Orion.VIM.VirtualMachines AS VM
JOIN Orion.VIM.Hosts AS H ON VM.HostID = H.HostID
WHERE H.HostName = '$esxHost'


# Execute the query
try {
    $results = Get-SwisData $swis $query
} catch {
    Write-Error "Failed to execute query or fetch data: $_"
    exit
}

# Convert the query results to JSON format
$jsonResults = $results | ConvertTo-Json -Depth 100

# Create the webhook payload
$payload = [PSCustomObject][Ordered]@{
    "@type" = "MessageCard"
    "@context" = "http://schema.org/extensions"
    "themeColor" = "0076D7"
    "title" = "ESX Host $esxHost has gone down!"
    "text" = "VMs running on host $esxHost`:`n`n$jsonResults"
} | ConvertTo-Json

$parameters = @{
    "URI" = 'https://mydomain.webhook.office.com/webhookb2/XXXXXXXXXXX'
    "Method" = 'POST'
    "Body" = $payload
    "ContentType" = 'application/json'
}

# Force TLS version
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# Send the webhook request
try {
    $response = Invoke-RestMethod @parameters
    Write-Host "Webhook sent successfully."
} catch {
    Write-Error "Failed to send webhook: $_"
}

I am trying to build a custom action that sends a message to MS Teams when a VM ESX Host goes down. The payload includes all the VMs that were running on the Host. The script above works fine when I explicitly define a host (e.g. myhost1.domain.com). HOWEVER, when I try to get the host dynamically using SWIS variables, it fails, and it appears the $esxHost variable is not populated. Am I using the correct SWIS variable and am I referencing it correctly?

Find more posts tagged with

swis

sam.

PowerShell

swis powershell

Accepted answers

All comments

chad.every

In PowerShell, a string enclosed in single quotation marks is a verbatim string. The string is passed to the command exactly as you type it. No substitution is performed. Try swapping with double quotation marks. If that doesn't work try enclosing the variable with $().

WHERE H.HostName = "$esxHost"

WHERE H.HostName = "$($esxHost)"

dombru

Thanks, while you are correct, that actually is not what is causing me problems in this instance. Let me rephrase my question:

If I have a custom action that is "C:\....\powershell.exe -file c:\myscript.ps1 ${N=SwisEntity;M=Caption}"

When I reference this as $args[0] in my action script, instead of getting the data for the ${N=SwisEntity;M=Caption} (e.g. MyHost1), it's being read literally (e.g. ${N=SwisEntity;M=Caption}).

What do I need to do / what am I missing in order to pass & retrieve SWIS variables into my action powershell script?

I really appreciate any advice.

chad.every

Is it possible to confirm that the alert variable is populating as expected via another alert action? Scripts can be difficult to troubleshoot. I've used an email action as a 2nd alert action, even if it is only temporary, to verify the variables are populating correctly.

Inside of the PowerShell script I've also piped lines to 'Out-File' temporarily to test what the script is seeing/doing to troubleshoot. e.g. a poor mans logs file. Windows permissions are typically a blocker if trying to write inside of C:\Users. I always write to C:\Temp\somefile.log

dombru

I've added logging, and tried again and here's what I am finding (I've "x'd out" the actual domain, but it is correct in the actual logs/script):

Here's the log file. You will see that the $esxHost variable which I'm getting from passing ${N=SwisEntity;M=Host} to the script as an argument is definitely being populated correctly:

[2024-05-08 08:45:31] Connected to SolarWinds SWIS successfully.
[2024-05-08 08:45:31] ESX Host: usovepesxi134.xxxxxxxxxxxx
[2024-05-08 08:45:31] SWQL Query: SELECT VM.DisplayName AS VM_Name FROM Orion.VIM.VirtualMachines AS VM JOIN Orion.VIM.Hosts AS H ON VM.HostID = H.HostID WHERE H.HostName = 'usovepesxi134.xxxxxxxxxxxxx'
[2024-05-08 08:45:31] Query executed successfully.

But the $results (the result of the query) are not:
[2024-05-08 08:45:31] Results:

When I perform the exact query in the logs (copy / paste) in SWQL Studio, it works perfectly:

It appears for whatever reason, that the query is executing but not populating the $results variable. One thing I have noticed is that while the query takes several seconds to execute in SWQL studio, the script's log file shows everything completing within a second which probably explains why it is not being populated.

Here's the custom action I'm executing from SW:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Noninteractive -NoLogo -file \scripts\List_VMs_on_ESX_Host.ps1 -esxHost ${N=SwisEntity;M=HostName}

Here's the updated script I'm working with:

param ($esxHost)

# Import the SolarWinds module
Import-Module SwisPowerShell

# Set the log file path
$logFile = "D:\scripts\List_VMs_on_ESX_Host.log"

# Function to write log messages
function Write-Log($message) {
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logMessage = "[$timestamp] $message"
    Add-Content -Path $logFile -Value $logMessage
}

# Connection string
try {
    $swis = Connect-Swis -Trusted
    Write-Log "Connected to SolarWinds SWIS successfully."
} catch {
    Write-Log "Failed to connect to SolarWinds SWIS: $_"
    exit
}

# SWQL query to get VMs running on the specified host
$query = "SELECT VM.DisplayName AS VM_Name FROM Orion.VIM.VirtualMachines AS VM JOIN Orion.VIM.Hosts AS H ON VM.HostID = H.HostID WHERE H.HostName = '$esxHost'"

Write-Log "ESX Host: $esxHost"
Write-Log "SWQL Query: $query"

# Execute the query
try {
    $results = Get-SwisData $swis $query
    Write-Log "Query executed successfully."
} catch {
    Write-Log "Failed to execute query or fetch data: $_"
    exit
}

Write-Log "Results: $results"