Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Where are External Program Command Lines Stored?

I need to parse all of the command lines defined in the alerts for action ExecuteExternalProgram against the nodes and applications in our Orion instance so I can move the data we have hard coded into our CMDB (priority/severity, team assignment, etc). I've been searching for days using SWIS and I can't find it. I have tried creating entity relationship diagrams and I've resorted to performing brute force checks against all tables & fields defined in Metadata.Property with type System.String using LIKE operators against %pwsh%, %powershell%, %createincident.ps1%, and %CreateIncident.ps1%. No valid matches are coming back.

Is this kept in a hidden table? Some other data type? Can anyone point me in the right direction for where this information is stored in the database?

Thanks!

-Pat

Find more posts tagged with

swis

Accepted answers

All comments

shuth

The data should be in the Orion.ActionsProperties SWIS table, and can filter by the PropertyName = 'ProgramPath'.

Orion.AlertConfigurations - the alerts and corresponding AlertID
Orion.ActionsAssignment - find the actionID #s by matching AlertID = ParentID
Orion.Actions - can see the basic actions information (title, description, etc) by filtering by the ActionID
Orion.ActionsProperties - the parameters used by the action (ProgramPath, etc)

Haven't gone too far to remove things like duplicates from shared alerts, etc. but should give you a starting point.

nyfreddie

I am not seeing that table nor field defined in Metadata.Property. Tried doing a direct lookup against the table and that failed as well. Are there additional permissions required to make this table available in SWIS?

PS C:\Windows\system32> get-swisdata $swis "select name,entityname from Metadata.Property where Name = 'ProgramPath'"

PS C:\Windows\system32> get-swisdata $swis "select name,entityname from Metadata.Property where EntityName = 'Orion.ActionsProperties'"

PS C:\Windows\system32> (get-swisdata $swis "select entityname from Metadata.Property where EntityName like 'Orion.Action%'") | sort-object | get-unique
Orion.ActionAssignmentProperties
Orion.Actions
Orion.ActionsAssignments
Orion.ActionSchedules

PS C:\Windows\system32> get-swisdata $swis "select ProgramPath from Orion.ActionsProperties"
get-swisdata : Cannot resolve property ProgramPath
At line:1 char:1
+ get-swisdata $swis "select ProgramPath from Orion.ActionsProperties"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [Get-SwisData], FaultException`1
+ FullyQualifiedErrorId : SwisError,SwisPowerShell.GetSwisData

shuth

I'm using SWQL Studio and can see them in there. I use an account with Admin role in SW which has access to everything so don't know off the top of my head what permissions are required - maybe Alert management, maybe full admin.

Also, ProgramPath isn't the name of the column. Per my earlier screenshot, the PropertyName column/field has a value ProgramPath, and the PropertyValue column/field has the path string.

This will also give you the Action title with the value.

SELECT TOP 1000 ap.ActionID, ap.Action.Title, ap.PropertyName, ap.PropertyValue
FROM Orion.ActionsProperties ap
WHERE PropertyName = 'ProgramPath'