Extra space at end of variable inserted in a json payload POST to a Flask webhook.

I have alerts setup to trigger on syslogs and I do not know how to remove the extra space at the end of a variable I have inserted into the body of my JSON POST.  It's from the variable (I believe), so I don't know how to parse it python or what I am doing wrong. 

Here is the body:

{
    "sylog": "${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}"
}

And here is the actual json I pulled from a packet capture:

{
    "sylog": "2028218 LC/0/2/CPU0:Oct 11 18:35:59.915 EDT: pfm_node_lc[294]: %PLATFORM-CFP-2-LANE_2_HIGH_BIAS_ALARM  :Set|envmon_lc[163927]|0x102b014|HundredGigE0/2/1/0
"
}

If I put that in a json validator, hit a backspace between the last " and the end of the string, it clears the json errors.

Any ideas?

  • The extra space is really suspect, because often if you add a variable, it comes with a space, so i'd guess first that

        "sylog": "${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}"

    might be 

        "sylog": "${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage} "

    in live, if not that's weird.

    Potentially you could wrap a that macro in a macro to remove the last space, an equivalent for testing looks like this:

        Select top 1 SubString(caption, 0, length(caption)) as minus1 from orion.nodes n
     
    but using that feels like the wrong solution, and that that's another problem somewhere.
  • Thanks for the response.  Interesting that the variable does in fact add a space. 

    You think there is something going on with my flask route?

    That section is fairly basic:


    @app.route('/webhook', methods=['POST'])
    def solarwinds_alert():
        # Parse the incoming JSON alert from SolarWinds
        alert_data = request.json

    Can you expound on the macro idea? It's worth a go.

  • Tell me more about the flask route, I've not touched flask, I recognize all the components but no idea where you put em

    For the macro route, if there's an insert variable button in some solarwinds field somewhere, click custom swql, then place ${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage} where I've put "caption" and that should function, though you'd have to test pumping in a proper event message as in live.

    Messaging from phone so no console access for a bit

  • I'm using flask to run a simple webhook server.  Then I can use python functions within to process and send the data to various destinations.  I will give the customer swql a go here soon. 

  • I bet I am doing someting wrong here with the defining of the SQWL variables. 

    In the diaglog box under advanced I am entering:

    SELECT top 1 SubString(${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}", 0, length(${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}")) as minus1 from orion.nodes n

    I click insert variable right after the " in "syslog": "

    Like this:

    The body is

    {
        "syslog": "${N=SWQL;M=SELECT top 1 SubString(${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}, 0, length(${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage})) as minus1 from orion.nodes n}"
    }

    No actual data is being plucked from the variables, my packet capture just shows the code as being sent in the POST.

  • Quick and dirty way could be to use a SQL variable to replace the line feed and carriage return chars. This is an example:

    ${SQL: SELECT REPLACE(REPLACE('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}', CHAR(13), ''), CHAR(10), '') AS [output] }

  • Try removing the doublequote (") and surrounding putting a single quote before both $'s and after eventmessage)

    SELECT top 1 SubString('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}', 0, length('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')) as minus1 from orion.nodes n


    If the doublequote you've got on there is necessary for later on, stick it on with a concat

    SELECT top 1 concat(SubString('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}', 0, length('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')),'"') as minus1 from orion.nodes n

    Tests ok in SWQL studio, havnt tried in SLW direct yet
  • Here is what I get when I try that:

    {
        SELECT top 1 SubString('2053846 RP/0/RSP0/CPU0:Oct 18 17:54:58.272 EDT: envmon[212]: %PLATFORM-ENVMON-2-SAT_DOM_SENSOR_ALARM : [Satellite 100]: ALARM_LOW alarm occurred for DOM sensor type TXPOWER and port number 11
    ', 0, length('2053846 RP/0/RSP0/CPU0:Oct 18 17:54:58.272 EDT: envmon[212]: %PLATFORM-ENVMON-2-SAT_DOM_SENSOR_ALARM : [Satellite 100]: ALARM_LOW alarm occurred for DOM sensor type TXPOWER and port number 11
    ')) as minus1 from orion.nodes n
    }

    Or if I add a "syslog:" I get:

    {
         "syslog": {SQL: SELECT REPLACE(REPLACE('2053640 LC/0/2/CPU0:Oct 18 16:39:05.214 EDT: pfm_node_lc[294]: %PLATFORM-CFP-2-LANE_2_HIGH_BIAS_ALARM : Clear|envmon_lc[163927]|0x102b014|HundredGigE0/2/1/0
    ', CHAR(13), ''), CHAR(10), '') AS [output] }
    }

  • Both of these pluck the actual alarm off but the POST sent includes the SQL (and still doesn't pass a json validator)

  • So in both of those the outer macro hasnt resolved fully, if I pull the code out it looks alright in SWQL studio though. In "mine" (top) it's not showing the "{SWQL"-type formatting i'd expect it to look like this in the end



    ${N=SWQL;M=SELECT top 1 SubString('2053846 RP/0/RSP0/CPU0:Oct 18 17:54:58.272 EDT: envmon[212]: %PLATFORM-ENVMON-2-SAT_DOM_SENSOR_ALARM : [Satellite 100]: ALARM_LOW alarm occurred for DOM sensor type TXPOWER and port number 11
    ', 0, length('2053846 RP/0/RSP0/CPU0:Oct 18 17:54:58.272 EDT: envmon[212]: %PLATFORM-ENVMON-2-SAT_DOM_SENSOR_ALARM : [Satellite 100]: ALARM_LOW alarm occurred for DOM sensor type TXPOWER and port number 11
    ')) as minus1 from orion.nodes n}


    Obviously in those two examples about i'm using the resolved example

    Using the event macro it should be something like 

    ${N=SWQL;M=SELECT top 1 SubString('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}', 0, length('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')) as minus1 from orion.nodes n}

    Resolved test:



    -------


    I'm not sure what happens at the point that these try and resolve, but if the inner macro resolves I cant see why the other macro shouldn't also be resolvable

    Might be worth dumping in some screenshots of what the next steps look like on your end for context