Hi,
We are trying to write a utility to dump UDT information from Orion into our logging system for correlation. We have cobbled together the following SWQL query that we want to use for lookups:
SELECT DISTINCT IPAddress,i.Endpoint.MACAddress,i.DNSNames.DNSName,i.Endpoint.EndpointPorts.EndpointPort.NodeID,i.Endpoint.EndpointPorts.EndpointPort.PortID,i.Endpoint.EndpointPorts.EndpointPort.IsMonitored,
i.Endpoint.EndpointPorts.EndpointPort.PortIndex,i.RouterNodes.DNS, i.Endpoint.EndpointPorts.EndpointPort.Name,
i.Endpoint.EndpointPorts.EndpointPort.Speed,i.Endpoint.EndpointPorts.EndpointPort.Duplex,
i.Endpoint.EndpointPorts.EndpointPort.TrunkMode,i.Endpoint.EndpointPorts.EndpointPort.PortDescription,
i.Endpoint.EndpointPorts.EndpointPort.DetailsUrl,i.Endpoint.EndpointPorts.FirstSeen,i.Endpoint.EndpointPorts.LastSeen
FROM Orion.UDT.IPAddress i WHERE i.Endpoint.EndpointPorts.EndpointPort.PortType=6 AND i.Endpoint.EndpointPorts.FirstSeen>'<A TIMESTAMP FROM 2 HOURS AGO>'
The issue is that the query works from SWQL studio (after modifying SwqlStudio.exe.config), but consistently fails from the PS snap-in:
Get-SwisData : The communication object, System.ServiceModel.Security.SecuritySessionClientSettings`1+ClientSecurityDuplexS
essionChannel[System.ServiceModel.Channels.IDuplexSessionChannel], cannot be used for communication because it is in the Fa
ulted state.
At \\appsrvr1\NetworkScripts\splunk\DumpAD\sw.ps1:36 char:21
+ $data = Get-SwisData <<<< $swis $swql
+ CategoryInfo : NotSpecified: (:) [Get-SwisData], CommunicationObjectFaultedException
+ FullyQualifiedErrorId : System.ServiceModel.CommunicationObjectFaultedException,SwisPowerShell.GetSwisData
I suspect that the issues are due to the max values imposed by SolarWinds.InformationService.Contract2. These could be maxReceivedMessageSize, maxBufferSize, maxArrayLength, or maxStringContentLength.
For an easier demonstration - note that the following is very likely to fail:
SELECT DISTINCT IPAddress FROM Orion.UDT.IPAddress i WHERE i.Endpoint.EndpointPorts.FirstSeen>'<A TIMESTAMP FROM 2 MINUTES AGO>'
While the following is always reliable:
SELECT DISTINCT TOP 200 IPAddress FROM Orion.UDT.IPAddress i WHERE i.Endpoint.EndpointPorts.FirstSeen>'<A TIMESTAMP FROM 2 MINUTES AGO>'
Does anyone have any idea how to override the client contract limits to allow the PS Snap-In to return larger data sets? Other suggestions to how we might best approach this are also welcome. Thanks in advance.
-Frank