1 Reply Latest reply on Jan 6, 2012 11:21 AM by tdanner

    Dumping UDT using powershell



      We are trying to write a utility to dump UDT information from Orion into our logging system for correlation.  We have cobbled together the following SWQL query that we want to use for lookups:

      SELECT DISTINCT IPAddress,i.Endpoint.MACAddress,i.DNSNames.DNSName,i.Endpoint.EndpointPorts.EndpointPort.NodeID,i.Endpoint.EndpointPorts.EndpointPort.PortID,i.Endpoint.EndpointPorts.EndpointPort.IsMonitored,
      i.Endpoint.EndpointPorts.EndpointPort.PortIndex,i.RouterNodes.DNS, i.Endpoint.EndpointPorts.EndpointPort.Name,
      FROM Orion.UDT.IPAddress i WHERE i.Endpoint.EndpointPorts.EndpointPort.PortType=6 AND i.Endpoint.EndpointPorts.FirstSeen>'<A TIMESTAMP FROM 2 HOURS AGO>'


      The issue is that the query works from SWQL studio (after modifying SwqlStudio.exe.config), but consistently fails from the PS snap-in:

      Get-SwisData : The communication object, System.ServiceModel.Security.SecuritySessionClientSettings`1+ClientSecurityDuplexS
      essionChannel[System.ServiceModel.Channels.IDuplexSessionChannel], cannot be used for communication because it is in the Fa
      ulted state.
      At \\appsrvr1\NetworkScripts\splunk\DumpAD\sw.ps1:36 char:21
      + $data = Get-SwisData <<<<  $swis $swql
          + CategoryInfo          : NotSpecified: (:) [Get-SwisData], CommunicationObjectFaultedException
          + FullyQualifiedErrorId : System.ServiceModel.CommunicationObjectFaultedException,SwisPowerShell.GetSwisData


      I suspect that the issues are due to the max values imposed by SolarWinds.InformationService.Contract2.  These could be maxReceivedMessageSize, maxBufferSize, maxArrayLength, or maxStringContentLength.

      For an easier demonstration - note that the following is very likely to fail:

      SELECT DISTINCT IPAddress FROM Orion.UDT.IPAddress i WHERE i.Endpoint.EndpointPorts.FirstSeen>'<A TIMESTAMP FROM 2 MINUTES AGO>' 


      While the following is always reliable:

      SELECT DISTINCT TOP 200 IPAddress FROM Orion.UDT.IPAddress i WHERE i.Endpoint.EndpointPorts.FirstSeen>'<A TIMESTAMP FROM 2 MINUTES AGO>' 


      Does anyone have any idea how to override the client contract limits to allow the PS Snap-In to return larger data sets? Other suggestions to how we might best approach this are also welcome.  Thanks in advance.