6 Replies Latest reply on Apr 7, 2020 2:06 PM by Arif Alibay

    Can you enable policies in TSPS using a cli

    Rich Bone
      Share This:

      We're looking to move policies between TSPS servers and although we have a mechanism for exporting and importing individual policies, we haven't found a way to enable the newly imported policies.

      Is there a way to do this through a CLI or even a SQL command to update the DB table?

      We have around 700 policies and some are only enabled when DR is invoked so it's not ideal as a manual task.

      Thanks

      Rich

        • 1. Re: Can you enable policies in TSPS using a cli
          Arif Alibay

          You can script it using REST API request

          The Method would be PUT

          The content type would be something like : {"action":"enable","policyIds":["xxddyyy-fgiigkkdk-dkgkd"]}

          where xxddyyy-fgiigkkdk-dkgkd is the ID of the policy

          and url would be : https://<TSPSFQDN><port>/tsws/10.0/api/unifiedadmin/Policy/action

           

           

          Regards,

          2 of 2 people found this helpful
          • 2. Re: Can you enable policies in TSPS using a cli
            Rich Bone

            Hi Arif,

             

            I've tried various different combinations and permutations of the URL and none seem to work:

            https://docs.bmc.com/docs/TSInfrastructure/113/updating-a-policy-774798609.html

             

            I know that the server is responding to web service requests as I can use the following to display the details of a policy:

            https://TSPSServer:8043/tsws/10.0/api/unifiedadmin/Policy/Named_Policy/list?&idType=name

             

            Whenever I try and use update or delete, I get:

            Requested webservice API not found.

             

            I did find some curl examples earlier but I've lost them now.

             

            It shouldn't be this hard but whenever I've had web services questions before, BMC hasn't had a lot more info than is posted in the documentation.

             

            If anyone has any working examples, that would be really helpful.

             

            Thanks

             

            Rich

            • 3. Re: Can you enable policies in TSPS using a cli
              Brendan Murray

              Hi Rich,

               

              The REST API that Arif refers to in his response to your question is not the one described in the documentation. It is new to me. I believe it may be undocumented. Nonetheless, I tested Arif's API in Postman and was able to make it work. Note that his URL:

               

              https://hostname:port/tsws/10.0/api/unifiedadmin/Policy/action

               

              is different from the one described in the documentation page you link to in your second post:

               

              https://hostname:port/tsws/10.0/api/unifiedadmin/MonitoringPolicy/policyname/update?&idType=name

               

              I have attached an export of a Postman collection that contains working examples of both API calls. The file is in Postman Collection 2.1 format. It is JSON data, so if you don't use Postman you can just view the data in an editor. Note that I have edited the file to remove authentication tokens and changed the host names. Note also that quotation marks in the request body have been escaped with backslashes. If you are not using Postman, you may have to remove the backslashes.

               

              My example for the MonitoringPolicy/policyname/update call supplies the minimum number of policy attributes required by the call. I don't understand why the call requires the AgentSelectionCriteria and name (since the policy name is already in the URL), but it does. If you leave out these attributes, the call will fail.

               

              Let me know if you are able to get the API to work using the attached information.

               

              Regards,

               

              Brendan

              1 of 1 people found this helpful
              • 4. Re: Can you enable policies in TSPS using a cli
                Rich Bone

                Winner, winner, chicken dinner.

                 

                Thanks Brendan, I managed to get both of those to work.

                 

                One thing I did discover is that you can use it to change the policy name.  I 'discovered' that by not changing the name in the body of the example you provided.  That's useful as it means I can also write a script to go through all our policies and remove the spaces from the names to make scripting easier.

                 

                The undocumented action call looks like the cleanest for what I want but I still need to do a bit more testing.

                 

                Once I have a working script, I'll post something back here.

                 

                Thanks

                 

                Rich

                • 5. Re: Can you enable policies in TSPS using a cli
                  Brendan Murray

                  You're welcome, Rich. Glad to hear you got both calls to work.

                   

                  I agree that the action call is cleaner. For one thing, I believe you can update multiple policies in a single request since the policyids attribute is a list object. I didn't try this in my testing though.

                   

                  That's interesting about being able to rename the policy with the MonitoringPolicy update call. I have never tried it, but it's a useful function.

                   

                  Please do post your script when it's ready so that others can benefit from your knowledge.

                   

                  Regards,

                   

                  Brendan

                  • 6. Re: Can you enable policies in TSPS using a cli
                    Arif Alibay

                    Hi Rich, Brendan,

                    First thanks for your feedback.

                    I  use Invoke-RestMethod cmlet when doing scripting with REST API.

                    And will try to write a powershell script which enables /disable the policy but will make sure that the script doesn't enable or update all the policies at the same time in one go.

                     

                    I noticed that enabling or updating  several policies or enabling some policies with a lot of Patrol Agents in one go could cause a performance issue on TSIM and TSPS.

                    I've seen a case scenario with  more than 10 K of Patrol Agents where TSPS and all the TSIMs were literally down for 10 days because the policies were edited then saved at same time.

                     

                    What exactly  happened  when those policies were updated :

                      - a  full pconfig () was applied  on all the agents  at the same time,

                              This had caused a lot traffic from CMA to Patrol Agents via the IS.

                               the pconfig column of the  patrolagent_pcfgtladmin table on TSPS database got bigger and bigger. Huge in size, and it impacted TSPS performance.

                             

                    - The PatrolAgents received the new pconfig and discovered new monitors

                         TSIMs got a lot new monitors created with new monid

                         jserver updating the monitors in TSIM Database was also down

                         Devices and monitors were in unknown status.

                     

                             

                    It took more than 10 days for the TS infrastructure to recover  ... without saying that it was all panic and there was no monitoring during that period.

                     

                    I know that when I write a REST API script enabling/updating  policies I'll put some kind of  sleeping functions between  action on each policy and also check the policies and Patrol Agent related tables Patrolagent_pcfgtl, pepolicy ,auditlog, configuration, policy_mapping .

                    And will enable/update the next policy only if   configuration and monitor change cycle  is done for the current policy...

                     

                    Regards,

                    Arif

                    1 of 1 people found this helpful