IMC
cancel
Showing results for 
Search instead for 
Did you mean: 

UAM eAPI: Filter authFail list by distinct/unique mac address

SOLVED
Go to solution
wulftone
Occasional Contributor

UAM eAPI: Filter authFail list by distinct/unique mac address

This is the URL I'm visiting: http://localhost:port/imcrs/uam/authFail?desc=true&orderBy=occureTime

 

This is close to what I want.  I get back a list of many failed authentications, and most of them have the same mac address.  I'd like to cut it down so I only see each unique mac address once, with the latest timestamp.  Is this possible?

 

Thanks!

 

6 REPLIES
Peter_Debruyne
Honored Contributor

Re: UAM eAPI: Filter authFail list by distinct/unique mac address

I recently ran into a similar challenge.

 

this should help with your specific query:

https://translate.googleusercontent.com/translate_c?depth=1&hl=en&ie=UTF8&inter=1&prev=_t&rurl=translate.google.be&sl=zh-CN&tl=en&u=http://218.75.75.91/RESTful/api/uam/logmgt/authFailQueryListAll.html&usg=ALkJrhiC1JPUAbvj3pFfPhSQn7w-0OtLIg

 

or a short guide on the new online eAPI docs (but these are lacking uam functions at this point, so no help for this request right now):

http://abouthpnetworking.com/2014/04/26/imc-e0202-eapi-online-documentation-and-testing/

 

or try contacting hp support for the manual

 

 

 

wulftone
Occasional Contributor

Re: UAM eAPI: Filter authFail list by distinct/unique mac address

Ah yeah, thanks for the links, those are helpful.  I've been poking around at "/imcrs/application.wadl" in order to see the UAM routes, but even this chinese documentation is better than none at all.

 

Unfortunately, I don't see a way to filter the returned query by unique mac addresses.

Peter_Debruyne
Honored Contributor

Re: UAM eAPI: Filter authFail list by distinct/unique mac address

doc says for query filter:

 

loginMac Users MAC address

String (String) type, non-essential, non-default values, length of 17 characters or less required to enter XX-XX-XX-XX-XX-XX, XX: XX: XX: XX: XX: XX, XXXX- XXXX-XXXX format, such as integrity, or enter XX-XX, XX: XX: XX, XXXX-XXXX and other vague format.
 

 

But have not been able to test ...

wulftone
Occasional Contributor

Re: UAM eAPI: Filter authFail list by distinct/unique mac address

Ah, right, I think you misunderstand the desired result.. It returns a list of Failed Authentications, each of which has a macAddress field. I don't want an individual record, I want a collection of all unique MACs.

Most of these records have identical macAddresses, so I want to eliminate all but one of each unique address... e.g., for a list of [1,2,2,3], I want to get only [1,2,3].

Sorry if my first post was confusing!
Peter_Debruyne
Honored Contributor
Solution

Re: UAM eAPI: Filter authFail list by distinct/unique mac address

I see what you mean (after re-reading your original request :) ).

 

That will not be possible directly from the eAPI, but since you have the xml output, it should be quite simple to parse the xml output from the eAPI and get only the unique records / latest failed login (using your preferred xml parser).

 

I personally use a lot of powershell and I know it can be done that way quite easily (since xml file can be loaded as a database, so you only need to filter the db on unique records)

wulftone
Occasional Contributor

Re: UAM eAPI: Filter authFail list by distinct/unique mac address

Yeah, I'm developing a NodeJS application, so I'm just parsing it in there and removing duplicate MAC Addresses. Wish there was a way to do it in the eAPI or MSSQL though. Might have to switch to MySQL just to get decent query support!