query added to eventlog does not work

[BradV]

I'm trying right out of the 1.6.15 developer guide.  If I run:

https://<storage_system>:8080/api/v1/eventlog/minutes:10 | jq -r '.'

I get back event logs from the last ten minutes.  If I try to add a query to get critical events:

https://<storage_system>:8080/api/v1/eventlog/minutes:10?query="severity EQ 2" | jq -r '.'

I get back:

{
  "code": 65,
  "desc": "invalid HTTP request"
}

Any ideas on how to add queries to the call?

[support_s]

System recommended content:

1. SQL/MX: Visual Query Planner help does not work with Windows 10

Please click on "Thumbs Up/Kudo" icon to give a "Kudo".

Thank you for being a HPE valuable community member.

[BradV]

I don't have nonstop access.  I had my account support manager look and the referenced link has nothing to do with my query.  I'm not using Windows of any kind.  I'm not using SQL/MX visual query planner.  I'm trying to make a API call to a 3PAR array.

[veeyarvi]

Hi BradV

The syntax looks to be fine (even though I am not sure whether the jq -r required or not). Could you change the severity 4 (or change the time frame to 120 minutes) and see whether it retrieves any info?

Regards,
Veeyaarvi

[BradV]

Complete syntax that I am using:

USERN=<my account>
PASSW=<my password>
STORSRV=<fqdn of 3par>
sessionID=$(curl --insecure \
   --header "content-type: application/json" \
   --header "accept: application/json" \
   --data '{"user":"'"${USERN}"'","password":"'"${PASSW}"'","sessionType":1}' \
   --request POST https://${STORSRV}:8080/api/v1/credentials | \
   jq -r '.key')
curl -s --insecure --header "X-HP3PAR-WSAPI-SessionKey: ${sessionID}" https://${STORSRV}:8080/api/v1/eventlog | jq -r '.'

which works and provides all of the event logs.  If I add a time frame:

curl -s --insecure --header "X-HP3PAR-WSAPI-SessionKey: ${sessionID}" https://${STORSRV}:8080/api/v1/eventlog/minutes:1000 | jq -r '.'

That works.  Then if I add a query (Note: from the previous command I saw many events with severity 6):

curl -s --insecure --header "X-HP3PAR-WSAPI-SessionKey: ${sessionID}" https://${STORSRV}:8080/api/v1/eventlog/minutes:1000?query="severity EQ 6" | jq -r '.'

I get back:

{
  "code": 65,
  "desc": "invalid HTTP request"
}

In some OneView REST API calls, I have noted a diffence between what the documentation says relative to whitespace and other special characters vs what actually works.  So, I tried:

curl -s --insecure --header "X-HP3PAR-WSAPI-SessionKey: ${sessionID}" https://${STORSRV}:8080/api/v1/eventlog/minutes:1000?query="severity&nbspEQ&nbsp6" | jq -r '.'

but that just returns:

{
  "code": 148,
  "desc": "Invalid Query String"
}

I've also tried:

curl -s --insecure --header "X-HP3PAR-WSAPI-SessionKey: ${sessionID}" https://${STORSRV}:8080/api/v1/vluns | jq -r '.'

and that works.  When I try to query for a specific hostname (which I saw in the previous output):

curl -s --insecure --header "X-HP3PAR-WSAPI-SessionKey: ${sessionID}" https://${STORSRV}:8080/api/v1/vluns?query="hostname EQ myhost" | jq -r '.'

I get back:

{
  "code": 65,
  "desc": "invalid HTTP request"
}

So, I'm not sure that the documented query syntax is correct?

[veeyarvi]

Hi BradV,

The syntax looks okay. Could you try the below

curl -s --insecure --header "X-HP3PAR-WSAPI-SessionKey: ${sessionID}" https://${STORSRV}:8080/api/v1/eventlog/minutes:1000?query="severity EQ 'Critical'" | jq -r '.'
curl -s --insecure --header "X-HP3PAR-WSAPI-SessionKey: ${sessionID}" https://${STORSRV}:8080/api/v1/eventlog/minutes:1000?query="severity EQ 'CRITICAL'" | jq -r '.'

Regards,
Veeyaarvi

[BradV]

I tried it both ways that you showed and then I tried it without the single quotes around critical.  All four tests came back with invalid HTTP request.

[veeyarvi]

Hi BradV,

It does not look to be any syntax issues in the developer guide. We see the same with the developer guide of the later 1.8 guide also

Document - HPE Primera Web Services API 1.8 Developer Guide | HPE Support

Page 61

Examples

Separate multiple values using a comma, and multiple expressions using the AND operator. All examples use the HTTPS GETmethod with the referenced URI.

•Request Critical events that occurred within the last 10 minutes:https://<storage_system>{:443}/api/v1/eventlog/minutes:10?query="severity EQ 2"

•Request notification of events in last 5 minutes using resource and category filters:https://<storage_system>{:443}/api/v1/eventlog/minutes:5?query="resource EQ1,2,3 AND category EQ 1,2"

•Request event information for multiple categories:https://<storage_system>{:443}/api/v1/eventlog?query="category EQ 1,2"

•Request event information for multiple resources:https://<storage_system>{:443}/api/v1/eventlog?query="resource EQ 1,3"

•Request event information within a specific time frame:https://<storage_system>{:443}/api/v1/eventlog?query="time GE 2017-03-2002:30:00 AND time LE 2017-03-20 02:35:00"

[BradV]

Well, not sure why the documentation says that.  It does not work.  I tried each of your examples and get back:

{
  "code": 65,
  "desc": "invalid HTTP request"
}

I noticed that you specified port 443 in your examples, but I do not get any response from port 443.  I do from port 8080.  Has anyone at HPE actually tried any of these examples against a real 3PAR storeserv?

Table 5 on page 28 of 1.8 API guide says error code 65 means:

The request line (first line) of an
HTTP request does not comply with
the form specified for “Request-
Line” in RFC 2616.

So, I added

--request GET

to the curl command, but that just gave the same error.

[BradV]

I ran:

curl -s --insecure -header "X-HP3PAR-WSAPI-SessionKey: ${sessionID}" --request GET https://${STORSRV}:8080/api/v1/eventlog/minutes:100 | jq -r '.'

and got back:

{
  "members": [],
  "total": 0
}

So, I upped the value to 1000 and got back events.  I did see several category 1 events.  So, I tried to add that to the query:

eventlog/minutes:1000?query="category EQ 1" | jq -r '.'

but got back error code 65.