UAM eAPI: Filter authFail list by distinct/unique mac address

[wulftone]

This is the URL I'm visiting: http://localhost:port/imcrs/uam/authFail?desc=true&orderBy=occureTime

This is close to what I want.  I get back a list of many failed authentications, and most of them have the same mac address.  I'd like to cut it down so I only see each unique mac address once, with the latest timestamp.  Is this possible?

Thanks!

[Peter_Debruyne]

I recently ran into a similar challenge.

this should help with your specific query:

https://translate.googleusercontent.com/translate_c?depth=1&hl=en&ie=UTF8&inter=1&prev=_t&rurl=translate.google.be&sl=zh-CN&tl=en&u=http://218.75.75.91/RESTful/api/uam/logmgt/authFailQueryListAll.html&usg=ALkJrhiC1JPUAbvj3pFfPhSQn7w-0OtLIg

or a short guide on the new online eAPI docs (but these are lacking uam functions at this point, so no help for this request right now):

http://abouthpnetworking.com/2014/04/26/imc-e0202-eapi-online-documentation-and-testing/

or try contacting hp support for the manual

[wulftone]

Ah yeah, thanks for the links, those are helpful.  I've been poking around at "/imcrs/application.wadl" in order to see the UAM routes, but even this chinese documentation is better than none at all.

Unfortunately, I don't see a way to filter the returned query by unique mac addresses.

[Peter_Debruyne]

doc says for query filter:

loginMac Users MAC address

String (String) type, non-essential, non-default values, length of 17 characters or less required to enter XX-XX-XX-XX-XX-XX, XX: XX: XX: XX: XX: XX, XXXX- XXXX-XXXX format, such as integrity, or enter XX-XX, XX: XX: XX, XXXX-XXXX and other vague format.

But have not been able to test ...

[wulftone]

Ah, right, I think you misunderstand the desired result.. It returns a list of Failed Authentications, each of which has a macAddress field. I don't want an individual record, I want a collection of all unique MACs.

Most of these records have identical macAddresses, so I want to eliminate all but one of each unique address... e.g., for a list of [1,2,2,3], I want to get only [1,2,3].

Sorry if my first post was confusing!

[Peter_Debruyne · Accepted solution]

I see what you mean (after re-reading your original request :) ).

That will not be possible directly from the eAPI, but since you have the xml output, it should be quite simple to parse the xml output from the eAPI and get only the unique records / latest failed login (using your preferred xml parser).

I personally use a lot of powershell and I know it can be done that way quite easily (since xml file can be loaded as a database, so you only need to filter the db on unique records)

[wulftone]

Yeah, I'm developing a NodeJS application, so I'm just parsing it in there and removing duplicate MAC Addresses. Wish there was a way to do it in the eAPI or MSSQL though. Might have to switch to MySQL just to get decent query support!