Notifications

41 views

Description

Windows terminal width can handle 9999 characters. When the MID Server has Powershell v2, we receive payload more than that, the data is pushed to a new line. WMIRunner probes such as Windows - Installed Software, which return a lot of data in JSON format, will cause JSON parsing errors during sensor processing if the JSON has invalid new lines in it.

Steps to Reproduce

  1. Install a MID Server on a Windows host with only Powershell v2
  2. Run Discovery of a Windows Server with a considerable amount of Installed Software

Notice that "Windows - Installed Software" sensor if failing with an error and no Application patterns are running (e.g. you don't see the expected Oracle DB On Windows, IIS, Tomcat, MSSQL, SharePoint, SASS, My SQL server On Windows and Linux).

The ECC Queue input Error string field will have this error. The MID Server version probably will already be up to date when seeing this error:

Sensor is expecting JSON format in the output field after probe post processor script. Please check that your MID server is up to date. (sys_script_include.778011130a0a0b2500c4595ad1d1d768.script; line 28)

The ECC Queue input  payload will have something like:

<results error="JSON.parse (script_include:JSON; line 42)"...

Workaround

This problem is currently under review. You can contact ServiceNow Technical Support or subscribe to this Known Error article by clicking the Subscribe button at the top right of this form to be notified when more information will become available.

2 workarounds are possible:

  • Install Powershell v3 or v4 on the MID Server host. Only Powershell v2 causes this problem.
  • Modify the "Windows - Installed Software" probe's "Post processor script" to include a simple string replace.
    /discovery_probes_wmi.do?sys_id=df4905820a0a0ba500b7ea51b460326c

Before this line:

var outputFormat = this.getParameter("output_format");

Add this line:

output = output.replace(/\n/gi,'');

So that you now have:

new ProbePostProcessor({

	/**
     * Runs the probe instance
     */    
	process : function() {
		related_data.packages = [];
		
		output = output.replace(/\n/gi,''); // Workaround for PRB1349945 Windows sensor JSON parsing errors due to WMIRunner probe output being larger than 10,000 character
		
		var outputFormat = this.getParameter("output_format");
		if (JSUtil.nil(outputFormat) || outputFormat != "json"){
			this.log("Windows - Installed Software: expected JSON as output but got " + outputFormat);
			return;
		}
		
		var jsonPayload = JSON.parse(output);
		// Using hash to make sure we get no dups (by name + version).
		var softwareList = this.getAllPackages(jsonPayload);
  .....

 


Related Problem: PRB1349945

Seen In

There is no data to report.

Associated Community Threads

There is no data to report.

Article Information

Last Updated:2019-07-09 04:48:54
Published:2019-07-01