No values for external parameters since netxms agent 3.9.178

[Alwin]

Hi all,

since NetXMS Agent Version 3.9.178 (last working version) we do not get values for the following external paramenter anymore

ExternalParameter = DefenderEngineLastUpdate:powershell -Command "& {Get-MpComputerStatus | Select -ExpandProperty AntivirusSignatureLastUpdated}"

If we run the powershell command directly on the node, it works without any problems.
Other powershell paramenter are however correctly transmitted and displayed - for example:

ExternalParameter = Defender:powershell -Command "& {Get-MpComputerStatus | Select -ExpandProperty RealTimeProtectionEnabled}"

We have no idea anymore and suspect that there is a bug or changed syntax in netxms. Does anyone have the same problem?

best regards,
Alwin

---

[victor]

Hi,

try to use ExternalParameterShellExec instead. Also, how long it take to execute this command? There could have been changes in handling execution timeouts. Agent log on debug level 6 could be helpful as well.

And what version you are using currently?

Best regards,
Victor

[Alwin]

Hi Victor,

the current Server an Agent version is: 4.1.404

The command needs 34ms to execute. In the agent configuration we have also added the line "ExternalParameterProviderTimeout = 60"

We try it with the following command (is this the correct syntax?)

ExternalParameterShellExec = DefenderEngineLastUpdate:powershell -Command "& {Get-MpComputerStatus | Select -ExpandProperty AntivirusSignatureLastUpdated}"

We added also the following parameters to the agent configuration file:

SubAgent = wineventsync.nsm
DebugTags=winsyncevent:6

Now we have logs in the windows event log but no entrys for the executed external parameters.

best regards,
Alwin

[Filipp Sudanov]

I've tried to run
powershell -Command "& {Get-MpComputerStatus | Select -ExpandProperty AntivirusSignatureLastUpdated}"
and the output starts from empty line:

Thursday, July 28, 2022 1:01:30 PM

Not sure if in previous versions agent was skipping empty lines, but currently it just takes the contents of the first line, which is emtpy.
Please try it e.g. this way:
ExternalParameter = DefenderEngineLastUpdate:powershell -Command "& Get-MpComputerStatus | Select -ExpandProperty AntivirusSignatureLastUpdated | Write-Host"

[Alwin]

Hi Filipp,

we have tried another command, which also generate an empty line in the first output line.

Thanks for your workaround - it works great!

It would be nice if the behaviour was the same as in the previous versions.

best regards,
Alwin

[victor]

Hi,

this is very strange. I just compared process execution and external parameter handling code in 3.9 and 4.1 and the only difference is that in 4.x agent replaces null characters with spaces in received command output. Theoretically if script returns null character in first line that could cause such difference in behavior.

Best regards,
Victor