on Oct 29, 2013Hello,
I'm in the process of automating the deployment of some of our custom parsers and feeds. I see that the REST API apparently allows for the automatic reload to be disabled, but I cannot make that work. Even if using the NW-built web form at <decoder>:50104/decoder/parsers/upload and leaving the "reload" checkbox turned off, the device still logs "Issuing automatic parser reload" and reloads all parsers.
I've tried to find a real REST API document, but haven't found anything that details the things I need. I first thought that I could use /decoder/parsers?msg=upload&op=start, sending the file in the POST body... but that didn't work. I *can* successfully send the file to /decoder/parsers/upload but then all attempts to disable the auto reload have failed.
Can someone please point me to a real API document, or perhaps an example of how to disable this automatic reload?
Thanks!
Josh
Hi Josh-
What version of 9.8 are you using? I have verified that 9.8.5.14 works as intended using /decoder/parsers/upload with out setting the reload argument.
To be a little more specific, once a file is received (upload completed), decoder will delay the reload by 3 seconds to provide a window in which additional content can be received. Each subsequent upload within this window will push the delay another 3 seconds from the completion of the upload. This can continue up until 1 minute from the initial upload at which point a reload is issued regardless of subsequent content upload.
There is no way to disable or alter the parser reload time windows.
The /decoder/parsers/upload REST interface accepts content as multipart/form-data (as used by the html page) or application/zip. The multipart/form-data has a single part with the following headers:
Content-Disposition: form-data; name="feed/parser"; filename="test.lua"
Content-Type: application/octet-stream
The application/zip requires that your content be placed within a flat zip file (no directory structure within the archive) and posted with a content type of application zip. The posted zip file can only contain a single piece of content (feed, parser, etc...). The following demonstrates using curl to upload a zip file:
curl -u admin:netwitness --verbose --header "Content-Type: application/zip" --data-binary @test.zip "http://localhost:50104/decoder/parsers/upload"
The following logs show the upload process for the above curl command including the 3 second reload delay:
id=495493 time=1383330807 level=audit module=Engine msg=User admin (session 596, 127.0.0.1:49855) has logged in
id=495494 time=1383330807 level=info module=Rest msg=Received 3971-42cb-0513-22a8.zip of size 586 for upload
id=495495 time=1383330807 level=audit module=Parse msg=User admin (session 596, 127.0.0.1:49855) has started uploading file '3971-42cb-0513-22a8.zip'
id=495496 time=1383330807 level=audit module=Parse msg=User admin (session 596, 127.0.0.1:49855) has finished uploading file '3971-42cb-0513-22a8.zip'
id=495497 time=1383330807 level=audit module=Parse msg=User admin (session 596, 127.0.0.1:49855) has finished uploading file 'test.lua'
id=495498 time=1383330807 level=audit module=Engine msg=User admin (session 596, 127.0.0.1:49855) has logged out
id=495499 time=1383330810 level=audit module=Parse msg=Issuing automatic parser reload
I hope that helps. Please let me know if you have any additional questions.
Edward Quackenbush