topic Re: How to get ESA VLN expiration date using API in Email Security

How to get ESA VLN expiration date using API

afesenko — Mon, 03 Jun 2019 18:21:57 GMT

Hello,

I need to monitor status of VLN on a number of ESA machines (ver. 12.1). I can check its status using CLI command 'showlicense'. I also receive alerts on email when something happens but I'd want not to rely on emails, but rather to get a Jira ticket.

We use Nagios for performing such service checks. Could you please help me to find out how can I query my ESAs using curl or similar tool to create some script for Nagios so it will create a Jira ticket for me when VLN is going to be expired?

Thanks,

Andrii

Re: How to get ESA VLN expiration date using API

dmccabej — Tue, 04 Jun 2019 02:07:01 GMT

Hello,

I was not able to find this via the API, but you can use cURL to pull the XML status page which has time remaining left on your feature keys.

curl -k https://esa.example.com/xml/status -u admin:cisco123

Sample output (time_remaining is in seconds) :

<features>
<feature name="McAfee" time_remaining="6474843"/>
<feature name="Cloudmark SP" time_remaining="6474843"/>
<feature name="IronPort Image Analysis" time_remaining="6474843"/>
<feature name="Sophos" time_remaining="6474843"/>
<feature name="File Analysis" time_remaining="6474843"/>
<feature name="Bounce Verification" time_remaining="5178843"/>
<feature name="IronPort Anti-Spam" time_remaining="6474843"/>
<feature name="IronPort Email Encryption" time_remaining="6474843"/>
<feature name="Data Loss Prevention" time_remaining="6474843"/>
<feature name="Intelligent Multi-Scan" time_remaining="6474843"/>
<feature name="File Reputation" time_remaining="6474843"/>
<feature name="Incoming Mail Handling" time_remaining="6558033"/>
<feature name="Graymail Safe Unsubscription" time_remaining="-16962900"/>
<feature name="Outbreak Filters" time_remaining="6474843"/>
</features>

Hopefully, this helps.

Thanks!

-Dennis M.

Re: How to get ESA VLN expiration date using API

afesenko — Tue, 18 Jun 2019 10:26:00 GMT

Hi,
Thank you Dennis for your reply. However, these licenses are already monitored. The only license without monitoring is general VLN.
Thanks,
Andrii

Re: How to get ESA VLN expiration date using API

dmccabej — Tue, 18 Jun 2019 16:03:24 GMT

Hello,

Thanks for the update. There is no variable specific to the VLN that I am aware of. In general, though, the VLN end date should be when the feature keys expire. You could potentially create a script to log in and run the showlicense command and grab the dates from there?

Thanks!

-Dennis M.

Re: How to get ESA VLN expiration date using API

afesenko — Wed, 19 Jun 2019 08:08:51 GMT

Hello,

That was a first thing I tried 🙂 Everything works well when I log into ESA and run 'showlicense' command:
(Machine ***.ironport.com)> showlicense

Virtual License
===============
vln VLNESA3*****26
begin_date Fri May 10 13:07:38 2019 GMT
end_date Tue May 26 13:07:38 2020 GMT
company Cisco SWIFT - Email:afesenko@cisco.com
seats 1
serial B***F
email afesenko@cisco.com
issue 363b***d0
license_version 1.1

However, when I trying to get this info without establishing terminal session I'm getting following error:
$ ssh admin@***.ironport.com 'showlicense'
admin@***.sv4.ironport.com's password:
Unable to run as a batch command because this command has not been configured for the current mode.

Is there any trick for such cases?

Thanks,
Andrii

Re: How to get ESA VLN expiration date using API

dmccabej — Thu, 20 Jun 2019 21:03:05 GMT

Hello,

It sounds like you may be running the command at the cluster level, and we would want to run showlicense at the machine level.

You could potentially try something like this.

clustermode machine esa.test.com; showlicense

Thanks!

-Dennis M.

Re: How to get ESA VLN expiration date using API

afesenko — Fri, 21 Jun 2019 10:58:51 GMT

Hi Dennis,

Unfortunately, using "clustermode machine ***.ironport.com; showlicense" shows the same output:
$ ssh admin@***.ironport.com 'clustermode machine ***.ironport.com; showlicense'
admin@***.ironport.com's password:
Unable to run as a batch command because this command has not been configured
for the current mode.

By the way, another command is being executed successfully:
$ ssh admin@***.ironport.com 'version'
admin@***.ironport.com's password:
Current Version
===============
Product: Cisco C600V Email Security Virtual Appliance
Model: C600V
Version: 12.1.0-071
Build Date: 2019-04-03
Install Date: 2019-05-06 03:38:04
Serial #: 423E***-***03
BIOS: 6.00
CPUs: 8 expected, 8 allocated
Memory: 8192 MB expected, 16384 MB allocated
RAID: NA
RAID Status: Unknown
RAID Type: NA
BMC: NA

Thanks,
Andrii

Re: How to get ESA VLN expiration date using API

Paul Thomas Cyblue — Fri, 21 Jun 2019 13:32:27 GMT

I don't use Virtual appliances to test on.
I assume you are trying to get to machine mode...

create command file

clustermode

showlicense

( the carriage returns will be sending the command and the blank line to inherit the default, which will be current machine you are logged onto )

Create script file
set hh=%time:~0,2%
if "%time:~0,1%"==" " set hh=0%hh:~1,1%
set dt=%date:~-4,4%%date:~-7,2%%date:~-10,2%_%hh%%time:~3,2%%time:~6,2%

start echo y | plink -i "<path to ppk" <username>@<hostname> -m "<path to command file" > "path to log_%dt%.log" 2>&1

Or use Expect if available, or try to manipulate the above to work in your processes.

Thanks

Paul

Re: How to get ESA VLN expiration date using API

afesenko — Fri, 21 Jun 2019 14:22:32 GMT

Hello Paul,

I've modified the command you posted and seems it works! Here is what exactly I did and what I got:

$ echo 'clustermode machine ***.ironport.com; showlicense' | ssh admin@***.ironport.com
Pseudo-terminal will not be allocated because stdin is not a terminal.
admin@***.ironport.com's password:
NOTE: This session will expire if left idle for 30 minutes. Any uncommitted
configuration changes will be lost. Commit the configuration changes as soon
as they are made.
(Machine ***.ironport.com)>
Virtual License
===============
vln VLNESA3***26
begin_date Fri May 10 13:07:38 2019 GMT
end_date Tue May 26 13:07:38 2020 GMT
company Cisco SWIFT - Email:afesenko@cisco.com
seats 1
serial BF9CF
email afesenko@cisco.com
issue 363b***d0
license_version 1.1
(Machine ***.ironport.com)>
Exiting...

This output I can filter out for my needs.
Thank you for the tip!

Best regards,
Andrii