ExportXMLWordPrintable

    • Type: Problem report
    • Resolution: Unresolved
    • Priority: Trivial
    • None
    • Affects Version/s: None
    • Component/s: Templates (T)
    • Environment:
      Template: Cisco Meraki organization by HTTP
      Template version: 7.0-3

      The issue was reproduced using version 7.0-3 of the official Cisco Meraki organization by HTTP template.

      The template stops collecting unrelated organization data when /licenses/overview is not supported for an organization using the Subscription Licensing model.

      The Get data item (meraki.get.data) requests:

      GET /organizations/{organizationId}/licenses/overview

      For an organization using Subscription Licensing, the Meraki API returns:

      {{HTTP 400
      Unsupported for organizations in subscriptions licensing}}

      This licensing-specific API error stops execution of the subsequent API requests in the same Get data script.

      As a result, unrelated organization data such as SAML configuration, administrators, and login security settings is not collected, although these API endpoints are supported and return data successfully using the same API token.

      For example, the resulting master item data contains empty values:

      {{

      { "licenseStates": [], "samlSSO": [], "samlRoles": [], "adminAccount": [], "loginSecurity": [], "error": "Unsupported for organizations in subscriptions licensing" }

      }}

      This also causes dependent items unrelated to licensing to fail. For example, the Account lockout attempts item becomes unsupported because its JSONPath preprocessing:

      $.loginSecurity.accountLockoutAttempts

      cannot find the value because loginSecurity remains empty.

      The item reports:

      {{cannot extract value from json by path
      "$.loginSecurity.accountLockoutAttempts":
      no data matches the specified path}}

      Steps to reproduce

      1. Configure the official Cisco Meraki organization by HTTP template with a valid Meraki API token.
      1. Monitor a Meraki organization that uses the Subscription Licensing model.
      1. Wait for or manually execute the Get data (meraki.get.data) item.
      1. Observe the error in Get data item errors:

      Unsupported for organizations in subscriptions licensing

      1. Check dependent items based on data requested later by the same script, for example Account lockout attempts.
      1. Observe that Account lockout attempts becomes unsupported because $.loginSecurity.accountLockoutAttempts cannot be extracted.
      1. Query the individual Meraki API endpoints directly using the same organization ID and the same API token.

      The direct API tests produce the following results:

      {{/licenses/overview -> HTTP 400
      /saml -> HTTP 200
      /samlRoles -> HTTP 200
      /admins -> HTTP 200
      /loginSecurity -> HTTP 200}}

      The /licenses/overview response is:

      {{

      { "errors": [ "Unsupported for organizations in subscriptions licensing" ] }

      }}

      The /saml request succeeds:

      {{

      { "enabled": false, "spInitiated": \{ "subdomain": "", "idpId": "" }

      }}}

      The /samlRoles request also succeeds and returns an empty list:

      []

      The /admins request returns HTTP 200 and valid administrator data. The response content is omitted because it contains personally identifiable information.

      The /loginSecurity request also returns HTTP 200 and valid data, including:

      {{

      { "enforceAccountLockout": true, "accountLockoutAttempts": 10 }

      }}

      All four unrelated endpoints therefore work successfully using the same organization ID and API token.

      The accountLockoutAttempts value is available through the Meraki API, but the Zabbix dependent item cannot receive it because execution of meraki.get.data stops after the unsupported licensing request.

      Actual result

      A failure of the licensing-specific /licenses/overview request stops collection of all API data requested later by the Get data script.

      Consequently, unrelated data from:

      {{/organizations/{organizationId}/saml
      /organizations/{organizationId}/samlRoles
      /organizations/{organizationId}/admins
      /organizations/{organizationId}/loginSecurity}}

      is not collected, even though all of these endpoints return HTTP 200 when queried directly using the same API token.

      This causes dependent items such as Account lockout attempts to become unsupported.

      Expected result

      A licensing-specific endpoint that is not applicable to the organization's licensing model should not prevent collection of unrelated organization data.

      Failure or non-applicability of /licenses/overview should not stop requests to /saml, /samlRoles, /admins, and /loginSecurity.

      The API requests should be handled independently, or the template should otherwise continue collecting unrelated data when a licensing-specific endpoint is not applicable.

      This report is not a request to add Subscription Licensing monitoring. It only concerns the current behavior where an unsupported licensing endpoint prevents unrelated, otherwise supported metrics from being collected.

            Assignee:
            Zabbix Development Team
            Reporter:
            Eimantas Zdanevicius
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: