topic MGMT_API delete all objects with TAGs "TEST" in API / CLI Discussion

MGMT_API delete all objects with TAGs "TEST"

MedM — Wed, 17 Nov 2021 12:01:39 GMT

Dear All,

I created almost 20k objects (hosts, networks,domains,...) with tags "TEST"

I would like to delete them easly.

Is there any commands line to use for deleting all objects relating to tags "TEST" ?

Thanks in advance for your help.

Kind Regards,

Medm

Re: MGMT_API delete all objects with TAGs "TEST"

Tal_Paz-Fridman — Wed, 17 Nov 2021 15:52:53 GMT

Just use the following command and the Tag should be completely deleted from all objects:

mgmt_cli delete tag

https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/delete-tag~v1.8%20

You can use Tag name or UID

Re: MGMT_API delete all objects with TAGs "TEST"

MedM — Wed, 17 Nov 2021 16:20:14 GMT

Dear Tal_Paz-Fridman

Thank you for your reply.

The goal is to delete all the created 20k objects with TAG "TEST".

In fact, I am working with SmartMove scripts and would like to run the scripts again after analysing and resolving errors found on failed_objects.txt file.

From CMA, I selected all objects with TAG TEST but when I tried to delete them but I get disconnected after almost 2 minutes.

The proposed command "mgmt_cli delete tag" will delete all objects with Tag "TEST" or only the TAG "TEST" from objects ?

Thanks again for you help.

Kind Regards,

Medm

Re: MGMT_API delete all objects with TAGs "TEST"

PhoneBoy — Wed, 17 Nov 2021 21:58:02 GMT

I think that will only remove the tag.
To remove all objects with said tag, you’ll probably have to write a script to iterate over all the objects that have said tag and remove said object.

Re: MGMT_API delete all objects with TAGs "TEST"

MedM — Mon, 22 Nov 2021 14:20:38 GMT

Hello,

I refered to your old similar solution found on the link below:

https://community.checkpoint.com/t5/API-CLI-Discussion/mgmt-cli-to-delete-all-objects-matching-a-pattern/td-p/75217

I tried using this command below but I get the error

mgmt_cli -s id.txt delete objects-batch $(mgmt_cli -s id.txt -f json show objects filter "TEST" limit 500 | jq '.objects[].name' | cat -n | sed -r 's/^\s+([0-9]+)/objects.1.list.\1.name/' | tr '\n' ' ')

code: "generic_err_command_not_found"
message: "Requested API command: [delete-objects-batch] not found"

I am working with API v1.1 (api-server-version: "1.1")

Any help please ?

Thanks

MedM

Re: MGMT_API delete all objects with TAGs "TEST"

PhoneBoy — Mon, 22 Nov 2021 16:33:52 GMT

That API endpoint is not available in R80.10 (API version 1.1).
You will need to upgrade your management server to a version that supports it (R80.40, API v1.6).
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/delete-objects-batch~v1.6%20

Re: MGMT_API delete all objects with TAGs "TEST"

Bob_Zimmerman — Mon, 22 Nov 2021 17:29:38 GMT

One concern with this method is it could catch objects with "TEST" in the name.

I don't know of a way to go from a tag to the objects tagged with it. "where-used" doesn't work for tags:

[Expert@DallasSA]# mgmt_cli -f json -r true show host name staxBerlinDevWebVip | jq '{uid:.uid,name:.name,tags:[.tags[]|{uid:.uid,name:.name}]}' { "uid": "70b131cb-e099-4b81-9345-53e5f4752b98", "name": "staxBerlinDevWebVip", "tags": [ { "uid": "962a5a68-29a9-4407-921a-b774890b0a39", "name": "Development" }, { "uid": "0a4b231c-bfad-4b37-8b50-b21a0c0f3f4a", "name": "Berlin" }, { "uid": "63599767-883e-47aa-a04c-fc7d30b16a84", "name": "Stax" } ] } [Expert@DallasSA]# mgmt_cli -f json -r true where-used uid 962a5a68-29a9-4407-921a-b774890b0a39 { "code" : "generic_err_object_not_found", "message" : "Requested object [962a5a68-29a9-4407-921a-b774890b0a39] not found" }

I think the only guaranteed option is to enumerate all of your objects, find the ones with the tag you care about, then send them to mgmt_cli delete-<type>. Something like this:

TagName="Development" mgmt_cli -r true login > session.txt echo "" > toRemove.txt ObjectCount=$(mgmt_cli -f json -s session.txt show objects limit 1 details-level uid | jq '.total') for GetOffset in $(seq 1 500 "${ObjectCount}"); do mgmt_cli -f json -s session.txt show hosts limit 500 offset "${GetOffset}" details-level full | jq -c '.objects[]|{uid:.uid,type:.type,tag:.tags[]|.name}' | grep "\"tag\":\"${TagName}\"" >> toRemove.txt done PublishEvery=100 ChangeCount=1 function deleteObject { mgmt_cli -s session.txt delete-"$1" uid "$2" ((ChangeCount+=1)) if [ ${ChangeCount} -gt ${PublishEvery} ]; then mgmt_cli -s session.txt publish ChangeCount=1 fi } while read ObjectToRemove; do deleteObject "$(echo $ObjectToRemove | cut -d '"' -f 8)" "$(echo $ObjectToRemove | cut -d '"' -f 4)" done < toRemove.txt mgmt_cli -s session.txt publish mgmt_cli -s session.txt logout rm toRemove.txt rm session.txt

Note that I have not tested this! It should work, though. If you only run the top section (everything before "PublishEvery=100"), it will spit out a file with the objects it would remove. That would let you preview what the bottom section would do.

Make and test a backup before running code you get like this from somebody you don't know.