topic Re: mgmt_cli: domains-to-process - Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER in API / CLI Discussion

mgmt_cli: domains-to-process - Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER

abr — Wed, 07 Aug 2024 11:33:05 GMT

Hi CheckMates

Can anyone provide a working example of how to use “domains_to_process”. I just came across this parameter and was wondering how to use it correctly.

As I understand it, the intention is to search across domains for fx. hosts.

Doing something like this:
mgmt_cli show hosts domains-to-process "ALL_DOMAINS_ON_THIS_SERVER" filter "1.1.1.1" --format json -s id.txt

I just can’t seem to make it work. I tried using it with id.txt set to “System Data” but without success.

Guessing that I’m misunderstanding the intended use case.

Much appreciated if anyone have examples to share.

Re: mgmt_cli: domains-to-process - Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER

_Val_ — Fri, 09 Aug 2024 12:25:37 GMT

"domains-to-process" does not seem to be a part of any valid command in the first place. Where are you taking this example from?

Re: mgmt_cli: domains-to-process - Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER

Henrik_Noerr1 — Fri, 09 Aug 2024 14:57:55 GMT

The documentation:

https://sc1.checkpoint.com/documents/latest/APIs/?#cli/show-hosts~v1.9.1%20

domains-to-process

List: string
Default: CURRENT_DOMAIN

Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ignore-warnings true. Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER.

Re: mgmt_cli: domains-to-process - Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER

PhoneBoy — Mon, 12 Aug 2024 18:56:41 GMT

What's the exact output when you try to use that command?
Also see the note about including ignore-warnings true in the API docs.

Re: mgmt_cli: domains-to-process - Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER

abr — Tue, 13 Aug 2024 06:15:50 GMT

Hi PhoneBoy

Result of trying the command with domain set to "System Data" in my id.txt file on API version "1.9.1".
I assume that by "ignore-warnings true" they mean "--ignore-errors true" .

------------------------------------------------------------------------------------------------------------------------------------
Command:
mgmt_cli show hosts domains-to-process "ALL_DOMAINS_ON_THIS_SERVER" filter "1.1.1.1" --format json --ignore-errors true -s id.txt

Output:
{
"code" : "generic_err_invalid_parameter",
"message" : "Parameter [domains-to-process] value is not valid"
}

------------------------------------------------------------------------------------------------------------------------------------

To me it seems like the parameter "domains-to-process" simply is not an option

Re: mgmt_cli: domains-to-process - Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER

PhoneBoy — Tue, 13 Aug 2024 14:27:45 GMT

ignore-warnings and ignore-errors are actually different things.
@Omer_Kleinstern any other ideas?

Re: mgmt_cli: domains-to-process - Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER

Omer_Kleinstern — Tue, 13 Aug 2024 15:00:14 GMT

Hi @abr ,

Since domains-to-process is a list, it should be something like this:
mgmt_cli show hosts domains-to-process.1 "ALL_DOMAINS_ON_THIS_SERVER" filter "1.1.1.1" ignore-warnings true --format json -s id.txt

Re: mgmt_cli: domains-to-process - Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER

Bob_Zimmerman — Tue, 13 Aug 2024 15:46:48 GMT

I can confirm this works, though in testing it I found what seems likely to be a bug in mgmt_cli's processing of session files. I'll open a ticket about that.

The "ignore-warnings" key doesn't appear in any of the API documentation I've checked, though I haven't checked exhaustively.

[Expert@MyMDS:0]# mgmt_cli -f json -d "MDS" -r true login >session.txt [Expert@MyMDS:0]# mgmt_cli -f json -s session.txt show hosts limit 2 domains-to-process.1 ALL_DOMAINS_ON_THIS_SERVER ignore-warnings true { "objects" : [ { "uid" : "08f0e998-b092-49ef-83cb-f56b367e4c5c", "name" : "SomeHost", "type" : "host", "domain" : { "uid" : "f538d6a9-dd21-40cc-b400-c758b2a05882", "name" : "CMA_1", "domain-type" : "domain" }, "ipv4-address" : "2.3.4.5", "icon" : "Objects/host", "color" : "black" }, { "uid" : "ccb0a948-c5ed-43e3-9e2f-f8aa331b3bcb", "name" : "SomeHost_2", "type" : "host", "domain" : { "uid" : "11415233-c3d4-4c3b-bc8b-6413ba75f64d", "name" : "CMA_2", "domain-type" : "domain" }, "ipv4-address" : "3.4.5.6", "icon" : "Objects/host", "color" : "black" } ], "from" : 1, "to" : 2, "total" : 55184 }

Note that this only makes sense on an MDS, and the "System Domain" is named "MDS".

It technically works on SmartCenters when you log in to the "System Data" domain, but a SmartCenter can only contain one domain, so there's no real point to doing it. You may as well log in to the functional domain directly.

Re: mgmt_cli: domains-to-process - Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER

abr — Wed, 14 Aug 2024 08:03:09 GMT

Hi @Omer_Kleinstern

Thanks for explaining this to me. Much appreciated!

I had no idea on how to "represent" a list with "strs" in the mgmt_cli. I tried all kinds of list formats. I had never guessed that it had to be represented using ".1"

I did not find any direct documentation on the "ignore-warnings true" in the documentation. It is stated to apply it to this command. Still it is not documented as an argument/option.

I think it might be helpfull for others if documentation was updated with an examples for "List: String" and "ignore-warnings true"

Re: mgmt_cli: domains-to-process - Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER

abr — Wed, 14 Aug 2024 07:58:52 GMT

@Bob_Zimmerman
Thanks for testing command and explaining the "System Domain" for MDS environments.

It make sense to use this for looking up hosts across domains within a MDS environment.

Help and input much appreciated!

Re: mgmt_cli: domains-to-process - Valid values are: CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER

jo-xxx — Thu, 31 Jul 2025 18:48:26 GMT

Btw when using REST domains-to-process is used like this:

POST {{server}}/show-groups
Content-Type: application/json
X-chkp-sid: {{session}}

{
  "filter" : "some-name",
  "ignore-warnings" : "true",
  "domains-to-process": ["ALL_DOMAINS_ON_THIS_SERVER"],
  "details-level" : "standard"
}