9.8 Netwitness Packet Decoder /sys node in REST API - fileEdit msg

[RSAAdmin]

Hello,

I'm having a heckuva time trying to get the NW REST API accept a config file update via the REST API.  The /sys node has a msg called "fileEdit" that appears to mimic is used in the SDK for these operations.  Looking at a pcap from the same function in the 9.8 Admin Client, the op "put" is used along with the appropriate filename, followed by the text you want the file to contain.  That's the most I can glean from the pcap and since it's the SDK instead of the REST API, things are obviously a bit different...

I know that when uploading a feed or parser, that node (parser/upload) takes POST data for the file contents.  I have that working just fine.  This /sys mnode does not accept POST data.  It does not accept any of the multitude of ways I've tried to send it the file contents... has anyone managed to make this work?  Is there another way to overwrite a config file via the REST API (index-decoder.xml, as an example)?

Thanks!

[RSAAdmin]

You should not be modifying index-decoder.xml.  If you want to POST index-decoder-custom.xml, then you need to send your file (using curl as an example) like this:

curl -u "admin:<password>" -H "Content-Type: application/octet-stream" --data @"/yourpath/index-decoder-custom.xml" -X POST "http://<hostname>:50104/sys?msg=fileEdit&op=put&filename=index-decoder-custom.xml"

Of course, replace the <password> and <hostname> with the proper substitutions.

HTHs,

Scott

[RSAAdmin]

I'm well aware of the -custom files, but this is 9.8, not 10.X.  In 9.8, the API does not recognize the -custom files as valid targets unless you copy them there manually first.  That is less than ideal... and either way, I only used that file as an example.  This question was not about which files are okay to modify but rather how to modify them.

That said, your post did contain some valuable info - the mime type application/octect-stream is the key to making this work.  For some reason that isn't necessary when uploading feeds/parsers but it is with this node.  So, thanks for the help!