Query when a command was last run



  • Hi Russ,

    Is there an API call to query when a command was last run?
    I could use the method below but was wondering if there is a better way to do it.

    # Replace COMMAND_ID and TOKEN with actual values
    https://www.triggercmd.com/api/run/list?status=Command+ran&command_id=COMMAND_ID&token=TOKEN
    

    Thanks,
    Mitch Razga


  • administrators

    @mitchell-razga, that's a good idea.

    I added an API endpoint for that. Is this good or do you want me to remove the extra fields?

    curl -k 'https://www.triggercmd.com/api/run/lastruntime?command_id=COMMAND_ID&token=TOKEN
    

    This is what the output looks like when when I pipe it to jq.

    {
      "records": [
        {
          "user": "167836262hd738j0002b7ue",
          "computer": "5abe93678273d100026349j",
          "command": "5abe97h2354cjf10002639k",
          "status": "Command ran",
          "createdAt": "2018-10-12T20:02:39.165Z",
          "updatedAt": "2018-10-12T20:02:39.165Z",
          "id": "5abe97df88d0f810005422a0"
        }
      ]
    }


  • @russ
    Thanks!
    If it reduces stress on your server you can remove the extra fields. I could use a regex anyway to just get the createdAt/updatedAt value so I don't really mind what the rest of the output is.

    Would it be possible to use the command name rather than the command id though? I've noticed that when editing commands they generate a new command id and I don't want to have to update my script with the new id every time.

    Thanks again!


  • administrators

    @mitchell-razga, take a look. I added the command info to the response.

    Also for what it's worth, there's an optional status parameter you can send. If you add "status=Trigger" in your URL parameters you'll see the latest "Trigger sent" entry instead of the latest "Command ran" entry.



  • @Russ
    I was thinking more along the lines of changing the request to be similar to the triggerSave API endpoint where it would use the computer name and the trigger name instead of the trigger id.

    Something like this

    # Replace COMPUTERNAME, TRIGGERNAME, STATUS and TOKEN with actual values
    https://www.triggercmd.com/api/run/lastruntime?computer=COMPUTERNAME&trigger=TRIGGERNAME&status=STATUS&token=TOKEN
    
    # e.g
    https://www.triggercmd.com/api/run/lastruntime?computer=Mitch-PC&trigger=CreateFile&status=Ran&token=1234567891011121314151617181920
    

    Output

    {
    "trigger": "CreateFile",
    "computer": "Mitch-PC",
    "parameters": "[names, docx]",
    "user": "167836262hd738j0002b7ue",
    "status": "Command ran",
    "createdAt": "2018-10-12T20:02:39.165Z",
    "updatedAt": "2018-10-12T20:02:39.165Z",
    "id": "5abe97df88d0f810005422a0"
    }
    

    I'm not sure if you track what parameters have been used but including this in the output could allow the last command to be repeated with the same parameters.


  • administrators

    @mitchell-razga, sorry I missed that.

    I changed it to take the trigger and computer parameters. Please try this:

    curl -k 'https://www.triggercmd.com/api/run/lastruntime?status=Command&trigger=TRIGGERNAME&computer=COMPUTERNAME&token=TOKEN' | jq
    

    Also, I don't track parameters at this point, but I could put it in the status field if that's helpful, like "Command ran with parameters: X Y Z"



  • @Russ
    This is exactly what i needed! Thanks very much!

    Yeah parameter tracking would be great but there's no rush to implement it. I'd mainly just use it for repeating triggers.


  • administrators

    @mitchell-razga, I added the parameters to the run status.


Log in to reply
 

Looks like your connection to TRIGGERcmd Forum was lost, please wait while we try to reconnect.