0 Replies Latest reply on Mar 2, 2015 4:08 PM by ziad1

    Exception after issuing a "qryExecuteDetail" call with all SELECT fields.

    ziad1

      I have a program that uses the Java SOAP API to issue event queries. The code flows as follows:

       

      1. Get all available select fields by calling qryGetSelectFields(EsmQueryType.EVENT, EsmQueryGroupType.NO_GROUP)
      2. Set up an EsmQueryConfig object, and pass it a specific time range, and all the fields fetched from step 1.
      3. Make an qryExecuteDetail call, with the config file from step 2.
      4. Wait until the query completes by polling qryGetStatus(id).isComplete().
      5. Retrieve the results by calling qryGetResults.

       

      The problem is, when passing all the select fields I get from step 1, I get the following exception when I reach step 4:

       

      com.mcafee.siem.api.v2.EsmException: null (65535)

          at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[na:1.7.0_25]

          at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessor Impl.java:57) ~[na:1.7.0_25]

          at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructor AccessorImpl.java:45) ~[na:1.7.0_25]

          at java.lang.reflect.Constructor.newInstance(Constructor.java:526) ~[na:1.7.0_25]

          at com.sun.xml.internal.ws.fault.SOAPFaultBuilder.createException(SOAPFaultBuilder .java:130) ~[na:1.7.0_25]

          at com.sun.xml.internal.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.j ava:108) ~[na:1.7.0_25]

          at com.sun.xml.internal.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.j ava:78) ~[na:1.7.0_25]

          at com.sun.xml.internal.ws.client.sei.SEIStub.invoke(SEIStub.java:129) ~[na:1.7.0_25]

          at com.sun.proxy.$Proxy35.qryGetStatus(Unknown Source) ~[na:na]

       

      If I pass a smaller number of fields to the qryExecuteDetail call (say 10-20 fields), then I do not get this exception.

       

      The exception message is quite vague. What does the 64k (65,535) number refer to here? Is that the maximum response size? Is this something that is configurable?

       

      Thanks,