NetXMS Support Forum

Hello,

first I would like to thank you for the excellent and very useful system.

Now I need your help. Since server version 6.2, the setCustomAttribute function doesn't work in either the transformation or threshold script.
For example, I use $node.setCustomAttribute("a",5); which no longer works now. How should I use the function correctly?

Thank you in advance
Daniel

Hi,

setCustomAttribute is not broken, it is blocked on purpose. 6.2 added a server configuration parameter Scripts.RestrictWriteAccess, enabled by default on both new installations and in-place upgrades. With it enabled, transformation, threshold, filter and other "analysis" scripts run under a read-only security context and cannot modify objects.

Here's what's actually happening: the call is not rejected with a script error. setCustomAttribute just returns false and does nothing, so the script keeps running and returns its value as usual - that is why it looks like the function silently stopped working. Reading is not affected, getCustomAttribute in the same script still works. The integer value in your example is fine, numbers are accepted.

The restriction covers transformation scripts for both single-value and table DCIs, threshold scripts, script-type DCIs, macro expansion in DCI and object text, autobind filters, conditions, business service checks and prototype instance discovery, EPP filter and RCA scripts, asset property autofill, network map filter and link styling scripts, and SNMP trap transformation.

Simplest approach is to turn it off: Server Configuration -> Scripts.RestrictWriteAccess -> 0. It takes effect immediately, no server restart needed. Note that it is a global switch - it re-enables writes for every script type listed above, not just for your DCI.

If you prefer to keep the restriction on, move the write out of the transformation script. Server actions of type "execute server-side script" and poll hook scripts are not restricted, so a script invoked from an EPP rule can still set custom attributes.

To confirm this is what you are hitting, enable debug tag nxsl.security at level 7 - every blocked call logs "Read-only script access denied" with the object name and id.

Perfect, thank you for the explanation.