Orchestrator Runbook Running….. but not.

I’ve had several customers come to me over the past few years complaining about one or more Runbooks showing that they are in a running state but they don’t show that there is any activity. Neither in the Log within the Runbook designer, nor in the console.


As you can see here the Runbook has been invoked and is in “Play” but there is no log data showing what step it is currently processing.



The thing that the Runbooks have in common are they are triggered from Service Requests within SCSM, usually from a Request Offering from the self-service portal.
On close inspection, it turns out that in passing properties to a Runbook the initialize data activity does not “Cleanse” the data and therefore any reserved characters are not protected by “” when used as input to the Runbook. So when a value gets passed that contains a character like &, > or <, the Orchestrator console try’s to interpret it as a command.


Don’t use &, < or > in any value that you pass to Orchestrator.

Within SCSM ensure any enumeration list or simple list that the end users may select from do not contain the &, < or > characters.

What gets harder is if the end user types this detail in to a free form text field. This you can prevent with a little >NET Regular Expression trickery.

On any text field that the end user will have free for them to enter text as they see fit that will be used to pass to a Runbook, use the following .NET Regular Expression filter to filter out any special characters:

^[a-zA-Z0-9~!@#$%*()-=+;:,.? ]+$




  1. Bruno Serafim

    Hi Brett,

    Thanks a lot for your post.
    In our case, I can confirm you that we have the same behavior if someone enters as a value of an user input.


  2. Bruno Serafim

    It isn’t displayed in the comment above but the value I’m talking about is smaller + greater than (different ).


      • Bruno Serafim

        Yes, a client put a sql query (with a condition where smaller+greater than <>) as the value of an user input and we get the same behavior with a related runbook.
        We can reproduce it as with the character you &.


  3. Bruno Serafim

    Thank you for your article 🙂
    Just a precision it’s the combination of the two symbols in this order <>. Not an or.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s