ceph-bluestore-tool

package: ceph-osd

title: ceph-bluestore-tool(8)

summary: bluestore administrative tool

text:
# ceph-bluestore-tool(8)

## NAME
ceph-bluestore-tool - bluestore administrative tool

## SYNOPSIS

```
ceph-bluestore-tool command
[ --dev device ... ]
[ -i osd_id ]
[ --path osd path ]
[ --out-dir dir ]
[ --log-file | -l filename ]
[ --deep ]
ceph-bluestore-tool fsck|repair --path osd path [ --deep ]
ceph-bluestore-tool qfsck       --path osd path
ceph-bluestore-tool allocmap    --path osd path
ceph-bluestore-tool restore_cfb --path osd path
ceph-bluestore-tool show-label --dev device ...
ceph-bluestore-tool prime-osd-dir --dev device --path osd path
ceph-bluestore-tool bluefs-export --path osd path --out-dir dir
ceph-bluestore-tool bluefs-bdev-new-wal --path osd path --dev-target new-device
ceph-bluestore-tool bluefs-bdev-new-db --path osd path --dev-target new-device
ceph-bluestore-tool bluefs-bdev-migrate --path osd path --dev-target new-device --devs-source device1 [--devs-source device2]
ceph-bluestore-tool free-dump|free-score --path osd path [ --allocator block/bluefs-wal/bluefs-db/bluefs-slow ]
ceph-bluestore-tool reshard --path osd path --sharding new sharding [ --sharding-ctrl control string ]
ceph-bluestore-tool show-sharding --path osd path
```

## DESCRIPTION
ceph-bluestore-tool is a utility to perform low-level administrative operations on a BlueStore instance.

## COMMANDS
help

show help

fsck [ --deep ]

run consistency check on BlueStore metadata. If --deep is specified, also read all object data and verify checksums.

repair

Run a consistency check and repair any errors we can.

qfsck

run consistency check on BlueStore metadata comparing allocator data (from RocksDB CFB when exists and if not uses allocation-file) with ONodes state.

allocmap

performs the same check done by qfsck and then stores a new allocation-file (command is disabled by default and requires a special build)

restore_cfb

Reverses changes done by the new NCB code (either through ceph restart or when running allocmap command) and restores RocksDB B Column-Family (allocator-map).

bluefs-export

Export the contents of BlueFS (i.e., RocksDB files) to an output directory.

bluefs-bdev-sizes --path osd path

Print the device sizes, as understood by BlueFS, to stdout.

bluefs-bdev-expand --path osd path

Instruct BlueFS to check the size of its block devices and, if they have expanded, make use of the additional space. Please note that only the new files created by BlueFS will be allocated on the preferred block device if it has enough free space, and the existing files that have spilled over to the slow device will be gradually removed when RocksDB performs compaction. In other words, if there is any data spilled over to the slow device, it will be moved to the fast device over time.

bluefs-bdev-new-wal --path osd path --dev-target new-device

Adds WAL device to BlueFS, fails if WAL device already exists.

bluefs-bdev-new-db --path osd path --dev-target new-device

Adds DB device to BlueFS, fails if DB device already exists.

bluefs-bdev-migrate --dev-target new-device --devs-source device1 [--devs-source device2]

Moves BlueFS data from source device(s) to the target one, source devices (except the main one) are removed on success. Target device can be both already attached or new device. In the latter case it's added to OSD replacing one of the source devices. Following replacement rules apply (in the order of precedence, stop on the first match):

- if source list has DB volume - target device replaces it.

- if source list has WAL volume - target device replace it.

- if source list has slow volume only - operation isn't permitted, requires explicit allocation via new-db/new-wal command.

show-label --dev device [...]

Show device label(s).

free-dump --path osd path [ --allocator block/bluefs-wal/bluefs-db/bluefs-slow ]

Dump all free regions in allocator.

free-score --path osd path [ --allocator block/bluefs-wal/bluefs-db/bluefs-slow ]

Give a [0-1] number that represents quality of fragmentation in allocator. 0 represents case when all free space is in one chunk. 1 represents worst possible fragmentation.

reshard --path osd path --sharding new sharding [ --resharding-ctrl control string ]

Changes sharding of BlueStore's RocksDB. Sharding is build on top of RocksDB column families. This option allows to test performance of new sharding without need to redeploy OSD. Resharding is usually a long process, which involves walking through entire RocksDB key space and moving some of them to different column families. Option --resharding-ctrl provides performance control over resharding process. Interrupted resharding will prevent OSD from running. Interrupted resharding does not corrupt data. It is always possible to continue previous resharding, or select any other sharding scheme, including reverting to original one.

show-sharding --path osd path

Show sharding that is currently applied to BlueStore's RocksDB.

## OPTIONS
--dev *device*

Add device to the list of devices to consider

-i *osd_id*

Operate as OSD osd_id. Connect to monitor for OSD specific options. If monitor is unavailable, add --no-mon-config to read from ceph.conf instead.

--devs-source *device*

Add device to the list of devices to consider as sources for migrate operation

--dev-target *device*

Specify target device migrate operation or device to add for adding new DB/WAL.

--path *osd path*

Specify an osd path. In most cases, the device list is inferred from the symlinks present in osd path. This is usually simpler than explicitly specifying the device(s) with --dev. Not necessary if -i osd_id is provided.

--out-dir *dir*

Output directory for bluefs-export

-l, --log-file *log file*

file to log to

--log-level *num*

debug log level. Default is 30 (extremely verbose), 20 is very verbose, 10 is verbose, and 1 is not very verbose.

--deep

deep scrub/repair (read and validate object data, not just metadata)

--allocator *name*

Useful for free-dump and free-score actions. Selects allocator(s).

--resharding-ctrl *control string*

Provides control over resharding process. Specifies how often refresh RocksDB iterator, and how large should commit batch be before committing to RocksDB. Option format is: <iterator_refresh_bytes>/<iterator_refresh_keys>/<batch_commit_bytes>/<batch_commit_keys> Default: 10000000/10000/1000000/1000

## ADDITIONAL CEPH.CONF OPTIONS
Any configuration option that is accepted by OSD can be also passed to ceph-bluestore-tool. Useful to provide necessary configuration options when access to monitor/ceph.conf is impossible and -i option cannot be used.

## DEVICE LABELS
Every BlueStore block device has a single block label at the beginning of the device. You can dump the contents of the label with:

```
ceph-bluestore-tool show-label --dev *device*
```

The main device will have a lot of metadata, including information that used to be stored in small files in the OSD data directory. The auxiliary devices (db and wal) will only have the minimum required fields (OSD UUID, size, device type, birth time).

## OSD DIRECTORY PRIMING
You can generate the content for an OSD data directory that can start up a BlueStore OSD with the prime-osd-dir command:

```
ceph-bluestore-tool prime-osd-dir --dev *main device* --path /var/lib/ceph/osd/ceph-*id*
```

## BLUEFS LOG RESCUE
Some versions of BlueStore were susceptible to BlueFS log growing extremely large - beyond the point of making booting OSD impossible. This state is indicated by booting that takes very long and fails in _replay function.

This can be fixed by::

ceph-bluestore-tool fsck --path osd path --bluefs_replay_recovery=true

It is advised to first check if rescue process would be successful::

ceph-bluestore-tool fsck --path osd path --bluefs_replay_recovery=true --bluefs_replay_recovery_disable_compact=true

If above fsck is successful fix procedure can be applied.

## AVAILABILITY
ceph-bluestore-tool is part of Ceph, a massively scalable, open-source, distributed storage system. Please refer to the Ceph documentation at https://docs.ceph.com for more information.

## SEE ALSO
ceph-osd(8)

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


ceph-clsinfo

title: ceph-clsinfo(8)

summary: show class object information

text:
# ceph-clsinfo(8)

## NAME
ceph-clsinfo - show class object information

## SYNOPSIS

```
ceph-clsinfo [ options ] ... filename
```

## DESCRIPTION
ceph-clsinfo can show name, version, and architecture information about a specific class object.

## OPTIONS
-n, --name

Shows the class name

-v, --version

Shows the class version

-a, --arch

Shows the class architecture

## AVAILABILITY
ceph-clsinfo is part of Ceph, a massively scalable, open-source, distributed storage system. Please refer to the Ceph documentation at https://docs.ceph.com for more information.

## SEE ALSO
ceph(8)

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


ceph-osd

title: ceph-osd(8)

summary: ceph object storage daemon

text:
# ceph-osd(8)

## NAME
ceph-osd - ceph object storage daemon

## SYNOPSIS

```
ceph-osd -i osdnum [ --osd-data datapath ] [ --osd-journal
journal ] [ --mkfs ] [ --mkjournal ] [--flush-journal] [--check-allows-journal] [--check-wants-journal] [--check-needs-journal] [ --mkkey ] [ --osdspec-affinity ]
```

## DESCRIPTION
ceph-osd is the object storage daemon for the Ceph distributed file system. It is responsible for storing objects on a local file system and providing access to them over the network.

The datapath argument should be a directory on a xfs file system where the object data resides. The journal is optional, and is only useful performance-wise when it resides on a different disk than datapath with low latency (ideally, an NVRAM device).

## OPTIONS
-f, --foreground

Foreground: do not daemonize after startup (run in foreground). Do not generate a pid file. Useful when run via ceph-run(8).

-d

Debug mode: like -f, but also send all log output to stderr.

--setuser userorgid

Set uid after starting. If a username is specified, the user record is looked up to get a uid and a gid, and the gid is also set as well, unless --setgroup is also specified.

--setgroup grouporgid

Set gid after starting. If a group name is specified the group record is looked up to get a gid.

--osd-data osddata

Use object store at osddata.

--osd-journal journal

Journal updates to journal.

--check-wants-journal

Check whether a journal is desired.

--check-allows-journal

Check whether a journal is allowed.

--check-needs-journal

Check whether a journal is required.

--mkfs

Create an empty object repository. This also initializes the journal (if one is defined).

--mkkey

Generate a new secret key. This is normally used in combination with --mkfs as it is more convenient than generating a key by hand with ceph-authtool(8).

--mkjournal

Create a new journal file to match an existing object repository. This is useful if the journal device or file is wiped out due to a disk or file system failure.

--flush-journal

Flush the journal to permanent store. This runs in the foreground so you know when it's completed. This can be useful if you want to resize the journal or need to otherwise destroy it: this guarantees you won't lose data.

--get-cluster-fsid

Print the cluster fsid (uuid) and exit.

--get-osd-fsid

Print the OSD's fsid and exit. The OSD's uuid is generated at --mkfs time and is thus unique to a particular instantiation of this OSD.

--get-journal-fsid

Print the journal's uuid. The journal fsid is set to match the OSD fsid at --mkfs time.

-c ceph.conf, --conf=ceph.conf

Use ceph.conf configuration file instead of the default /etc/ceph/ceph.conf for runtime configuration options.

-m monaddress[:port]

Connect to specified monitor (instead of looking through ceph.conf).

--osdspec-affinity

Set an affinity to a certain OSDSpec. This option can only be used in conjunction with --mkfs.

## AVAILABILITY
ceph-osd is part of Ceph, a massively scalable, open-source, distributed storage system. Please refer to the Ceph documentation at https://docs.ceph.com for more information.

## SEE ALSO
ceph(8), ceph-mds(8), ceph-mon(8), ceph-authtool(8)

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


ceph-diff-sorted

package: ceph-radosgw

title: ceph-diff-sorted(8)

summary: compare two sorted files line by line

text:
# ceph-diff-sorted(8)

## NAME
ceph-diff-sorted - compare two sorted files line by line

## SYNOPSIS

```
ceph-diff-sorted file1 file2
```

## DESCRIPTION
ceph-diff-sorted is a simplified diff utility optimized for comparing two files with lines that are lexically sorted.

The output is simplified in comparison to that of the standard diff tool available in POSIX systems. Angle brackets ('<' and '>') are used to show lines that appear in one file but not the other. The output is not compatible with the patch tool.

This tool was created in order to perform diffs of large files (e.g., containing billions of lines) that the standard diff tool cannot handle efficiently. Knowing that the lines are sorted allows this to be done efficiently with minimal memory overhead.

The sorting of each file needs to be done lexcially. Most POSIX systems use the LANG environment variable to determine the sort tool's sorting order. To sort lexically we would need something such as:

$ LANG=C sort some-file.txt >some-file-sorted.txt

## EXAMPLES
Compare two files:

```
$ ceph-diff-sorted fileA.txt fileB.txt
```

## EXIT STATUS
When complete, the exit status will be set to one of the following:

0

files same

1

files different

2

usage problem (e.g., wrong number of command-line arguments)

3

problem opening input file

4

bad file content (e.g., unsorted order or empty lines)

## AVAILABILITY
ceph-diff-sorted is part of Ceph, a massively scalable, open-source, distributed storage system. Please refer to the Ceph documentation at https://docs.ceph.com for more information.

## SEE ALSO
rgw-orphan-list(8)

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


radosgw

title: radosgw(8)

summary: rados REST gateway

text:
# radosgw(8)

## NAME
radosgw - rados REST gateway

## SYNOPSIS

```
radosgw
```

## DESCRIPTION
radosgw is an HTTP REST gateway for the RADOS object store, a part of the Ceph distributed storage system. It is implemented as a FastCGI module using libfcgi, and can be used in conjunction with any FastCGI capable web server.

## OPTIONS
-c ceph.conf, --conf=ceph.conf

Use ceph.conf configuration file instead of the default /etc/ceph/ceph.conf to determine monitor addresses during startup.

-m monaddress[:port]

Connect to specified monitor (instead of looking through ceph.conf).

-i ID, --id ID

Set the ID portion of name for radosgw

-n TYPE.ID, --name TYPE.ID

Set the rados user name for the gateway (eg. client.radosgw.gateway)

--cluster NAME

Set the cluster name (default: ceph)

-d

Run in foreground, log to stderr

-f

Run in foreground, log to usual location

--rgw-region=region

The region where radosgw runs

--rgw-zone=zone

The zone where radosgw runs

## CONFIGURATION
Earlier RADOS Gateway had to be configured with Apache and mod_fastcgi. Now, mod_proxy_fcgi module is used instead of mod_fastcgi. mod_proxy_fcgi works differently than a traditional FastCGI module. This module requires the service of mod_proxy which provides support for the FastCGI protocol. So, to be able to handle FastCGI protocol, both mod_proxy and mod_proxy_fcgi have to be present in the server. Unlike mod_fastcgi, mod_proxy_fcgi cannot start the application process. Some platforms have fcgistarter for that purpose. However, external launching of application or process management may be available in the FastCGI application framework in use.

Apache must be configured in a way that enables mod_proxy_fcgi to be used with localhost tcp.

The following steps show the configuration in Ceph's configuration file i.e, /etc/ceph/ceph.conf and the gateway configuration file i.e, /etc/httpd/conf.d/rgw.conf (RPM-based distros) or /etc/apache2/conf-available/rgw.conf (Debian-based distros) with localhost tcp:

1.

For distros with Apache 2.2 and early versions of Apache 2.4 that use localhost TCP, append the following contents to /etc/ceph/ceph.conf:

```
[client.radosgw.gateway]
host = {hostname}
keyring = /etc/ceph/ceph.client.radosgw.keyring
log_file = /var/log/ceph/client.radosgw.gateway.log
rgw_frontends = fastcgi socket_port=9000 socket_host=0.0.0.0
rgw_print_continue = false
```

2.

Add the following content in the gateway configuration file: For Debian/Ubuntu add in /etc/apache2/conf-available/rgw.conf:

```
<VirtualHost *:80>
ServerName localhost
DocumentRoot /var/www/html
ErrorLog /var/log/apache2/rgw_error.log
CustomLog /var/log/apache2/rgw_access.log combined
# LogLevel debug
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
SetEnv proxy-nokeepalive 1
ProxyPass / fcgi://localhost:9000/
</VirtualHost>
```

For CentOS/RHEL add in /etc/httpd/conf.d/rgw.conf:

```
<VirtualHost *:80>
ServerName localhost
DocumentRoot /var/www/html
ErrorLog /var/log/httpd/rgw_error.log
CustomLog /var/log/httpd/rgw_access.log combined
# LogLevel debug
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
SetEnv proxy-nokeepalive 1
ProxyPass / fcgi://localhost:9000/
</VirtualHost>
```

3.

Add the following content in the gateway configuration file: For CentOS/RHEL add in /etc/httpd/conf.d/rgw.conf:

```
<VirtualHost *:80>
ServerName localhost
DocumentRoot /var/www/html
ErrorLog /var/log/httpd/rgw_error.log
CustomLog /var/log/httpd/rgw_access.log combined
# LogLevel debug
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
SetEnv proxy-nokeepalive 1
ProxyPass / unix:///var/run/ceph/ceph.radosgw.gateway.fastcgi.sock|fcgi://localhost:9000/
</VirtualHost>
```

4.

Generate a key for radosgw to use for authentication with the cluster.

```
ceph-authtool -C -n client.radosgw.gateway --gen-key /etc/ceph/keyring.radosgw.gateway
ceph-authtool -n client.radosgw.gateway --cap mon 'allow rw' --cap osd 'allow rwx' /etc/ceph/keyring.radosgw.gateway
```

5.

Add the key to the auth entries.

```
ceph auth add client.radosgw.gateway --in-file=keyring.radosgw.gateway
```

6.

Start Apache and radosgw. Debian/Ubuntu:

```
sudo /etc/init.d/apache2 start
sudo /etc/init.d/radosgw start
```

CentOS/RHEL:

```
sudo apachectl start
sudo /etc/init.d/ceph-radosgw start
```

## USAGE LOGGING
radosgw maintains an asynchronous usage log. It accumulates statistics about user operations and flushes it periodically. The logs can be accessed and managed through radosgw-admin.

The information that is being logged contains total data transfer, total operations, and total successful operations. The data is being accounted in an hourly resolution under the bucket owner, unless the operation was done on the service (e.g., when listing a bucket) in which case it is accounted under the operating user.

Following is an example configuration:

```
[client.radosgw.gateway]

    rgw enable usage log = true

    rgw usage log tick interval = 30

    rgw usage log flush threshold = 1024

    rgw usage max shards = 32

    rgw usage max user shards = 1
```

The total number of shards determines how many total objects hold the usage log information. The per-user number of shards specify how many objects hold usage information for a single user. The tick interval configures the number of seconds between log flushes, and the flush threshold specify how many entries can be kept before resorting to synchronous flush.

## AVAILABILITY
radosgw is part of Ceph, a massively scalable, open-source, distributed storage system. Please refer to the Ceph documentation at https://docs.ceph.com for more information.

## SEE ALSO
ceph(8) radosgw-admin(8)

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


rgw-orphan-list

title: rgw-orphan-list(8)

text:
# rgw-orphan-list(8)

## NAME
rgw-orphan-list - list rados objects that are not indexed by rgw

## SYNOPSIS

```
rgw-orphan-list
```

## DESCRIPTION
rgw-orphan-list is an EXPERIMENTAL RADOS gateway user administration utility. It produces a listing of rados objects that are not directly or indirectly referenced through the bucket indexes on a pool. It places the results and intermediate files on the local filesystem rather than on the ceph cluster itself, and therefore will not itself consume additional cluster storage.

In theory orphans should not exist. However because ceph evolves rapidly, bugs do crop up, and they may result in orphans that are left behind.

In its current form this utility does not take any command-line arguments or options. It will list the available pools and prompt the user to enter the pool they would like to list orphans for.

Behind the scenes it runs rados ls and radosgw-admin bucket radoslist ... and produces a list of those entries that appear in the former but not the latter. Those entries are presumed to be the orphans.

## WARNINGS
This utility is currently considered EXPERIMENTAL.

This utility will produce false orphan entries for unindexed buckets since such buckets have no bucket indices that can provide the starting point for tracing.

## OPTIONS
At present there are no options.

## EXAMPLES
Launch the tool:

```
$ rgw-orphan-list
```

## AVAILABILITY
radosgw-admin is part of Ceph, a massively scalable, open-source, distributed storage system. Please refer to the Ceph documentation at https://docs.ceph.com for more information.

## SEE ALSO
radosgw-admin(8) ceph-diff-sorted(8)

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


ceph-volume

package: ceph-volume

title: ceph-volume(8)

summary: Ceph OSD deployment and inspection tool

text:
# ceph-volume(8)

## NAME
ceph-volume - Ceph OSD deployment and inspection tool

## SYNOPSIS
ceph-volume [-h] [--cluster CLUSTER] [--log-level LOG_LEVEL] [--log-path LOG_PATH]

ceph-volume inventory

ceph-volume lvm [ trigger | create | activate | prepare | zap | list | batch | new-wal | new-db | migrate ]

ceph-volume simple [ trigger | scan | activate ]

## DESCRIPTION
ceph-volume is a single purpose command line tool to deploy logical volumes as OSDs, trying to maintain a similar API to ceph-disk when preparing, activating, and creating OSDs.

It deviates from ceph-disk by not interacting or relying on the udev rules that come installed for Ceph. These rules allow automatic detection of previously setup devices that are in turn fed into ceph-disk to activate them.

## COMMANDS

### inventory
This subcommand provides information about a host's physical disc inventory and reports metadata about these discs. Among this metadata one can find disc specific data items (like model, size, rotational or solid state) as well as data items specific to ceph using a device, such as if it is available for use with ceph or if logical volumes are present.

Examples:

```
ceph-volume inventory
ceph-volume inventory /dev/sda
ceph-volume inventory --format json-pretty
```

Optional arguments:

-h, --help

show the help message and exit

--format

report format, valid values are plain (default), json and json-pretty

### lvm
By making use of LVM tags, the lvm sub-command is able to store and later re-discover and query devices associated with OSDs so that they can later activated.

Subcommands:

### batch
Creates OSDs from a list of devices using a filestore or bluestore (default) setup. It will create all necessary volume groups and logical volumes required to have a working OSD.

Example usage with three devices:

```
ceph-volume lvm batch --bluestore /dev/sda /dev/sdb /dev/sdc
```

Optional arguments:

-h, --help

show the help message and exit

--bluestore

Use the bluestore objectstore (default)

--filestore

Use the filestore objectstore

--yes

Skip the report and prompt to continue provisioning

--prepare

Only prepare OSDs, do not activate

--dmcrypt

Enable encryption for the underlying OSD devices

--crush-device-class

Define a CRUSH device class to assign the OSD to

--no-systemd

Do not enable or create any systemd units

--osds-per-device

Provision more than 1 (the default) OSD per device

--report

Report what the potential outcome would be for the current input (requires devices to be passed in)

--format

Output format when reporting (used along with --report), can be one of 'pretty' (default) or 'json'

--block-db-size

Set (or override) the "bluestore_block_db_size" value, in bytes

--journal-size

Override the "osd_journal_size" value, in megabytes

Required positional arguments:

<DEVICE>

Full path to a raw device, like /dev/sda. Multiple <DEVICE> paths can be passed in.

### activate
Enables a systemd unit that persists the OSD ID and its UUID (also called fsid in Ceph CLI tools), so that at boot time it can understand what OSD is enabled and needs to be mounted.

Usage:

```
ceph-volume lvm activate --bluestore <osd id> <osd fsid>
```

Optional Arguments:

-h, --help

show the help message and exit

--auto-detect-objectstore

Automatically detect the objectstore by inspecting the OSD

--bluestore

bluestore objectstore (default)

--filestore

filestore objectstore

--all

Activate all OSDs found in the system

--no-systemd

Skip creating and enabling systemd units and starting of OSD services

Multiple OSDs can be activated at once by using the (idempotent) --all flag:

```
ceph-volume lvm activate --all
```

### prepare
Prepares a logical volume to be used as an OSD and journal using a filestore or bluestore (default) setup. It will not create or modify the logical volumes except for adding extra metadata.

Usage:

```
ceph-volume lvm prepare --filestore --data <data lv> --journal <journal device>
```

Optional arguments:

-h, --help

show the help message and exit

--journal JOURNAL

logical group name, path to a logical volume, or path to a device

--bluestore

Use the bluestore objectstore (default)

--block.wal

Path to a bluestore block.wal logical volume or partition

--block.db

Path to a bluestore block.db logical volume or partition

--filestore

Use the filestore objectstore

--dmcrypt

Enable encryption for the underlying OSD devices

--osd-id OSD_ID

Reuse an existing OSD id

--osd-fsid OSD_FSID

Reuse an existing OSD fsid

--crush-device-class

Define a CRUSH device class to assign the OSD to

Required arguments:

--data

A logical group name or a path to a logical volume

For encrypting an OSD, the --dmcrypt flag must be added when preparing (also supported in the create sub-command).

### create
Wraps the two-step process to provision a new osd (calling prepare first and then activate) into a single one. The reason to prefer prepare and then activate is to gradually introduce new OSDs into a cluster, and avoiding large amounts of data being rebalanced.

The single-call process unifies exactly what prepare and activate do, with the convenience of doing it all at once. Flags and general usage are equivalent to those of the prepare and activate subcommand.

### trigger
This subcommand is not meant to be used directly, and it is used by systemd so that it proxies input to ceph-volume lvm activate by parsing the input from systemd, detecting the UUID and ID associated with an OSD.

Usage:

```
ceph-volume lvm trigger <SYSTEMD-DATA>
```

The systemd "data" is expected to be in the format of:

```
<OSD ID>-<OSD UUID>
```

The lvs associated with the OSD need to have been prepared previously, so that all needed tags and metadata exist.

Positional arguments:

<SYSTEMD_DATA>

Data from a systemd unit containing ID and UUID of the OSD.

### list
List devices or logical volumes associated with Ceph. An association is determined if a device has information relating to an OSD. This is verified by querying LVM's metadata and correlating it with devices.

The lvs associated with the OSD need to have been prepared previously by ceph-volume so that all needed tags and metadata exist.

Usage:

```
ceph-volume lvm list
```

List a particular device, reporting all metadata about it:

```
ceph-volume lvm list /dev/sda1
```

List a logical volume, along with all its metadata (vg is a volume group, and lv the logical volume name):

```
ceph-volume lvm list {vg/lv}
```

Positional arguments:

<DEVICE>

Either in the form of vg/lv for logical volumes, /path/to/sda1 or /path/to/sda for regular devices.

### zap
Zaps the given logical volume or partition. If given a path to a logical volume it must be in the format of vg/lv. Any file systems present on the given lv or partition will be removed and all data will be purged.

However, the lv or partition will be kept intact.

Usage, for logical volumes:

```
ceph-volume lvm zap {vg/lv}
```

Usage, for logical partitions:

```
ceph-volume lvm zap /dev/sdc1
```

For full removal of the device use the --destroy flag (allowed for all device types):

```
ceph-volume lvm zap --destroy /dev/sdc1
```

Multiple devices can be removed by specifying the OSD ID and/or the OSD FSID:

```
ceph-volume lvm zap --destroy --osd-id 1
ceph-volume lvm zap --destroy --osd-id 1 --osd-fsid C9605912-8395-4D76-AFC0-7DFDAC315D59
```

Positional arguments:

<DEVICE>

Either in the form of vg/lv for logical volumes, /path/to/sda1 or /path/to/sda for regular devices.

### new-wal
Attaches the given logical volume to OSD as a WAL. Logical volume name format is vg/lv. Fails if OSD has already got attached WAL.

Usage:

```
ceph-volume lvm new-wal --osd-id OSD_ID --osd-fsid OSD_FSID --target <target lv>
```

Optional arguments:

-h, --help

show the help message and exit

--no-systemd

Skip checking OSD systemd unit

Required arguments:

--target

logical volume name to attach as WAL

### new-db
Attaches the given logical volume to OSD as a DB. Logical volume name format is vg/lv. Fails if OSD has already got attached DB.

Usage:

```
ceph-volume lvm new-db --osd-id OSD_ID --osd-fsid OSD_FSID --target <target lv>
```

Optional arguments:

-h, --help

show the help message and exit

--no-systemd

Skip checking OSD systemd unit

Required arguments:

--target

logical volume name to attach as DB

### migrate
Moves BlueFS data from source volume(s) to the target one, source volumes (except the main, i.e. data or block one) are removed on success. LVM volumes are permitted for Target only, both already attached or new one. In the latter case it is attached to the OSD replacing one of the source devices. Following replacement rules apply (in the order of precedence, stop on the first match):

- if source list has DB volume - target device replaces it.

- if source list has WAL volume - target device replace it.

- if source list has slow volume only - operation is not permitted, requires explicit allocation via new-db/new-wal command.

Usage:

```
ceph-volume lvm migrate --osd-id OSD_ID --osd-fsid OSD_FSID --target <target lv> --from {data|db|wal} [{data|db|wal} ...]
```

Optional arguments:

-h, --help

show the help message and exit

--no-systemd

Skip checking OSD systemd unit

Required arguments:

--from

list of source device type names

--target

logical volume to move data to

### simple
Scan legacy OSD directories or data devices that may have been created by ceph-disk, or manually.

Subcommands:

### activate
Enables a systemd unit that persists the OSD ID and its UUID (also called fsid in Ceph CLI tools), so that at boot time it can understand what OSD is enabled and needs to be mounted, while reading information that was previously created and persisted at /etc/ceph/osd/ in JSON format.

Usage:

```
ceph-volume simple activate --bluestore <osd id> <osd fsid>
```

Optional Arguments:

-h, --help

show the help message and exit

--bluestore

bluestore objectstore (default)

--filestore

filestore objectstore

NOTE:

It requires a matching JSON file with the following format:

```
/etc/ceph/osd/<osd id>-<osd fsid>.json
```

### scan
Scan a running OSD or data device for an OSD for metadata that can later be used to activate and manage the OSD with ceph-volume. The scan method will create a JSON file with the required information plus anything found in the OSD directory as well.

Optionally, the JSON blob can be sent to stdout for further inspection.

Usage on all running OSDs:

```
ceph-volume simple scan
```

Usage on data devices:

```
ceph-volume simple scan <data device>
```

Running OSD directories:

```
ceph-volume simple scan <path to osd dir>
```

Optional arguments:

-h, --help

show the help message and exit

--stdout

Send the JSON blob to stdout

--force

If the JSON file exists at destination, overwrite it

Optional Positional arguments:

<DATA DEVICE or OSD DIR>

Actual data partition or a path to the running OSD

### trigger
This subcommand is not meant to be used directly, and it is used by systemd so that it proxies input to ceph-volume simple activate by parsing the input from systemd, detecting the UUID and ID associated with an OSD.

Usage:

```
ceph-volume simple trigger <SYSTEMD-DATA>
```

The systemd "data" is expected to be in the format of:

```
<OSD ID>-<OSD UUID>
```

The JSON file associated with the OSD need to have been persisted previously by a scan (or manually), so that all needed metadata can be used.

Positional arguments:

<SYSTEMD_DATA>

Data from a systemd unit containing ID and UUID of the OSD.

## AVAILABILITY
ceph-volume is part of Ceph, a massively scalable, open-source, distributed storage system. Please refer to the documentation at http://docs.ceph.com/ for more information.

## SEE ALSO
ceph-osd(8),

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


ceph-volume-systemd

title: ceph-volume-systemd(8)

summary: systemd ceph-volume helper tool

text:
# ceph-volume-systemd(8)

## NAME
ceph-volume-systemd - systemd ceph-volume helper tool

## SYNOPSIS

```
ceph-volume-systemd systemd instance name
```

## DESCRIPTION
ceph-volume-systemd is a systemd helper tool that receives input from (dynamically created) systemd units so that activation of OSDs can proceed.

It translates the input into a system call to ceph-volume for activation purposes only.

## EXAMPLES
Its input is the systemd instance name (represented by %i in a systemd unit), and it should be in the following format:

```
<ceph-volume subcommand>-<extra metadata>
```

In the case of lvm a call could look like:

```
/usr/bin/ceph-volume-systemd lvm-0-8715BEB4-15C5-49DE-BA6F-401086EC7B41
```

Which in turn will call ceph-volume in the following way:

```
ceph-volume lvm trigger  0-8715BEB4-15C5-49DE-BA6F-401086EC7B41
```

Any other subcommand will need to have implemented a trigger command that can consume the extra metadata in this format.

## AVAILABILITY
ceph-volume-systemd is part of Ceph, a massively scalable, open-source, distributed storage system. Please refer to the documentation at http://docs.ceph.com/ for more information.

## SEE ALSO
ceph-osd(8),

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


cephadm

package: cephadm

title: cephadm(8)

summary: manage the local cephadm host

text:
# cephadm(8)

## NAME
cephadm - manage the local cephadm host

## SYNOPSIS

```
cephadm** [-h] [--image IMAGE] [--docker] [--data-dir DATA_DIR]

[--log-dir LOG_DIR] [--logrotate-dir LOGROTATE_DIR]
[--unit-dir UNIT_DIR] [--verbose] [--timeout TIMEOUT]
[--retry RETRY] [--no-container-init]
{version,pull,inspect-image,ls,list-networks,adopt,rm-daemon,rm-cluster,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,prepare-host,add-repo,rm-repo,install}
...
```

```
cephadm pull
```

```
cephadm inspect-image
```

```
cephadm ls [-h] [--no-detail] [--legacy-dir LEGACY_DIR]
```

```
cephadm list-networks
```

```
cephadm adopt [-h] --name NAME --style STYLE [--cluster CLUSTER]

[--legacy-dir LEGACY_DIR] [--config-json CONFIG_JSON]
[--skip-firewalld] [--skip-pull]
```

```
cephadm rm-daemon [-h] --name NAME --fsid FSID [--force]

[--force-delete-data]
```

```
cephadm rm-cluster [-h] --fsid FSID [--force]
```

```
cephadm run [-h] --name NAME --fsid FSID
```

```
cephadm shell [-h] [--fsid FSID] [--name NAME] [--config CONFIG]
[--keyring KEYRING] --mount [MOUNT [MOUNT ...]] [--env ENV]
[--] [command [command ...]]
```

```
cephadm enter [-h] [--fsid FSID] --name NAME [command [command ...]]
```

```
cephadm ceph-volume [-h] [--fsid FSID] [--config-json CONFIG_JSON]
[--config CONFIG] [--keyring KEYRING]
command [command ...]
```

```
cephadm unit  [-h] [--fsid FSID] --name NAME command
```

```
cephadm logs [-h] [--fsid FSID] --name NAME [command [command ...]]
```

```
cephadm bootstrap [-h] [--config CONFIG] [--mon-id MON_ID]

[--mon-addrv MON_ADDRV] [--mon-ip MON_IP]
[--mgr-id MGR_ID] [--fsid FSID]
[--log-to-file] [--single-host-defaults]
[--output-dir OUTPUT_DIR]
[--output-keyring OUTPUT_KEYRING]
[--output-config OUTPUT_CONFIG]
[--output-pub-ssh-key OUTPUT_PUB_SSH_KEY]
[--skip-ssh]
[--initial-dashboard-user INITIAL_DASHBOARD_USER]
[--initial-dashboard-password INITIAL_DASHBOARD_PASSWORD]
[--ssl-dashboard-port SSL_DASHBOARD_PORT]
[--dashboard-key DASHBOARD_KEY]
[--dashboard-crt DASHBOARD_CRT]
[--ssh-config SSH_CONFIG]
[--ssh-private-key SSH_PRIVATE_KEY]
[--ssh-public-key SSH_PUBLIC_KEY]
[--ssh-user SSH_USER] [--skip-mon-network]
[--skip-dashboard] [--dashboard-password-noupdate]
[--no-minimize-config] [--skip-ping-check]
[--skip-pull] [--skip-firewalld] [--allow-overwrite]
[--allow-fqdn-hostname] [--skip-prepare-host]
[--orphan-initial-daemons] [--skip-monitoring-stack]
[--apply-spec APPLY_SPEC]
[--registry-url REGISTRY_URL]
[--registry-username REGISTRY_USERNAME]
[--registry-password REGISTRY_PASSWORD]
[--registry-json REGISTRY_JSON]
```

```
cephadm deploy [-h] --name NAME --fsid FSID [--config CONFIG]

[--config-json CONFIG_JSON] [--keyring KEYRING]
[--key KEY] [--osd-fsid OSD_FSID] [--skip-firewalld]
[--tcp-ports TCP_PORTS] [--reconfig] [--allow-ptrace]
```

```
cephadm check-host [-h] [--expect-hostname EXPECT_HOSTNAME]
```

```
cephadm prepare-host
```

```
cephadm add-repo [-h] [--release RELEASE] [--version VERSION]

[--dev DEV] [--dev-commit DEV_COMMIT]
[--gpg-url GPG_URL] [--repo-url REPO_URL]
```

```
cephadm rm-repo
```

```
cephadm install [-h] [packages [packages ...]]
```

```
cephadm registry-login [-h] [--registry-url REGISTRY_URL]

[--registry-username REGISTRY_USERNAME]
[--registry-password REGISTRY_PASSWORD]
[--registry-json REGISTRY_JSON] [--fsid FSID]
```

## DESCRIPTION
cephadm is a command line tool to manage the local host for the cephadm orchestrator.

It provides commands to investigate and modify the state of the current host.

cephadm is not required on all hosts, but useful when investigating a particular daemon.

## OPTIONS
--image IMAGE

container image. Can also be set via the "CEPHADM_IMAGE" env var (default: None)

--docker

use docker instead of podman (default: False)

--data-dir DATA_DIR

base directory for daemon data (default: /var/lib/ceph)

--log-dir LOG_DIR

base directory for daemon logs (default: /var/log/ceph)

--logrotate-dir LOGROTATE_DIR

location of logrotate configuration files (default: /etc/logrotate.d)

--unit-dir UNIT_DIR

base directory for systemd units (default: /etc/systemd/system)

--verbose, -v

Show debug-level log messages (default: False)

--timeout TIMEOUT

timeout in seconds (default: None)

--retry RETRY

max number of retries (default: 10)

--no-container-init

do not run podman/docker with --init (default: False)

## COMMANDS

### add-repo
configure local package repository to also include the ceph repository.

Arguments:

- [--release RELEASE] use latest version of a named release (e.g., octopus)

- [--version VERSION] use specific upstream version (x.y.z)

- [--dev DEV] use specified bleeding edge build from git branch or tag

- [--dev-commit DEV_COMMIT] use specified bleeding edge build from git commit

- [--gpg-url GPG_URL] specify alternative GPG key location

- [--repo-url REPO_URL] specify alternative repo location

### adopt
Adopt a daemon deployed with a different deployment tool.

Arguments:

- [--name NAME, -n NAME] daemon name (type.id)

- [--style STYLE] deployment style (legacy, ...)

- [--cluster CLUSTER] cluster name

- [--legacy-dir LEGACY_DIR] base directory for legacy daemon data

- [--config-json CONFIG_JSON] Additional configuration information in JSON format

- [--skip-firewalld] Do not configure firewalld

- [--skip-pull] do not pull the latest image before adopting

Configuration:

When starting the shell, cephadm looks for configuration in the following order. Only the first values found are used:

1.

An explicit, user provided path to a config file (-c/--config option)

2.

Config file for daemon specified with --name parameter (/var/lib/ceph/<fsid>/<daemon-name>/config)

3.

/var/lib/ceph/<fsid>/config/ceph.conf if it exists

4.

The config file for a mon daemon (/var/lib/ceph/<fsid>/mon.<mon-id>/config) if it exists

5.

Finally: fallback to the default file /etc/ceph/ceph.conf

### bootstrap
Bootstrap a cluster on the local host. It deploys a MON and a MGR and then also automatically deploys the monitoring stack on this host (see --skip-monitoring-stack) and calls ceph orch host add $(hostname) (see --skip-ssh).

Arguments:

- [--config CONFIG, -c CONFIG] ceph conf file to incorporate

- [--mon-id MON_ID] mon id (default: local hostname)

- [--mon-addrv MON_ADDRV] mon IPs (e.g., [v2:localipaddr:3300,v1:localipaddr:6789])

- [--mon-ip MON_IP] mon IP

- [--mgr-id MGR_ID] mgr id (default: randomly generated)

- [--fsid FSID] cluster FSID

- [--log-to-file] configure cluster to log to traditional log files

- [--single-host-defaults] configure cluster to run on a single host

- [--output-dir OUTPUT_DIR] directory to write config, keyring, and pub key files

- [--output-keyring OUTPUT_KEYRING] location to write keyring file with new cluster admin and mon keys

- [--output-config OUTPUT_CONFIG] location to write conf file to connect to new cluster

- [--output-pub-ssh-key OUTPUT_PUB_SSH_KEY] location to write the cluster's public SSH key

- [--skip-ssh skip setup of ssh key on local host

- [--initial-dashboard-user INITIAL_DASHBOARD_USER] Initial user for the dashboard

- [--initial-dashboard-password INITIAL_DASHBOARD_PASSWORD] Initial password for the initial dashboard user

- [--ssl-dashboard-port SSL_DASHBOARD_PORT] Port number used to connect with dashboard using SSL

- [--dashboard-key DASHBOARD_KEY] Dashboard key

- [--dashboard-crt DASHBOARD_CRT] Dashboard certificate

- [--ssh-config SSH_CONFIG] SSH config

- [--ssh-private-key SSH_PRIVATE_KEY] SSH private key

- [--ssh-public-key SSH_PUBLIC_KEY] SSH public key

- [--ssh-user SSH_USER] set user for SSHing to cluster hosts, passwordless sudo will be needed for non-root users'

- [--skip-mon-network] set mon public_network based on bootstrap mon ip

- [--skip-dashboard] do not enable the Ceph Dashboard

- [--dashboard-password-noupdate] stop forced dashboard password change

- [--no-minimize-config] do not assimilate and minimize the config file

- [--skip-ping-check] do not verify that mon IP is pingable

- [--skip-pull] do not pull the latest image before bootstrapping

- [--skip-firewalld] Do not configure firewalld

- [--allow-overwrite] allow overwrite of existing --output-* config/keyring/ssh files

- [--allow-fqdn-hostname] allow hostname that is fully-qualified (contains ".")

- [--skip-prepare-host] Do not prepare host

- [--orphan-initial-daemons] Do not create initial mon, mgr, and crash service specs

- [--skip-monitoring-stack] Do not automatically provision monitoring stack] (prometheus, grafana, alertmanager, node-exporter)

- [--apply-spec APPLY_SPEC] Apply cluster spec after bootstrap (copy ssh key, add hosts and apply services)

- [--registry-url REGISTRY_URL] url of custom registry to login to. e.g. docker.io, quay.io

- [--registry-username REGISTRY_USERNAME] username of account to login to on custom registry

- [--registry-password REGISTRY_PASSWORD] password of account to login to on custom registry

- [--registry-json REGISTRY_JSON] JSON file containing registry login info (see registry-login command documentation)

### ceph-volume
Run ceph-volume inside a container:

```
cephadm ceph-volume inventory
```

Positional arguments: * [command] command

Arguments:

- [--fsid FSID] cluster FSID

- [--config-json CONFIG_JSON] JSON file with config and (client.bootrap-osd) key

- [--config CONFIG, -c CONFIG] ceph conf file

- [--keyring KEYRING, -k KEYRING] ceph.keyring to pass through to the container

### check-host
check host configuration to be suitable for a Ceph cluster.

Arguments:

•

[--expect-hostname EXPECT_HOSTNAME] Check that hostname matches an expected value

### deploy
deploy a daemon on the local host. Used by the orchestrator CLI:

```
cephadm shell -- ceph orch apply <type> ...
```

Arguments:

- [--name NAME] daemon name (type.id)

- [--fsid FSID] cluster FSID

- [--config CONFIG, -c CONFIG] config file for new daemon

- [--config-json CONFIG_JSON] Additional configuration information in JSON format

- [--keyring KEYRING] keyring for new daemon

- [--key KEY] key for new daemon

- [--osd-fsid OSD_FSID] OSD uuid, if creating an OSD container

- [--skip-firewalld] Do not configure firewalld

- [--tcp-ports List of tcp ports to open in the host firewall

- [--reconfig] Reconfigure a previously deployed daemon

- [--allow-ptrace] Allow SYS_PTRACE on daemon container

### enter
Run an interactive shell inside a running daemon container:

```
cephadm enter --name mgr.myhost.ysubfo
```

Positional arguments: * [command] command

Arguments:

- [--fsid FSID] cluster FSID

- [--name NAME, -n NAME] daemon name (type.id)

### install
install ceph package(s)

Positional arguments:

•

[packages] packages

### inspect-image
inspect local ceph container image.

### list-networks
list IP networks

### ls
list daemon instances known to cephadm on this host:

```
$ cephadm ls
[

    {

        "style": "cephadm:v1",

        "name": "mgr.storage-14b-1.ysubfo",

        "fsid": "5110cb22-8332-11ea-9148-0894ef7e8bdc",

        "enabled": true,

        "state": "running",

        "container_id": "8562de72370a3836473ecfff8a22c9ccdd99815386b4692a2b30924fb5493c44",

        "container_image_name": "docker.io/ceph/ceph:v15",

        "container_image_id": "bc83a388465f0568dab4501fb7684398dca8b50ca12a342a57f21815721723c2",

        "version": "15.2.1",

        "started": "2020-04-21T01:16:41.831456",

        "created": "2020-04-21T01:16:41.775024",

        "deployed": "2020-04-21T01:16:41.415021",

        "configured": "2020-04-21T01:16:41.775024"

    },
...
```

Arguments:

- [--no-detail] Do not include daemon status

- [--legacy-dir LEGACY_DIR] Base directory for legacy daemon data

### logs
print journald logs for a daemon container:

```
cephadm logs --name mgr.myhost.ysubfo
```

This is similar to:

```
journalctl -u mgr.myhost.ysubfo
```

Can also specify additional journal arguments:

```
cephadm logs --name mgr.myhost.ysubfo -- -n 20 # last 20 lines
cephadm logs --name mgr.myhost.ysubfo -- -f # follow the log
```

Positional arguments:

•

[command] command (optional)

Arguments:

- [--fsid FSID] cluster FSID

- [--name NAME, -n NAME] daemon name (type.id)

### prepare-host
prepare a host for cephadm use

Arguments:

•

[--expect-hostname EXPECT_HOSTNAME] Set hostname

### pull
Pull the ceph image:

```
cephadm pull
```

### registry-login
Give cephadm login information for an authenticated registry (url, username and password). Cephadm will attempt to log the calling host into that registry:

```
cephadm registry-login --registry-url [REGISTRY_URL] --registry-username [USERNAME]

                       --registry-password [PASSWORD]
```

Can also use a JSON file containing the login info formatted as:

```
{

 "url":"REGISTRY_URL",

 "username":"REGISTRY_USERNAME",

 "password":"REGISTRY_PASSWORD"
}
```

and turn it in with command:

```
cephadm registry-login --registry-json [JSON FILE]
```

Arguments:

- [--registry-url REGISTRY_URL] url of registry to login to. e.g. docker.io, quay.io

- [--registry-username REGISTRY_USERNAME] username of account to login to on registry

- [--registry-password REGISTRY_PASSWORD] password of account to login to on registry

- [--registry-json REGISTRY_JSON] JSON file containing login info for custom registry

- [--fsid FSID] cluster FSID

### rm-daemon
Remove a specific daemon instance

Arguments:

- [--name NAME, -n NAME] daemon name (type.id)

- [--fsid FSID] cluster FSID

- [--force] proceed, even though this may destroy valuable data

- [--force-delete-data] delete valuable daemon data instead of making a backup

### rm-cluster
remove all daemons for a cluster

Arguments:

- [--fsid FSID] cluster FSID

- [--force] proceed, even though this may destroy valuable data

### rm-repo
remove package repository configuration

### run
run a ceph daemon, in a container, in the foreground

Arguments:

- [--name NAME, -n NAME] daemon name (type.id)

- [--fsid FSID] cluster FSID

### shell
Run an interactive shell:

```
cephadm shell
```

Or one specific command inside a container:

```
cephadm shell -- ceph orch ls
```

Positional arguments:

•

[command] command (optional)

Arguments:

- [--fsid FSID] cluster FSID

- [--name NAME, -n NAME] daemon name (type.id)

- [--config CONFIG, -c CONFIG] ceph.conf to pass through to the container

- [--keyring KEYRING, -k KEYRING] ceph.keyring to pass through to the container

- [--mount MOUNT, -m MOUNT] mount a file or directory under /mnt in the container

- [--env ENV, -e ENV] set environment variable

### unit
Operate on the daemon's systemd unit.

Positional arguments:

•

[command] systemd command (start, stop, restart, enable, disable, ...)

Arguments:

- [--fsid FSID] cluster FSID

- [--name NAME, -n NAME] daemon name (type.id)

## AVAILABILITY
cephadm is part of Ceph, a massively scalable, open-source, distributed storage system. Please refer to the documentation at http://docs.ceph.com/ for more information.

## SEE ALSO
ceph-volume(8),

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


cephfs-mirror

package: cephfs-mirror

title: cephfs-mirror(8)

text:
# cephfs-mirror(8)

## NAME
cephfs-mirror - Ceph daemon for mirroring CephFS snapshots

## SYNOPSIS

```
cephfs-mirror
```

## DESCRIPTION
cephfs-mirror is a daemon for asynchronous mirroring of Ceph Filesystem snapshots among Ceph clusters.

It connects to remote clusters via libcephfs, relying on default search paths to find ceph.conf files, i.e. /etc/ceph/$cluster.conf where $cluster is the human-friendly name of the cluster.

## OPTIONS
-c ceph.conf, --conf=ceph.conf

Use ceph.conf configuration file instead of the default /etc/ceph/ceph.conf to determine monitor addresses during startup.

-i ID, --id ID

Set the ID portion of name for cephfs-mirror

-n TYPE.ID, --name TYPE.ID

Set the rados user name (eg. client.mirror)

--cluster NAME

Set the cluster name (default: ceph)

-d

Run in foreground, log to stderr

-f

Run in foreground, log to usual location

## AVAILABILITY
cephfs-mirror is part of Ceph, a massively scalable, open-source, distributed storage system. Please refer to the Ceph documentation at https://docs.ceph.com for more information.

## SEE ALSO
ceph(8)

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


cephfs-shell

package: cephfs-shell

title: cephfs-shell(8)

summary: Shell-like tool talking with CephFS

text:
# cephfs-shell(8)

## NAME
cephfs-shell - Shell-like tool talking with CephFS

## SYNOPSIS

```
cephfs-shell [options] [command]
cephfs-shell [options] -- [command, command,...]
```

## DESCRIPTION
CephFS Shell provides shell-like commands that directly interact with the Ceph File System.

This tool can be used in interactive mode as well as in non-interactive mode. In former mode, cephfs-shell opens a shell session and after the given command is finished, it prints the prompt string and waits indefinitely. When the shell session is finished, cephfs-shell quits with the return value of last executed command. In non-interactive mode, cephfs-shell issues a command and exits right after the command's execution is complete with the command's return value.

Behaviour of CephFS Shell can be tweaked using cephfs-shell.conf. Refer to CephFS Shell Configuration File for details.

## OPTIONS
-b, --batch FILE

Path to batch file.

-c, --config FILE

Path to cephfs-shell.conf

-f, --fs FS

Name of filesystem to mount.

-t, --test FILE

Path to transcript(s) in FILE for testing

NOTE:

Latest version of the cmd2 module is required for running cephfs-shell. If CephFS is installed through source, execute cephfs-shell in the build directory. It can also be executed as following using virtualenv:

```
[build]$ python3 -m venv venv && source venv/bin/activate && pip3 install cmd2
[build]$ source vstart_environment.sh && source venv/bin/activate && python3 ../src/tools/cephfs/cephfs-shell
```

## COMMANDS

### mkdir
Create the directory(ies), if they do not already exist.

Usage :

mkdir [-option] <directory>...

•

directory - name of the directory to be created.

Options :

-m MODE

Sets the access mode for the new directory.

-p, --parent

Create parent directories as necessary. When this option is specified, no error is reported if a directory already exists.

### put
Copy a file/directory to Ceph File System from Local File System.

Usage :

put [options] <source_path> <target_path>

•

source_path - local file/directory path to be copied to cephfs.

- if . copies all the file/directories in the local working directory.

- if - Reads the input from stdin.

•

target_path - remote directory path where the files/directories are to be copied to.

•

if . files/directories are copied to the remote working directory.

Options :

-f, --force

Overwrites the destination if it already exists.

### get
Copy a file from Ceph File System to Local File System.

Usage :

get [options] <source_path> <target_path>

•

source_path - remote file/directory path which is to be copied to local file system.

•

if . copies all the file/directories in the remote working directory.

•

target_path - local directory path where the files/directories are to be copied to.

- if . files/directories are copied to the local working directory.

- if - Writes output to stdout.

Options:

-f, --force

Overwrites the destination if it already exists.

### ls
List all the files and directories in the current working directory.

Usage :

ls [option] [directory]...

•

directory - name of directory whose files/directories are to be listed.

•

By default current working directory's files/directories are listed.

Options:

-l, --long

list with long format - show permissions

-r, --reverse

reverse sort

-H

human readable

-a,-all

ignore entries starting with .

-S

Sort by file_size

### cat
Concatenate files and print on the standard output

Usage :

cat <file>....

•

file - name of the file

### cd
Change current working directory.

Usage :

cd [directory]

•

directory - path/directory name. If no directory is mentioned it is changed to the root directory.

•

If '.' moves to the parent directory of the current directory.

### cwd
Get current working directory.

Usage :

cwd

### quit/Ctrl + D
Close the shell.

### chmod
Change the permissions of file/directory.

Usage :

chmod <mode> <file/directory>

### mv
Moves files/Directory from source to destination.

Usage :

mv <source_path> <destination_path>

### rmdir
Delete a directory(ies).

Usage :

rmdir <directory_name>.....

### rm
Remove a file(es).

Usage :

rm <file_name/pattern>...

### write
Create and Write a file.

Usage :

write <file_name> <Enter Data> Ctrl+D Exit.

### lls
Lists all files and directories in the specified directory.Current local directory files and directories are listed if no path is mentioned

Usage:

lls <path>.....

### lcd
Moves into the given local directory.

Usage :

lcd <path>

### lpwd
Prints the absolute path of the current local directory.

Usage :

lpwd

### umask
Set and get the file mode creation mask

Usage :

umask [mode]

### alias
Define or display aliases

Usage:

alias [name] | [<name> <value>]

- name - name of the alias being looked up, added, or replaced

- value - what the alias will be resolved to (if adding or replacing) this can contain spaces and does not need to be quoted

### run_pyscript
Runs a python script file inside the console

Usage:

run_pyscript <script_path> [script_arguments]

•

Console commands can be executed inside this script with cmd ("your command") However, you cannot run nested "py" or "pyscript" commands from within this script. Paths or arguments that contain spaces must be enclosed in quotes

NOTE:

This command is available as pyscript for cmd2 versions 0.9.13 or less.

### py
Invoke python command, shell, or script

Usage :

py <command>: Executes a Python command. py: Enters interactive Python mode.

### shortcuts
Lists shortcuts (aliases) available

Usage :

shortcuts

### history
View, run, edit, and save previously entered commands.

Usage :

history [-h] [-r | -e | -s | -o FILE | -t TRANSCRIPT] [arg]

Options:

-h

show this help message and exit

-r

run selected history items

-e

edit and then run selected history items

-s

script format; no separation lines

-o FILE

output commands to a script file

-t TRANSCRIPT

output commands and results to a transcript file

### unalias
Unsets aliases

Usage :

unalias [-a] name [name ...]

•

name - name of the alias being unset

Options:

-a

remove all alias definitions

### set
Sets a settable parameter or shows current settings of parameters.

Usage :

set [-h] [-a] [-l] [settable [settable ...]]

•

Call without arguments for a list of settable parameters with their values.

Options :

-h

show this help message and exit

-a

display read-only settings as well

-l

describe function of parameter

### edit
Edit a file in a text editor.

Usage:

edit [file_path]

•

file_path - path to a file to open in editor

### run_script
Runs commands in script file that is encoded as either ASCII or UTF-8 text. Each command in the script should be separated by a newline.

Usage:

run_script <file_path>

•

file_path - a file path pointing to a script

NOTE:

This command is available as load for cmd2 versions 0.9.13 or less.

### shell
Execute a command as if at the OS prompt.

Usage:

shell <command> [arguments]

### locate
Find an item in File System

Usage:

locate [options] <name>

Options :

-c

Count number of items found

-i

Ignore case

### stat
Display file status.

Usage :

stat [-h] <file_name> [file_name ...]

Options :

-h

Shows the help message

### snap
Create or Delete Snapshot

Usage:

snap {create|delete} <snap_name> <dir_name>

- snap_name - Snapshot name to be created or deleted

- dir_name - directory under which snapshot should be created or deleted

### setxattr
Set extended attribute for a file

Usage :

setxattr [-h] <path> <name> <value>

- path - Path to the file

- name - Extended attribute name to get or set

- value - Extended attribute value to be set

Options:

-h, --help

Shows the help message

### getxattr
Get extended attribute value for the name associated with the path

Usage :

getxattr [-h] <path> <name>

- path - Path to the file

- name - Extended attribute name to get or set

Options:

-h, --help

Shows the help message

### listxattr
List extended attribute names associated with the path

Usage :

listxattr [-h] <path>

•

path - Path to the file

Options:

-h, --help

Shows the help message

### df
Display amount of available disk space

Usage :

df [-h] [file [file ...]]

•

file - name of the file

Options:

-h, --help

Shows the help message

### du
Show disk usage of a directory

Usage :

du [-h] [-r] [paths [paths ...]]

•

paths - name of the directory

Options:

-h, --help

Shows the help message

-r

Recursive Disk usage of all directories

### quota
Quota management for a Directory

Usage :

quota [-h] [--max_bytes [MAX_BYTES]] [--max_files [MAX_FILES]] {get,set} path

- {get,set} - quota operation type.

- path - name of the directory.

Options :

-h, --help

Shows the help message

--max_bytes MAX_BYTES

Set max cumulative size of the data under this directory

--max_files MAX_FILES

Set total number of files under this directory tree

## CEPHFS SHELL CONFIGURATION FILE
By default, CephFS Shell looks for cephfs-shell.conf in the path provided by the environment variable CEPHFS_SHELL_CONF and then in user's home directory (~/.cephfs-shell.conf).

Right now, CephFS Shell inherits all its options from its dependency cmd2. Therefore, these options might vary with the version of cmd2 installed on your system. Refer to cmd2 docs for a description of these options.

Following is a sample cephfs-shell.conf

```
[cephfs-shell]
prompt = CephFS:~/>>>
continuation_prompt = >
quiet = False
timing = False
colors = True
debug = False
abbrev = False
autorun_on_edit = False
echo = False
editor = vim
feedback_to_output = False
locals_in_py = True
```

## EXIT CODE
Following exit codes are returned by cephfs shell

Error Type

Exit Code

Miscellaneous

1

Keyboard Interrupt

2

Operation not permitted

3

Permission denied

4

No such file or directory

5

I/O error

6

No space left on device

7

File exists

8

No data available

9

Invalid argument

10

Operation not supported on transport endpoint

11

Range error

12

Operation would block

13

Directory not empty

14

Not a directory

15

Disk quota exceeded

16

Broken pipe

17

Cannot send after transport endpoint shutdown

18

Connection aborted

19

Connection refused

20

Connection reset

21

Interrupted function call

22

## FILES
~/.cephfs-shell.conf

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


cephfs-top

package: cephfs-top

title: cephfs-top(8)

summary: Ceph Filesystem Top Utility

text:
# cephfs-top(8)

## NAME
cephfs-top - Ceph Filesystem Top Utility

## SYNOPSIS

```
cephfs-top [flags]
```

## DESCRIPTION
cephfs-top provides top(1) like functionality for Ceph Filesystem. Various client metrics are displayed and updated in realtime.

Ceph Metadata Servers periodically send client metrics to Ceph Manager. Stats plugin in Ceph Manager provides an interface to fetch these metrics.

## OPTIONS
--cluster

Cluster: Ceph cluster to connect. Defaults to ceph.

--id

Id: Client used to connect to Ceph cluster. Defaults to fstop.

--selftest

Perform a selftest. This mode performs a sanity check of stats module.

--conffile [CONFFILE]

Path to cluster configuration file

-d [DELAY], --delay [DELAY]

Refresh interval in seconds (default: 1)

--dump

Dump the metrics to stdout

--dumpfs <fs_name>

Dump the metrics of the given filesystem to stdout

## DESCRIPTIONS OF FIELDS
chit

cap hit rate

dlease

dentry lease rate

ofiles

number of opened files

oicaps

number of pinned caps

oinodes

number of opened inodes

rtio

total size of read IOs

wtio

total size of write IOs

raio

average size of read IOs

waio

average size of write IOs

rsp

speed of read IOs compared with the last refresh

wsp

speed of write IOs compared with the last refresh

rlatavg

average read latency

rlatsd

standard deviation (variance) for read latency

wlatavg

average write latency

wlatsd

standard deviation (variance) for write latency

mlatavg

average metadata latency

mlatsd

standard deviation (variance) for metadata latency

## AVAILABILITY
cephfs-top is part of Ceph, a massively scalable, open-source, distributed storage system. Please refer to the Ceph documentation at http://ceph.com/ for more information.

## SEE ALSO
ceph(8), ceph-mds(8)

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


certmonger

package: certmonger

title: certmonger(8)

text:
# certmonger(8)

## NAME
certmonger

## SYNOPSIS
certmonger [-s|-S] [-L|-l] [-P PATH] [-b TIMEOUT|-B] [-n|-f] [-d LEVEL] [-p FILE] [-F] [-c command] [-v]

## DESCRIPTION
The certmonger daemon monitors certificates for impending expiration, and can optionally refresh soon-to-be-expired certificates with the help of a CA. If told to, it can drive the entire enrollment process from key generation through enrollment and refresh.

The daemon provides a control interface via the org.fedorahosted.certmonger service, with which client tools such as getcert(1) interact.

## OPTIONS
-s, --session

Listen on the session bus rather than the system bus.

-S, --system

Listen on the system bus rather than the session bus. This is the default.

-l, --listening-socket

Also listen on a private socket for connections from clients running under the same UID.

-L, --only-listening-socket

Listen only on a private socket for connections from clients running under the same UID, and skip connecting to a bus.

-P PATH, --listening-socket-path=PATH

Specify a location for the private listening socket. If the location beings with a '/' character, it will be prefixed with 'unix:path=', otherwise it will be prefixed with 'unix:'. If this option is not specified, the listening socket, if one is created, will be placed in the abstract namespace.

-b TIMEOUT, --bus-activation-timeout=TIMEOUT

Behave as a bus-activated service: if there are no certificates to be monitored or obtained, and no requests are received within TIMEOUT seconds, exit. Not compatible with the -c option.

-B, --no-bus-activation-timeout

Don't behave as a bus-activated service. This is the default.

-n, --nofork

Don't fork, and log messages to stderr rather than syslog.

-f, --fork

Do fork, and log messages to syslog rather than stderr. This is the default.

-d LEVEL, --debug-level=LEVEL

Set debugging level. Higher values produce more debugging output. Implies -n.

-p FILE, pidfile=FILE

Store the daemon's process ID in the named file.

-F, --fips

Force NSS to be initialized in FIPS mode. The default behavior is to heed the setting stored in /proc/sys/crypto/fips_enabled.

-c COMMAND, --command=COMMAND

After the service has initialized, run the specified command, then shut down the service after the command exits. If the -l or -L option was also specified, the command will be run with the CERTMONGER_PVT_ADDRESS environment variable set to the listening socket's location. Not compatible with the -b option.

-v, --version

Print version information and exit.

## FILES
The set of certificates being monitored or signed is tracked using files stored under /var/lib/certmonger/requests, or in a directory named by the CERTMONGER_REQUESTS_DIR environment variable.

The set of known CAs is tracked using files stored under /var/lib/certmonger/cas, or in a directory named by the CERTMONGER_CAS_DIR environment variable.

Temporary files will be stored in "/run/certmonger", or in the directory named by the CERTMONGER_TMPDIR environment variable if that value was not given at compile time.

## BUGS
Please file tickets for any that you find at https://fedorahosted.org/certmonger/

## SEE ALSO
getcert(1) getcert-add-ca(1) getcert-add-scep-ca(1) getcert-list-cas(1) getcert-list(1) getcert-modify-ca(1) getcert-refresh-ca(1) getcert-refresh(1) getcert-rekey(1) getcert-remove-ca(1) getcert-request(1) getcert-resubmit(1) getcert-start-tracking(1) getcert-status(1) getcert-stop-tracking(1) certmonger-certmaster-submit(8) certmonger-dogtag-ipa-renew-agent-submit(8) certmonger-dogtag-submit(8) certmonger-ipa-submit(8) certmonger-local-submit(8) certmonger-scep-submit(8) certmonger_selinux(8)


summary: ipa\-renew\-agent\-submit

text:
# certmonger-dogtag-ipa-renew-agent-submit(8)

## NAME
dogtag-ipa-renew-agent-submit

## SYNOPSIS
dogtag-ipa-renew-agent-submit [options] [csrfile]

## DESCRIPTION
dogtag-ipa-renew-agent-submit is the helper which certmonger uses to make certificate renewal requests to Dogtag instances running on IPA servers. It is not normally run interactively, but it can be for troubleshooting purposes.

The preferred option is to request a renewal of an already-issued certificate, using its serial number, which can be read from a PEM-formatted certificate provided in the CERTMONGER_CERTIFICATE environment variable, or via the -s or -D option on the command line. If no serial number is provided, then the client will attempt to obtain a new certificate by submitting a signing request to the CA.

The signing request which is to be submitted should either be in a file whose name is given as an argument, or fed into dogtag-ipa-renew-agent-submit via stdin.

certmonger does not yet support retrieving trust information from Dogtag CAs.

## OPTIONS
-E EE-URL, --ee-url=EE-URL

The top-level URL for the end-entity interface provided by the CA. In IPA installations, this is typically http://SERVER:EEPORT/ca/ee/ca. If no URL is specified, the host named in the [global] section in the /etc/ipa/default.conf file is used as the value of SERVER, and the value of EEPORT will be inferred based on the value of the dogtag_version in the [global] section in the /etc/ipa/default.conf file: if dogtag_version is set to 10 or more, EEPORT will be set to 8090. Otherwise it will be 9180.

-A AGENT-URL, --agent-url=AGENT-URL

The top-level URL for the agent interface provided by the CA. In IPA installations, this is typically https://SERVER:AGENTPORT/ca/agent/ca. If no URL is specified, the host named in the [global] section in the /etc/ipa/default.conf file is used as the value of SERVER, and the value of AGENTPORT will be inferred based on the value of the dogtag_version in the [global] section in the /etc/ipa/default.conf file: if dogtag_version is set to 10 or more, AGENTPORT will be set to 8443. Otherwise it will be 9443.

-i FILE, --cafile=PATH

The location of a file containing a copy of the CA's certificate, against which the CA server's certificate will be verified. The default is /etc/ipa/ca.crt.

-C DIR, --capath=DIR

The location of a directory containing a copy of the CA's certificate, against which the CA server's certificate will be verified.

-d DIR, --dbdir=DIR

The NSS database that contains credentials to authenticate to the CA.

-n NAME, --nickname=NAME

The nickname of the certificate used for authentication.

-c FILENAME, --certfile=FILENAME

The certificate in PEM format used for authentication.

-k FILENAME, --keyfile=FILENAME

The private key for the certificate in PEM format used for authentication. It may be encrypted.

-p FILENAME, --sslpinfile=FILENAME

A file that contains the pin for the private key file or NSS database.

-P STRING, --sslpin=STRING

The pin for the private key file or NSS database.

-s NUMBER, --hex-serial=NUMBER

The serial number of an already-issued certificate for which the client should attempt to obtain a new certificate, in hexidecimal form, if one can not be read from the CERTMONGER_CERTIFICATE environment variable.

-D NUMBER, --serial=NUMBER

The serial number of an already-issued certificate for which the client should attempt to obtain a new certificate, in decimal form, if one can not be read from the CERTMONGER_CERTIFICATE environment variable.

-S STATE-VALUE, --state=STATE-VALUE

A cookie value provided by a previous instance of this helper, if the helper is being asked to continue a multi-step enrollment process. If the CERTMONGER_COOKIE environment variable is set, its value is used.

-T NAME, --profile=NAME

The name of the type of certificate which the client should request from the CA if it is not renewing a certificate (per the -s option above). If the CERTMONGER_CA_PROFILE environment variable is set, its value is used. Otherwise, the default value is caServerCert.

-t, --profile-list

Instead of attempting to obtain a new certificate, query the server for a list of the enabled enrollment profiles.

-O param=value, --approval-option=param=value

An additional parameter to pass to the server when approving the signing request using the agent's credentials. By default, any server-supplied default settings are applied. This option can be used either to override a server-supplied default setting, or to supply one which would otherwise have not been used.

-N, --force-new

Even if an already-issued certificate is available in the CERTMONGER_CERTIFICATE environment variable, or a serial number has been provided, don't attempt to renew a certificate using its serial number. Instead, attempt to obtain a new certificate using the signing request. The default behavior is to request a renewal if possible.

-R, --force-renew

Negates the effect of the -N flag.

-o param=value, --submit-option=param=value

When initially submitting a request to the CA, add the specified parameter and value along with any request parameters which would otherwise be sent. This option is not typically used.

-a, --agent-submit

Use agent credentials, specified using some combination of the -d, -n, -c, and -k flags, to authenticate to the CA when initially submitting a request to the CA or retrieving the list of enabled enrollment profiles. This is typically required when the enrollment profile being used uses AgentCertAuth-based authentication, and requires that the URL specified using the -E flag be an HTTPS URL, or when the URL specified using the -E flag is an HTTPS URL.

-u username, --uid=username

When initially submitting a request to the CA, supply the specified value as a user name. This is typically required when the enrollment profile being used uses UidPwdDirAuth-based or NISAuth-based authentication..TP -U userdn, --upn=userdn When initially submitting a request to the CA, supply the specified value as the DN (distinguished name) of the user's entry in a directory server which the CA is configured to use for checking the user's password. This is typically required when the enrollment profile being used uses UdnPwdDirAuth-based authentication.

-W PASSWORD, --userpwd=PASSWORD

When initially submitting a request to the CA, supply the specified value as the password for the user whose name is specified with the -u option, or whose DN is specified with the -U option. This is typically only required when the enrollment profile being used uses UidPwdDirAuth-based, UserPwdDirAuth-based, or NISAuth-based authentication. If the URL specified using the -E flag is not an HTTPS URL, this value will not be encrypted.

-w FILE, --userpwdfile=FILE

When initially submitting a request to the CA, read from the specified file a password to supply for the user whose name is specified with the -u option, or whose DN is specified with the -U option. This is typically only required when the enrollment profile being used uses UidPwdDirAuth-based, UserPwdDirAuth-based, or NISAuth-based authentication. If the URL specified using the -E flag is not an HTTPS URL, this value will not be encrypted.

-Y PIN, --userpin=PIN

When initially submitting a request to the CA, supply the specified value as the PIN for the user whose name is specified with the -u option, or whose DN is specified with the -U option. This is typically only required when the enrollment profile being used uses UidPwdPinDirAuth-based authentication. If the URL specified using the -E flag is not an HTTPS URL, this value will not be encrypted. -y FILE, --userpinfile=FILE When initially submitting a request to the CA, read from the specified file a PIN to supply for the user whose name is specified with the -u option, or whose DN is specified with the -U option. This is typically only required when the enrollment profile being used uses UidPwdPinDirAuth-based authentication. If the URL specified using the -E flag is not an HTTPS URL, this value will not be encrypted.

-v, --verbose

Increases the logging level. Use twice for more logging. This option is mainly useful for troubleshooting.

## AGENT KEY AND CERTIFICATE OPTIONS
Options that provide the location for the private key and public certificate which the client should use to authenticate to the CA's agent interface. The values to use depend on which cryptography library your copy of libcurl was linked with.

The location of the certificate used for authentication to the CA needs to be provided in either a combination of PEM files using --certfile and --keyfile or an NSS database using--dbdir and --nickname. The default for --cafile is /etc/ipa/ca.crt.

-d dbdir, --dbdir=dbdir

Use an NSS database in the specified directory for this certificate and key. Only valid with -n.

-n NAME, --nickname=NAME

Use the NSS key with this nickname. Only valid with -d.

-c FILE, --certfile=FILE

The PEM file that contains the public certificate. Only valid with -k.

-k FILE, --keyfile=FILE

The PEM file that contains the private certificate. Only valid with -c.

-p FILE, --sslpinfile=FILE

The name of a file which contains a PIN/password which will be needed in order to make use of the agent credentials.

-P PIN, --sslpin=PIN

The name of a file which contains a PIN/password which will be needed in order to make use of the agent credentials.

## EXIT STATUS
0

if the certificate was issued. The certificate will be printed.

1

if the CA is still thinking. A cookie (state) value will be printed.

2

if the CA rejected the request. An error message may be printed.

3

if the CA was unreachable. An error message may be printed.

4

if critical configuration information is missing. An error message may be printed.

5

if the CA is still thinking. A suggested poll delay (specified in seconds) and a cookie (state) value will be printed.

17

if the CA indicates that the client needs to attempt enrollment using a new key pair.

## FILES
/etc/ipa/default.conf

is the IPA client configuration file. This file is consulted to determine the URL for the Dogtag server's end-entity and agent interfaces if they are not supplied as arguments.

## BUGS
Please file tickets for any that you find at https://fedorahosted.org/certmonger/

## SEE ALSO
certmonger(8) getcert(1) getcert-add-ca(1) getcert-add-scep-ca(1) getcert-list-cas(1) getcert-list(1) getcert-modify-ca(1) getcert-refresh-ca(1) getcert-refresh(1) getcert-rekey(1) getcert-remove-ca(1) getcert-resubmit(1) getcert-start-tracking(1) getcert-status(1) getcert-stop-tracking(1) certmonger-certmaster-submit(8) certmonger-dogtag-submit(8) certmonger-ipa-submit(8) certmonger-local-submit(8) certmonger-scep-submit(8) certmonger_selinux(8)


certmonger-dogtag-submit

title: certmonger-dogtag-submit(8)

summary: submit

text:
# certmonger-dogtag-submit(8)

## NAME
dogtag-submit

## SYNOPSIS
dogtag-submit -E EE-URL -A AGENT-URL [-d DIR] [-n NAME] [-i FILE] [-C DIR] [-c FILE] [-k FILE] [-p FILE] [-P PIN] [-s serial (hex)] [-D serial (decimal)] [-S state] [-T profile] [-O param=value] [-N | -R] [-t] [-o option=value] [-a] [-u username] [-U userdn] [-W PASSWORD] [-w FILE] [-Y PIN] [-y FILE] [-v] [csrfile]

## DESCRIPTION
dogtag-submit is the helper which certmonger can use to make certificate enrollment and renewal requests to Dogtag servers. It is not normally run interactively, but it can be for troubleshooting purposes.

The preferred option is to request a renewal of an already-issued certificate, using its serial number, which can be read from a PEM-formatted certificate provided in the CERTMONGER_CERTIFICATE environment variable, or via the -s or -D option on the command line. If no serial number is provided, then the client will attempt to obtain a new certificate by submitting a signing request to the CA.

The signing request which is to be submitted should either be in a file whose name is given as an argument, or fed into dogtag-submit via stdin.

certmonger does not yet support retrieving trust information from Dogtag CAs.

## OPTIONS
-E EE-URL, --ee-url=EE-URL

The top-level URL for the end-entity interface provided by the CA, through which the initial enrollment request will be submitted. This is typically http://SERVER:EEPORT/ca/ee/ca.

-A AGENT-URL, --agent-url=AGENT-URL

The top-level URL for the agent interface provided by the CA, through which the request can be approved using agent credentials. This is typically https://SERVER:AGENTPORT/ca/agent/ca.

-i FILE, --cafile=FILE

The location of a file containing a copy of the CA's certificate, against which the CA server's certificate will be verified.

-C DIR, --capath=DIR

The location of a directory containing a copy of the CA's certificate(s), against which the CA server's certificate will be verified.

-D SERIAL, --serial=SERIAL

The serial number of an already-issued certificate for which the client should attempt to obtain a new certificate, in decimal form, if one can not be read from the CERTMONGER_CERTIFICATE environment variable.

-s SERIAL, --hex-serial=SERIAL

The serial number of an already-issued certificate for which the client should attempt to obtain a new certificate, in hexadecimal form, if one can not be read from the CERTMONGER_CERTIFICATE environment variable.

-S STATE, --state=STATE

A cookie value provided by a previous instance of this helper, if the helper is being asked to continue a multi-step enrollment process. If the CERTMONGER_COOKIE environment variable is set, its value is used.

-T NAME, --profile=NAME

The name of the type of certificate which the client should request from the CA if it is not renewing a certificate (per the -s option above). If the CERTMONGER_CA_PROFILE environment variable is set, its value is used. Otherwise, the default value is caServerCert.

-O param=value, --approval-options=param=value

An additional parameter to pass to the server when approving the signing request using agent credentials. By default, any server-supplied default settings are applied. This option can be used either to override a server-supplied default setting, or to supply one which would otherwise have not been used. Requires the -A option.

-N, --force-new

Even if an already-issued certificate is available in the CERTMONGER_CERTIFICATE environment variable, or a serial number has been provided, don't attempt to renew a certificate using its serial number. Instead, attempt to obtain a new certificate using the signing request. The default behavior is to request a renewal if possible.

-R, --force-renew

Negates the effect of the -N flag.

-t, --profile-list

Instead of attempting to obtain a new certificate, query the server for a list of the enabled enrollment profiles.

-o param=value, --submit-option=param=value

When initially submitting a request to the CA, add the specified parameter and value along with any request parameters which would otherwise be sent.

-a, --agent-submit

Use agent credentials, specified using some combination of the -d, -n, -c, and -k flags, to authenticate to the CA when initially submitting a request to the CA or retrieving the list of enabled enrollment profiles. This is typically required when the enrollment profile being used uses AgentCertAuth-based authentication, and requires that the URL specified using the -E flag be an HTTPS URL, or when the URL specified using the -E flag is an HTTPS URL.

-u username, --uid=username

When initially submitting a request to the CA, supply the specified value as a user name. This is typically required when the enrollment profile being used uses UidPwdDirAuth-based or NISAuth-based authentication.

-U userdn, --upn=userdn

When initially submitting a request to the CA, supply the specified value as the DN (distinguished name) of the user's entry in a directory server which the CA is configured to use for checking the user's password. This is typically required when the enrollment profile being used uses UdnPwdDirAuth-based authentication.

-W PASSWORD, --userpwd=PASSWORD

When initially submitting a request to the CA, supply the specified value as the password for the user whose name is specified with the -u option, or whose DN is specified with the -U option. This is typically only required when the enrollment profile being used uses UidPwdDirAuth-based, UserPwdDirAuth-based, or NISAuth-based authentication. If the URL specified using the -E flag is not an HTTPS URL, this value will not be encrypted.

-w FILE, --userpwdfile=FILE

When initially submitting a request to the CA, read from the specified file a password to supply for the user whose name is specified with the -u option, or whose DN is specified with the -U option. This is typically only required when the enrollment profile being used uses UidPwdDirAuth-based, UserPwdDirAuth-based, or NISAuth-based authentication. If the URL specified using the -E flag is not an HTTPS URL, this value will not be encrypted.

-Y PIN, --userpin=PIN

When initially submitting a request to the CA, supply the specified value as the PIN for the user whose name is specified with the -u option, or whose DN is specified with the -U option. This is typically only required when the enrollment profile being used uses UidPwdPinDirAuth-based authentication. If the URL specified using the -E flag is not an HTTPS URL, this value will not be encrypted.

-y FILE, --userpinfile=FILE

When initially submitting a request to the CA, read from the specified file a PIN to supply for the user whose name is specified with the -u option, or whose DN is specified with the -U option. This is typically only required when the enrollment profile being used uses UidPwdPinDirAuth-based authentication. If the URL specified using the -E flag is not an HTTPS URL, this value will not be encrypted.

-v, --verbose

Increases the logging level. Use twice for more logging. This option is mainly useful for troubleshooting.

## AGENT KEY AND CERTIFICATE OPTIONS
Options that provide the location for the private key and public certificate which the client should use to authenticate to the CA's agent interface. The values to use depend on which cryptography library your copy of libcurl was linked with.

-d DIR, --dbdir=DIR

Use an NSS database in the specified directory for this certificate and key. Only valid with -n.

-n NAME, --nickname=NAME

Use the NSS key with this nickname. Only valid with -d.

-c FILE, --certfile=FILE

The PEM file that contains the public certificate. Only valid with -k.

-k FILE, --keyfile=FILE

The PEM file that contains the private certificate. Only valid with -c.

-p FILE, --sslpinfile=FILE

The name of a file which contains a PIN/password which will be needed in order to make use of the agent credentials.

-P PIN, --sslpin=PIN

The name of a file which contains a PIN/password which will be needed in order to make use of the agent credentials.

## EXIT STATUS
0

if the certificate was issued. The certificate will be printed.

1

if the CA is still thinking. A cookie (state) value will be printed.

2

if the CA rejected the request. An error message may be printed.

3

if the CA was unreachable. An error message may be printed.

4

if critical configuration information is missing. An error message may be printed.

5

if the CA is still thinking. A suggested poll delay (specified in seconds) and a cookie (state) value will be printed.

17

if the CA indicates that the client needs to attempt enrollment using a new key pair.

## BUGS
Please file tickets for any that you find at https://fedorahosted.org/certmonger/

## SEE ALSO
certmonger(8) getcert(1) getcert-add-ca(1) getcert-add-scep-ca(1) getcert-list-cas(1) getcert-list(1) getcert-modify-ca(1) getcert-refresh-ca(1) getcert-refresh(1) getcert-rekey(1) getcert-remove-ca(1) getcert-resubmit(1) getcert-start-tracking(1) getcert-status(1) getcert-stop-tracking(1) certmonger-certmaster-submit(8) certmonger-dogtag-ipa-renew-agent-submit(8) certmonger-ipa-submit(8) certmonger-local-submit(8) certmonger-scep-submit(8) certmonger_selinux(8)


certmonger-ipa-submit

title: certmonger-ipa-submit(8)

summary: submit

text:
# certmonger-ipa-submit(8)

## NAME
ipa-submit

## SYNOPSIS
ipa-submit [-h serverHost] [-H serverURL] [-d domain] [-L ldapurl] [-b basedn] [-c cafile] [-C capath] [[-K] | [-t keytab] [-k submitterPrincipal]] [-u UID] [-W PASSWORD] [-w FILE] [-P principalOfRequest] [-T profile] [-X issuer] [csrfile]

## DESCRIPTION
ipa-submit is the helper which certmonger uses to make requests to IPA-based CAs. It is not normally run interactively, but it can be for troubleshooting purposes. The signing request which is to be submitted should either be in a file whose name is given as an argument, or fed into ipa-submit via stdin.

certmonger supports retrieving trusted certificates from IPA CAs. See getcert-request(1) and getcert-resubmit(1) for information about specifying where those certificates should be stored on the local system. Trusted certificates are retrieved from the caCertificate attribute of entries present at and below cn=cacert,cn=ipa,cn=etc,$BASE in the IPA LDAP server's directory tree, where $BASE defaults to the value of the basedn setting in /etc/ipa/default.conf.

## OPTIONS
-P PRINCIPAL, --principal-of-request=PRINCIPAL

Identifies the principal name of the service for which the certificate is being issued. This setting is required by IPA and must always be specified.

-X NAME, --issuer=NAME

Requests that the certificate be processed by the specified certificate issuer. By default, if this flag is not specified, and the CERTMONGER_CA_ISSUER variable is set in the environment, then the value of the environment variable will be used. This setting is optional, and if a server returns error 3005, indicating that it does not understand multiple profiles, the request will be re-submitted without specifying an issuer name.

-T NAME, --profile=NAME

Requests that the certificate be processed using the specified certificate profile. By default, if this flag is not specified, and the CERTMONGER_CA_PROFILE variable is set in the environment, then the value of the environment variable will be used. This setting is optional, and if a server returns error 3005, indicating that it does not understand multiple profiles, the request will be re-submitted without specifying a profile.

-h HOSTNAME, --host=HOSTNAME

Submit the request to the IPA server running on the named host. The default is to read the location of the host from /etc/ipa/default.conf. If no server is configured, or the configured server cannot be reached, the client will attempt to use DNS discovery to locate LDAP servers for the IPA domain. If servers are found, they will be searched for entries pointing to IPA masters running the "CA" service, and the client will attempt to contact each of those in turn.

-H URL, --xmlrpc-url=URL

Submit the request to the IPA server at the specified location. The default is to read the location of the host from /etc/ipa/default.conf. If no server is configured, or the configured server cannot be reached, the client will attempt to use DNS discovery to locate LDAP servers for the IPA domain. If servers are found, they will be searched for entries pointing to IPA masters running the "CA" service, and the client will attempt to contact each of those in turn.

-L URL, --ldap-url=URL

Provide the IPA LDAP service location rather than using DNS discovery. The default is to read the location of the host from /etc/ipa/default.conf and use DNS discovery to find the set of _ldap._tcp.DOMAIN values and pick one for use.

-d DOMAIN, --domain=DOMAIN

Use this domain when doing DNS discovery to locate LDAP servers for the IPA installation. The default is to read the location of the host from /etc/ipa/default.conf.

-b BASEDN, --basedn=BASEDN

Use this basedn to search for an IPA installation in LDAP. The default is to read the location of the host from /etc/ipa/default.conf.

-c FILE, --cafile=FILE

The server's certificate was issued by the CA whose certificate is in the named file. The default value is /etc/ipa/ca.crt.

-C PATH, --capath=DIR

Trust the server if its certificate was issued by a CA whose certificate is in a file in the named directory. There is no default for this option, and it is not expected to be necessary.

-t KEYTAB, --keytab=KEYTAB

Authenticate to the IPA server using Kerberos with credentials derived from keys stored in the named keytab. The default value can vary, but it is usually /etc/krb5.keytab. This option conflicts with the -K, -u, -W, and -w options.

-k PRINCIPAL, --submitter-principal=PRINCIPAL

Authenticate to the IPA server using Kerberos with credentials derived from keys stored in the named keytab for this principal name. The default value is the host service for the local host in the local realm. This option conflicts with the -K, -u, -W, and -w options.

-K, --use-ccache-creds

Authenticate to the IPA server using Kerberos with credentials derived from the default credential cache rather than a keytab. This option conflicts with the -k, -u, -W, and -w options.

-u USERNAME, --uid=USERNAME

Authenticate to the IPA server using a user name and password, using the specified value as the user name. This option conflicts with the -k, -K, and -t options.

-W PASSWORD, --pwd=PASSWORD

Authenticate to the IPA server using a user name and password, using the specified value as the password. This option conflicts with the -k, -K, -t, and -w options.

-w FILE, --pwdfile=FILE

Authenticate to the IPA server using a user name and password, reading the password from the specified file. This option conflicts with the -k, -K, -t, and -W options.

## EXIT STATUS
0

if the certificate was issued. The certificate will be printed.

1

if the CA is still thinking. A cookie value will be printed.

2

if the CA rejected the request. An error message may be printed.

3

if the CA was unreachable. An error message may be printed.

4

if critical configuration information is missing. An error message may be printed.

17

if the CA indicates that the client needs to attempt enrollment using a new key pair.

## FILES
/etc/ipa/default.conf

is the IPA client configuration file. This file is consulted to determine the URL for the IPA server's XML-RPC interface.

## BUGS
Please file tickets for any that you find at https://fedorahosted.org/certmonger/

## SEE ALSO
certmonger(8) getcert(1) getcert-add-ca(1) getcert-add-scep-ca(1) getcert-list-cas(1) getcert-list(1) getcert-modify-ca(1) getcert-refresh-ca(1) getcert-refresh(1) getcert-rekey(1) getcert-remove-ca(1) getcert-request(1) getcert-resubmit(1) getcert-start-tracking(1) getcert-status(1) getcert-stop-tracking(1) certmonger-certmaster-submit(8) certmonger-dogtag-ipa-renew-agent-submit(8) certmonger-dogtag-submit(8) certmonger-local-submit(8) certmonger-scep-submit(8) certmonger_selinux(8)


certmonger-local-submit

title: certmonger-local-submit(8)

summary: submit

text:
# certmonger-local-submit(8)

## NAME
local-submit

## SYNOPSIS
local-submit [-d state-directory] [-v] [csrfile]

## DESCRIPTION
local-submit is the helper which certmonger uses to implement its local signer. It is not normally run interactively, but it can be for troubleshooting purposes. The signing request which is to be submitted should either be in a file whose name is given as an argument, or fed into local-submit via stdin.

The local signer is currently hard-coded to generate and use a 2048-bit RSA key and a name and initial serial number based on a UUID, replacing that key and certificate at roughly the midpoint of their useful lifetime.

certmonger supports retrieving the list of current and previously-used local CA certificates. See getcert-request(1) and getcert-resubmit(1) for information about specifying where those certificates should be stored.

## OPTIONS
-d DIR, --ca-data-directory=DIR

Identifies the directory which contains the local signer's private key, certificates, and other data used by the local signer.

-v, --verbose

Increases the verbosity of the tool's diagnostic logging.

## EXIT STATUS
0

if the certificate was issued. The new certificate will be printed.

3

if the helper needs to be called again. An error message may be printed.

4

if critical configuration information is missing. An error message may be printed.

## FILES
creds

is currently a PKCS#12 bundle containing the local signer's current signing key and current and previously-used signer certificates. It should not be modified except by the local signer. A new key is currently generated when ever a new signer certificate is needed.

serial

currently contains the serial number which will be used for the next issued certificate. It should not be modified except by the local signer.

## BUGS
Please file tickets for any that you find at https://fedorahosted.org/certmonger/

## SEE ALSO
certmonger(8) getcert(1) getcert-add-ca(1) getcert-add-scep-ca(1) getcert-list-cas(1) getcert-list(1) getcert-modify-ca(1) getcert-refresh-ca(1) getcert-refresh(1) getcert-rekey(1) getcert-remove-ca(1) getcert-resubmit(1) getcert-start-tracking(1) getcert-status(1) getcert-stop-tracking(1) certmonger-certmaster-submit(8) certmonger-dogtag-ipa-renew-agent-submit(8) certmonger-dogtag-submit(8) certmonger-ipa-submit(8) certmonger-scep-submit(8) certmonger_selinux(8)