vnstatd

package: vnstat-server

title: vnstatd(8)

text:
# vnstatd(8)

## NAME
vnstatd - daemon based database updating for vnStat

## SYNOPSIS
vnstatd [-Ddnpsv?] [--alwaysadd] [--config file] [--daemon] [--debug] [-g group] [--group group] [--help] [--initdb] [--noadd] [--nodaemon] [--pidfile file] [--sync] [--u user] [--user user] [--version]

## DESCRIPTION
The purpose of vnstatd is to provide a flexible and robust way for updating the database that vnstat(1) uses. The availability of each interface is automatically tracked which removes the need for additional scripts to be implemented and called when an interface comes online or goes offline.

vnstatd is the command for starting the daemon. The daemon can either fork itself to run as a background process or stay attached to the terminal. It supports logging to a user selectable file or using syslog.

Once started, the daemon will read vnstat.conf(5) if available and then check if there is a database present in the database directory that has been specified in the configuration file. By default, if no database is found, a database will be created during startup with entries for all available interfaces excluding pseudo interfaces lo, lo0 and sit0. This automatic database entry creation behaviour can be disabled using the --noadd option. Alternatively, it is possible to allow the daemon to create new database entries whenever previously unseen interfaces become visible using the --alwaysadd option.

The daemon will proceed to track the availability of monitored interfaces, process the interface traffic statistics and write new values to the database at a configured interval. As a result, the daemon ends up spending most of the time sleeping between updates.

Data is stored in the database using local time based on the daemon's execution environment. Any changes in the system clock or the system timezone configuration will result in data being inserted according to the new local time without any recalculation being done for already stored data. The daemon and the database in essence aren't aware of the used timezone or possible daylight saving time and cannot be configured to offset the timestamps to any direction. If a system clock or system timezone change or daylight saving time observation ending results in an already seen time period to repeat then the existing database values get incremented with the new data.

## OPTIONS
--alwaysadd

Enable automatic creation of new database entries for previously unseen interfaces even if the database already exists when the daemon is started. New database entries will also get created for new interfaces seen while the daemon is running. Pseudo interfaces lo, lo0 and sit0 are always excluded from getting added.

--config file

Use file as configuration file instead of using automatic configuration file search functionality.

-d, --daemon

Fork process to background and run as a daemon.

-D, --debug

Provide additional output for debug purposes. The process will stay attached to the terminal for output.

-g, --group group

Set daemon process group to group during startup. group can be either the name of the group or a numerical group id. This option can only be used when the process is started as root.

--initdb

Create a new empty database without interface data and exit. If the database already exists then access to it is only verified. The daemon will not stay running when this option is used. This option cannot be used in combination with -d, --daemon or -n, --nodaemon.

--noadd

Disable the automatic creation of new database entries for all available interfaces if the daemon is started with no database found or with a database without any interfaces. The daemon will fail to start if this option is used when the database contains no interfaces or doesn't exist. The daemon will create an empty database if one doesn't already exist. Pseudo interfaces lo, lo0 and sit0 are always excluded from getting added regardless of this option.

-n, --nodaemon

Stay in foreground attached to the current terminal and start the update process.

-p, --pidfile file

Write the process id to file and use it for locking so that another instance of the daemon cannot be started if the same file is specified. This option has no effect if used in combination with -n, --nodaemon.

-s, --sync

Synchronize internal counters in the database with interface counters for all available interfaces before starting traffic monitoring. Use this option if the traffic between the previous shutdown and the current startup of the daemon needs to be ignored. This option isn't required in normal use because the daemon will automatically synchronize the internal counters after a system reboot, if enough time has passed since the daemon was previously running or if the internal counters are clearly out of sync.

-u, --user user

Set daemon process user to user during startup. user can be either the login of the user or a numerical user id. This option can only be used when the process is started as root.

-v, --version

Show current version of the daemon executable.

-?, --help

Show a command option summary.

## CONFIGURATION
The behaviour of the daemon is configured mainly using the configuration keywords UpdateInterval, PollInterval and SaveInterval in the configuration file.

UpdateInterval defines in seconds how often the interface data is fetched and updated. This is similar to the run interval for alternative cron based updating. However, the difference is that the data doesn't directly get written to disk during updates.

PollInterval defines in seconds how often the list of available interfaces is checked for possible changes. The minimum value is 2 seconds and the maximum 60 seconds. PollInterval also defines the resolution for other intervals.

SaveInterval defines in minutes how often cached interface data is written to disk. A write can only occur during the updating of interface data. Therefore, the value should be a multiple of UpdateInterval with a maximum value of 60 minutes.

The default values of UpdateInterval 30, SaveInterval 5 and PollInterval 5 are usually suitable for most systems and provide a similar behaviour as cron based updating does but with a better resolution for interface changes and fast interfaces.

For embedded and/or low power systems more tuned configurations are possible. In such cases if the interfaces are mostly static the PollInterval can be increased to around 10-30 seconds and UpdateInterval set to 60 seconds. Higher values up to 300 seconds are possible if the interface speed is 10 Mbit or less. SaveInterval can be increased for example to 15, 30 or even 60 minutes depending on how often the data needs to be viewed.

## SIGNALS
The daemon is listening to signals SIGHUP, SIGINT and SIGTERM. Sending the SIGHUP signal to the daemon will cause cached data to be written to disk, a rescan of the database directory and a reload of settings from the configuration file. However, the pid file location will not be changed even if it's configuration setting has been modified.

SIGTERM and SIGINT signals will cause the daemon to write all cached data to disk and then exit.

## FILES
/var/lib/vnstat/

Default database directory.

/etc/vnstat.conf

Config file that will be used unless $HOME/.vnstatrc exists. See the configuration chapter and vnstat.conf(5) for more information.

/var/log/vnstat/vnstat.log

Log file that will be used if logging to file is enable and no other file is specified in the config file.

/var/run/vnstat/vnstat.pid

File used for storing the process id when running as a background process and if no other file is specified in the configuration file or using the command line parameter.

## RESTRICTIONS
Updates need to be executed at least as often as it is possible for the interface to generate enough traffic to overflow the kernel interface traffic counter. Otherwise, it is possible that some traffic won't be seen. With 32-bit interface traffic counters, the maximum time between two updates depends on how fast the interface can transfer 4 GiB. Note that there is no guarantee that a 64-bit kernel has 64-bit interface traffic counters for all interfaces. Calculated theoretical times are:

10 Mbit: 54 minutes

100 Mbit: 5 minutes

1000 Mbit: 30 seconds

Virtual and aliased interfaces cannot be monitored because the kernel doesn't provide traffic information for that type of interfaces. Such interfaces are usually named eth0:0, eth0:1, eth0:2 etc. where eth0 is the actual interface being aliased.

## AUTHOR
Teemu Toivola <tst at iki dot fi>

## SEE ALSO
vnstat(1), vnstati(1), vnstat.conf(5), signal(7)


title: volume_key(8)

text:
# volume_key(8)

## NAME
volume_key - work with volume encryption secrets and escrow packets

## SYNOPIS
volume_key [OPTION]... OPERAND...

## DESCRIPTION
volume_key extracts "secrets" used for volume encryption (for example keys or passphrases) and stores them into separate encrypted "escrow packets", uses a previously created escrow packet to restore access to a volume (e.g. if the user forgets a passphrase), or manipulates the information in escrow packets.

The mode of operation and operands of volume_key are determined by specifying one of the --save, --restore, --setup-volume, --reencrypt, --dump or --secrets options. See the OPTIONS sections for details.

## OPTIONS
In all options described below, VOLUME is a LUKS device, not the plaintext device contained within:

blkid -s TYPE VOLUME

should report TYPE="crypto_LUKS". The following options determine the mode of operation and expected operands of volume_key:

--save

Expects operands VOLUME [PACKET]. Open VOLUME. If PACKET is provided, load the secrets from it. Otherwise, extract secrets from VOLUME, prompting the user if necessary. In any case, store secrets in one or more output packets.

--restore

Expects operands VOLUME PACKET. Open VOLUME and use the secrets in PACKET to make VOLUME accessible again, prompting the user if necessary (e.g. by letting the user enter a new passphrase).

--setup-volume

Expects operands VOLUME PACKET NAME. Open VOLUME and use the secrets in PACKET to set up VOLUME for use of the decrypted data as NAME. Currently NAME is a name of a dm-crypt volume, and this operation makes the decrypted volume available as /dev/mapper/NAME.

This operation should not permanently alter VOLUME (e.g. by adding a new passphrase); the user can of course access and modify the decrypted volume, modifying VOLUME in the process.

--reencrypt

Expects operand PACKET. Open PACKET, decrypting it if necessary, and store the information in one or more new output packets.

--dump

Expects operand PACKET. Open PACKET, decrypting it if necessary, and output the contents of PACKET. The secrets are not output by default.

--secrets

Expects operand PACKET. Open PACKET, decrypting it if necessary, and output secrets contained in PACKET.

--help

Show usage information.

--version

Show version of volume_key.

The following options alter the behavior of the specified operation:

-b, --batch

Run in batch mode. Read passwords and passphrases from standard input, each terminated by a NUL character. If a packet does not match a volume exactly, fail instead of prompting the user.

-d, --nss-dir DIR

Use private keys in NSS database in DIR to decrypt public key-encrypted packets.

-o, --output PACKET

Write the default secret to PACKET. Which secret is the default depends on volume format: it should not be likely to expire, and it should allow restoring access to the volume using --restore.

--output-data-encryption-key PACKET

Write the data encryption key (the key directly used to encrypt the actual volume data) to PACKET.

--output-passphrase PACKET

Write a passphrase that can be used to access the volume to PACKET.

--create-random-passphrase PACKET

Generate a random alphanumeric passphrase, add it to VOLUME (without affecting other passphrases) and store the random passphrase into PACKET.

-c, --certificate CERT

Load a certificate from the file specified by CERT and encrypt all output packets using the public key contained in the certificate. If this option is not specified, all output packets are encrypted using a passphrase. Note that CERT is a certificate file name, not a NSS certificate nickname.

--output-format FORMAT

Use FORMAT for all output packets. FORMAT can currently be one of asymmetric (use CMS to encrypt the whole packet, requires a certificate), asymmetric_wrap_secret_only (wrap only the secret, requires a certificate), passphrase (use GPG to encrypt the whole packet, requires a passphrase).

--unencrypted

Only dump the unencrypted parts of the packet, if any, with --dump. Do not require any passphrase or private key access.

--with-secrets

Include secrets in the output of --dump

## EXIT STATUS
volume_key returns with exit status 0 on success, 1 on error.

## NOTES
The only currently supported volume format is LUKS.

## EXAMPLE
Typical usage of volume_key proceeds as follows. During system installation or soon after, back up the default secret of a volume, and add a system-specific random passphrase. Encrypt both using a certificate:

volume_key --save VOLUME -c CERT -o PACKET_DEFAULT --create-random-passphrase PACKET_PASSPHRASE

Store PACKET_DEFAULT and PACKET_PASSPHRASE outside of the computer. If the user forgets a passphrase, and you can access the computer, decrypt PACKET_DEFAULT using the certificate private key (which should never leave a secure machine):

volume_key --reencrypt -d NSS_DB PACKET_DEFAULT -o PACKET_DEFAULT_PW

Then boot the computer (e.g. using a "rescue mode"), copy PACKET_DEFAULT_PW to it, and restore access to the volume: volume_key --restore VOLUME PACKET_DEFAULT_PW

If the user forgets the passphrase, and you cannot access the computer, decrypt the backup passphrase:

volume_key --secrets PACKET_PASSPHRASE

and tell the backup passphrase to the user. (You can later generate a new backup passphrase.)


vpnc

package: vpnc

title: vpnc(8)

text:
# vpnc(8)

## NAME
vpnc - client for Cisco VPN3000 Concentrator, IOS and PIX

## SYNOPSIS
vpnc [--version] [--print-config] [--help] [--long-help] [options] [config files]

## DESCRIPTION
This manual page documents briefly the vpnc and vpnc-disconnect commands.

vpnc is a VPN client for the Cisco 3000 VPN Concentrator, creating a IPSec-like connection as a tunneling network device for the local system. It uses the TUN/TAP driver in Linux kernel 2.4 and above and device tun(4) on BSD. The created connection is presented as a tunneling network device to the local system.

OBLIGATORY WARNING: the most used configuration (XAUTH authentication with pre-shared keys and password authentication) is insecure by design, be aware of this fact when you use vpnc to exchange sensitive data like passwords!

The vpnc daemon by itself does not set any routes, but it calls vpnc-script to do this job. vpnc-script displays a connect banner. If the concentrator supplies a network list for split-tunneling these networks are added to the routing table. Otherwise the default-route will be modified to point to the tunnel. Further a host route to the concentrator is added in the later case. If the client host needs DHCP, care must be taken to add another host route to the DHCP-Server around the tunnel.

The vpnc-disconnect command is used to terminate the connection previously created by vpnc and restore the previous routing configuration.

## CONFIGURATION
The daemon reads configuration data from the following places:

- command line options

- config file(s) specified on the command line

- /etc/vpnc/default.conf

- /etc/vpnc.conf

- prompting the user if not found above

vpnc can parse options and configuration files in any order. However the first place to set an option wins. configuration filenames which do not contain a / will be searched at /etc/vpnc/<filename> and /etc/vpnc/<filename>.conf. Otherwise <filename> and <filename>.conf will be used. If no configuration file is specified on the command-line at all, both /etc/vpnc/default.conf and /etc/vpnc.conf will be loaded.

Additionally, if the configuration file "-" is specified on the command-line vpnc will read configuration from stdin. The configuration is parsed and the connection proceeds when stdin is closed or the special character CEOT (CTRL-D) is read.

## OPTIONS
The program options can be either given as arguments (but not all of them for security reasons) or be stored in a configuration file.

--gateway <ip/hostname>

IP/name of your IPSec gateway

conf-variable: IPSec gateway <ip/hostname>

--id <ASCII string>

your group name

conf-variable: IPSec ID <ASCII string>

--id-type <ipv4/fqdn/user/key/#>

IKE Phase 1 Identification type

Default: 0

conf-variable: IPSec IDType <ipv4/fqdn/user/key/#>

(configfile only option)

your group password (cleartext)

conf-variable: IPSec secret <ASCII string>

(configfile only option)

your group password (obfuscated)

conf-variable: IPSec obfuscated secret <hex string>

--username <ASCII string>

your username

conf-variable: Xauth username <ASCII string>

(configfile only option)

your password (cleartext)

conf-variable: Xauth password <ASCII string>

(configfile only option)

your password (obfuscated)

conf-variable: Xauth obfuscated password <hex string>

--domain <ASCII string>

(NT-) Domain name for authentication

conf-variable: Domain <ASCII string>

--xauth-inter

enable interactive extended authentication (for challenge response auth)

conf-variable: Xauth interactive

--vendor <cisco/juniper/netscreen>

vendor of your IPSec gateway

Default: cisco

conf-variable: Vendor <cisco/juniper/netscreen>

--natt-mode <natt/none/force-natt/cisco-udp>

Which NAT-Traversal Method to use:

- natt -- NAT-T as defined in RFC3947

- none -- disable use of any NAT-T method

- force-natt -- always use NAT-T encapsulation even without presence of a NAT device (useful if the OS captures all ESP traffic)

- cisco-udp -- Cisco proprietary UDP encapsulation, commonly over Port 10000

Note: cisco-tcp encapsulation is not yet supported

Default: natt

conf-variable: NAT Traversal Mode <natt/none/force-natt/cisco-udp>

--script <command>

command is executed using system() to configure the interface, routing and so on. Device name, IP, etc. are passed using environment variables, see README. This script is executed right after ISAKMP is done, but before tunneling is enabled. It is called when vpnc terminates, too

Default: /etc/vpnc/vpnc-script

conf-variable: Script <command>

--dh <dh1/dh2/dh5>

name of the IKE DH Group

Default: dh2

conf-variable: IKE DH Group <dh1/dh2/dh5>

--pfs <nopfs/dh1/dh2/dh5/server>

Diffie-Hellman group to use for PFS

Default: server

conf-variable: Perfect Forward Secrecy <nopfs/dh1/dh2/dh5/server>

--enable-1des

enables weak single DES encryption

conf-variable: Enable Single DES

--enable-no-encryption

enables using no encryption for data traffic (key exchanged must be encrypted)

conf-variable: Enable no encryption

--application-version <ASCII string>

Application Version to report. Note: Default string is generated at runtime.

Default: Cisco Systems VPN Client 0.5.4:Linux

conf-variable: Application version <ASCII string>

--ifname <ASCII string>

visible name of the TUN/TAP interface

conf-variable: Interface name <ASCII string>

--ifmode <tun/tap>

mode of TUN/TAP interface:

- tun: virtual point to point interface (default)

- tap: virtual ethernet interface

Default: tun

conf-variable: Interface mode <tun/tap>

--ifmtu <0-65535>

Set MTU for TUN/TAP interface (default 0 == automatic detect)

conf-variable: Interface MTU <0-65535>

--debug <0/1/2/3/99>

Show verbose debug messages

-

0: Do not print debug information.

-

1: Print minimal debug information.

-

2: Show statemachine and packet/payload type information.

-

3: Dump everything exluding authentication data.

- 99: Dump everything INCLUDING AUTHENTICATION data (e.g. PASSWORDS).

conf-variable: Debug <0/1/2/3/99>

--no-detach

Don't detach from the console after login

conf-variable: No Detach

--pid-file <filename>

store the pid of background process in <filename>

Default: /var/run/vpnc.pid

conf-variable: Pidfile <filename>

--local-addr <ip/hostname>

local IP to use for ISAKMP / ESP / ... (0.0.0.0 == automatically assign)

Default: 0.0.0.0

conf-variable: Local Addr <ip/hostname>

--local-port <0-65535>

local ISAKMP port number to use (0 == use random port)

Default: 500

conf-variable: Local Port <0-65535>

--udp-port <0-65535>

Local UDP port number to use (0 == use random port). This is only relevant if cisco-udp nat-traversal is used. This is the _local_ port, the remote udp port is discovered automatically. It is especially not the cisco-tcp port.

Default: 10000

conf-variable: Cisco UDP Encapsulation Port <0-65535>

--dpd-idle <0,10-86400>

Send DPD packet after not receiving anything for <idle> seconds. Use 0 to disable DPD completely (both ways).

Default: 600

conf-variable: DPD idle timeout (our side) <0,10-86400>

--non-inter

Don't ask anything, exit on missing options

conf-variable: Noninteractive

--auth-mode <psk/cert/hybrid>

Authentication mode:

- psk: pre-shared key (default)

- cert: server + client certificate (not implemented yet)

- hybrid: server certificate + xauth (if built with openssl support)

Default: psk

conf-variable: IKE Authmode <psk/cert/hybrid>

--ca-file <filename>

filename and path to the CA-PEM-File

conf-variable: CA-File <filename>

--ca-dir <directory>

path of the trusted CA-Directory

Default: /etc/ssl/certs

conf-variable: CA-Dir <directory>

--target-network <target network/netmask>

Target network in dotted decimal or CIDR notation

Default: 0.0.0.0/0.0.0.0

conf-variable: IPSEC target network <target network/netmask>

--password-helper <executable>

path to password program or helper name

conf-variable: Password helper <executable>

--print-config

Prints your configuration; output can be used as vpnc.conf

## FILES
/etc/vpnc.conf /etc/vpnc/default.conf

The default configuration file. You can specify the same config directives as with command line options and additionally IPSec secret and Xauth password both supplying a cleartext password. Scrambled passwords from the Cisco configuration profiles can be used with IPSec obfuscated secret and Xauth obfuscated password. See EXAMPLES for further details.

/etc/vpnc/*.conf

vpnc will read configuration files in this directory when the config filename (with or without .conf) is specified on the command line.

## EXAMPLES
This is an example vpnc.conf with pre-shared keys:

IPSec gateway vpn.example.com IPSec ID ExampleVpnPSK

IKE Authmode psk

IPSec secret PskS3cret!

Xauth username user@example.com

Xauth password USecr3t

And another one with hybrid authentication (requires that vpnc was built with openssl support):

IPSec gateway vpn.example.com IPSec ID ExampleVpnHybrid

IKE Authmode hybrid

CA-Dir /etc/vpnc

or

CA-File /etc/vpnc/vpn-example-com.pem

IPSec secret HybS3cret?

Xauth username user@example.com

Xauth password 123456

The lines begin with a keyword (no leading spaces!). The values start exactly one space after the keywords, and run to the end of line. This lets you put any kind of weird character (except CR, LF and NUL) in your strings, but it does mean you can't add comments after a string, or spaces before them.

In case the the CA-Dir option is used, your certificate needs to be named something like 722d15bd.X, where X is a manually assigned number to make sure that files with colliding hashes have different names. The number can be derived from the certificate file itself:

openssl x509 -subject_hash -noout -in /etc/vpnc/vpn-example-com.pem

See also the --print-config option to generate a config file, and the example file in the package documentation directory where more advanced usage is demonstrated.

Advanced features like manual setting of multiple target routes and disabling /etc/resolv.conf rewriting is documented in the README of the vpnc package.

## AUTHOR
This man-page has been written by Eduard Bloch <blade(at)debian.org> and Christian Lackas <delta(at)lackas.net>, based on vpnc README by Maurice Massar <vpnc(at)unix-ag.uni-kl.de>. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 any later version published by the Free Software Foundation.

On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
pcf2vpnc(1), cisco-decrypt(1), ip(8), ifconfig(8), route(1), http://www.unix-ag.uni-kl.de/~massar/vpnc/


vrrpd

package: vrrpd

title: vrrpd(8)

text:
# vrrpd(8)

## NAME
vrrpd - Virtual Router Redundancy Protocol Deamon

## SYNOPSIS
vrrpd -i ifname -v vrid [-f piddir] [-s] [-a auth] [-p prio] [-m ifname] [-c delta] [-nhD] ipaddr

## DESCRIPTION
vrrpd is an implementation of VRRPv2 as specified in rfc2338. It run in userspace for linux. In short, VRRP is a protocol which elects a master server on a LAN and the master answers to a 'virtual ip address'. If it fails, a backup server takes over the ip address.

A longer answer in the rfc2338 abstract : "This memo defines the Virtual Router Redundancy Protocol (VRRP). VRRP specifies an election protocol that dynamically assigns responsibility for a virtual router to one of the VRRP routers on a LAN. The VRRP router controlling the IP address(es) associated with a virtual router is called the Master, and forwards packets sent to these IP addresses. The election process provides dynamic fail over in the forwarding responsibility should the Master become unavailable. This allows any of the virtual router IP addresses on the LAN to be used as the default first hop router by end-hosts. The advantage gained from using VRRP is a higher availability default path without requiring configuration of dynamic routing or router discovery protocols on every end-host." Copyright (C) The Internet Society (1998). All Rights Reserved.

Monitored interface functionality is useful on high availability router or firewall platforms, where single interface failure can cause asymmetrical routing issues.

Ideally, what is required is a method for a vrrpd process to detect a failure of the 'other' network interface, and lower it's own VRRP priority below that of the 'backup' vrrpd process. This allows failover to occur normally.

### OPTIONS
-h

display this short inlined help

-n

Don't handle the virtual mac address

-D

Go into background mode, daemonize

-i ifname

the interface name to run on. More than one interface can be monitored by the one vrrpd process, a list like "eth1 eth2 eth3 eth4 eth5" is acceptable. Losing link-beat on any of these will cause the priority of that vrrpd process to be decreased by the specified value, or a default of 100. Note that as MII calls are used, this implementation is limited to Fast and Gigabit Ethernet chipsets only - 10Mbps Ethernet cards will not work.

-v vrid

the id of the virtual server [1-255]

-s

iqxSwitch the preemption mode (Enabled by default)

-a auth

set the authentification type auth=(none|pw/hexkey|ah/hexkey) hexkey=0x[0-9a-fA-F]+ Password is a symbolic security, anybody with a sniffer can break it. AH is a bit stronger.

-p prio

Set the priority of this host in the virtual server (dfl: 100)

-f piddir

specify the directory where the pid file is stored (dfl: /var/run)

-d delay

Set the advertisement interval (in sec) (dfl: 1) -m ifname Interface(s) to monitor for failure. Use " " for multiple interfaces

-c delta

Set the delta to decrease priority by (dfl: 50)

ipaddr

the ip address(es) of the virtual server

## EXAMPLES
vrrpd -i eth0 -v 50 10.0.0.1

run vrrp on the interface eth0 with the virtual id 50 and 10.0.0.1 as virtual ip address

## AUTHOR
vrrpd was written by Jerome Etienne <jetienne@arobas.net>, it was later improved by Alexandre Cassert <acassen@linux-vs.org> and David Hunter <david.hunter@gen-i.co.nz>

## BUGS
Suggestions, bugs or questions should be directed to the Sourceforge project at http://sourceforge.net/projects/vrrpd/

Bug reports regarding this package should be submitted to Debian using the reportbug or bug tool.

## MORE INFO
For more information please read the documents under /usr/share/doc/vrrpd/ : README, README.Debian FAQ and TODO.


vsftpd

package: vsftpd

title: vsftpd(8)

summary: Very Secure FTP Daemon

text:
# vsftpd(8)

## NAME
vsftpd — Very Secure FTP Daemon

## SYNOPSIS
vsftpd

[configuration file and / or options]

## DESCRIPTION
vsftpd is the Very Secure File Transfer Protocol Daemon. The server can be launched via a “super-server” such as inetd(8) or xinetd(8). Alternatively, vsftpd can be launched in standalone mode, in which case vsftpd itself will listen on the network. This latter mode is easier to use, and recommended. It is activated by setting listen=YES in /etc/vsftpd.conf. Direct execution of the vsftpd binary will then launch the FTP service ready for immediate client connections.

## OPTIONS
An optional configuration file or files may be given on the command line. These files must be owned as root if running as root. Any command line option not starting with a "-" character is treated as a config file that will be loaded. Note that config files are loaded in the strict order that they are encountered on the command line. If no config files are specified, the default configuration file of /etc/vsftpd.conf will be loaded, after all other command line options are processed.

Supported options are:

-v

Print the version information and exit, even if other options are encountered.

-ooption=value

Set a single option, value pair as per the format in the config file. Multiple -o options are supported, and they are applied in strict order relative to their appearance on the command line, including intermingling with loading of config files.

## EXAMPLES
vsftpd -olisten=NO /etc/vsftpd.conf -oftpd_banner=blah

That example overrides vsftpd's built-in default for the "listen" option to be NO, but then loads /etc/vsftpd.conf which may override that setting. Finally, the "ftpd_banner" setting is set to "blah", which overrides any default vsftpd setting and any identical setting that was in the config file.

## FILES
/etc/vsftpd.conf

## SEE ALSO
vsftpd.conf(5)


ubclogd

package: vzctl

title: ubclogd(8)

text:
# ubclogd(8)

## NAME
ubclogd - utility for periodical logging of selected user beancounters.

## SYNOPSIS
ubclogd [-i seconds] [-r kilobytes] [-o logfile] [-n]

ubclogd -h

## DESCRIPTION
The purpose of this utility is to log snapshots of some selected user beancounter parameters.

Upon startup, ubclogd checks that it is run under root account, and that /proc/user_beancounters is accessible. It when opens and acquires an exclusive lock on its log file. Then, it tries to grab some disk space by adding blocks of zeroes to the end of file. This space is used to write the log file, so in case of filesystem space shortage log will still be available.

Then it forks a daemon, which task is to periodically wake up and log current values of some user beancounters, reading it from /proc/user_beancounters file. It also maintains free space at the end of file by periodically writing blocks of zeroes to it.

Logged beancounters are: kmemsize, numproc, privvmpages, physpages, and oomguarpages. This list is compiled in and can not be changed from command line.

Log file format is similar to this of /proc/user_beancounters, separated by lines with time stamps.

## OPTIONS
-i seconds

Parameters gather interval, in seconds. Default is 60 seconds.

-r kilobytes

Amount of space to reserve for log file, in kilobytes. Default is 512 KB.

-o logfile

Name of log file to write log to. Default is /var/log/ubc.

-n

Do not fork into background.

-h

Outputs a short help message, including compiled in defaults for above command line parameters.

## SIGNALS
Below is the list of signals for which ubclogd has a special handlers.

SIGUSR1

Upon receiving the signal, extra space in log file is truncated, and ubclogd enters "do not maintain extra space" mode. This can be used either before rotating ubclogd's log file, or before stopping it, if you do not want to have many zero-filled blocks at end of file.

SIGHUP

Makes ubclogd to reopen its log file, and restore "maintain extra space" mode. This is used after log rotation.

## RETURN VALUE
Returns 0 upon success. If some operation before forking into background failed, returns 1.

## FILES
/proc/user_beancounters, /var/log/ubc.

## CAVEATS
It is not convenient to read the log file, because it contains a lot of null characters at the end. This is the price you have to pay for ubclogd ability to reserve free space.

Log rotating is a bit complex: you have to send SIGUSR1 to process, when rename its log file, and at last send SIGHUP.

## SEE ALSO
kill(1).

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzauth

title: vzauth(8)

summary: authenticate a user in a CT

text:
# vzauth(8)

## NAME
vzauth - authenticate a user in a CT

## SYNOPSIS
vzauth [-t system|pleskadmin] [-g gid] ctid user

## DESCRIPTION
This utility is used to authenticate the user in a CT ctid. User password is passed to stdin. This utility mounts the CT if it is unmounted, reads $VE_ROOT/etc/shadow and then uses crypt(3) to authenticate the user. If -g specified, user is checked to be a member of group gid.

## DIAGNOSTICS
0

access granted

1

invalid parameters

2

unable to read VE_ROOT from the CT configuration file.

3

access denided

4

unable to mount the CT

5

unable to read the password

6

unable to open /etc/shadow

7

unable to open /etc/psa/.psa.shadow

## EXAMPLES
echo 'passwd' | vzauth 1 root

## SEE ALSO
crypt(3)

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzcfgscale

title: vzcfgscale(8)

summary: scale a CT configuration file.

text:
# vzcfgscale(8)

## NAME
vzcfgscale - scale a CT configuration file.

## SYNOPSIS
vzcfgscale [options] configfile

## DESCRIPTION
This utility is used to scale a Container configuration. It multiplies Container resource control parameters by the number passed as an argument.

## OPTIONS
-o, --output-file outfile

Output the scaled configuration into the outfile. By default, the utility prints its output to the screen. Note that the file specified cannot be the same as input file configfile, otherwise you will lose the configuration file content.

-a, --all coeff

Multiply all Container parameters by the coefficient specified.

-c, --cpu-only coeff

Multiply the CPU parameters by the coefficient specified.

-d, --disk-only coeff

Multiply the disk quota parameters by the coefficient specified.

-u, --ubc-only coeff

Multiply the UBC parameters by the coefficient specified.

-n, --network-only coeff

Multiply the network bandwidth parameters by the coefficient specified.

-r, --remove

Skip the CT-specific parameters like VE_ROOT, VE_PRIVATE, etc. This option is used for producing configuration samples to be employed as an argument for the --config option of the vzctl create command.

After the CT configuration file has been scaled it is recommended to check the CT configuration validity with the vzcfgvalidate(8) utility.

## DIAGNOSTICS
Normally, the exit status is 0. On error, the exit status is 1.

## SEE ALSO
ve.conf(5), vzcfgvalidate(8).

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzcfgvalidate

title: vzcfgvalidate(8)

summary: validate the CT configuration file

text:
# vzcfgvalidate(8)

## NAME
vzcfgvalidate - validate the CT configuration file

## SYNOPSIS
vzcfgvalidate [-r | -i] configfile

## DESCRIPTION
This utility checks validity of resource control parameters in the CT configuration configfile file. Configurations where resources allowed for a Container exceed the system capacity are not valid and are dangerous from the stability point of view. There are three severity levels in the output: Error, Warning, Recommendation.

## OPTIONS
-r

Enter the correction mode to fix the wrong resources configuration.

-i

Enter the interactive correction mode.

## DIAGNOSTICS
Normally, the exit status is 0. On a program execution error, the exit status is 1. If the validation fails, the exit status is 2.

## SEE ALSO
ve.conf(5).

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved.


vzcpucheck

title: vzcpucheck(8)

text:
# vzcpucheck(8)

## NAME
vzcpucheck - show information about the CPU power and utilization.

## SYNOPSIS
vzcpucheck [-v] [-x]

## DESCRIPTION
This script outputs information on the CPU power and utilization.

## OPTIONS
-v

Display information for each CT.

-x

Output in XML format.

## RETURN CODE
Returns 0 upon success.

## SEE ALSO
vzctl(8).

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzctl

title: vzctl(8)

summary: utility to control a Container.

text:
# vzctl(8)

## NAME
vzctl - utility to control a Container.

## SYNOPSIS
vzctl [--quiet | --verbose] create ctid | --ostemplate name} [--private path] [--root path] [--ipadd addr[/mask]] [--hostname name] [--skip_app_templates] [--name name] [--description desc] [--force]

vzctl [--quiet | --verbose] reinstall ctid [--skipbackup] [--resetpwdb] [--skipscripts]

vzctl pause ctid

vzctl runscript ctid script

vzctl execaction ctid action

vzctl [--quiet | --verbose] set ctid [--save]

[-p, --numproc items[:items]] [--vmguarpages pages[:pages]] [-l, --lockedpages pages[:pages]] [--privvmpages pages[:pages]] [--shmpages pages[:pages]] [-n, --numfile items[:items]] [-f, --numflock items[:items]] [-t, --numpty items[:items]] [-i, --numsiginfo items[:items]] [-e, --numiptent num[:num]] [--swappages num[:num]] [--physpages pages[:pages]] [--ram bytes] [--swap bytes] [--numnetif num] [--memguarantee auto|value] [--vm_overcommit N]

[--diskspace num] [--quotaugidlimit num] [--jquota on|off]

[--cpuunits value] [--cpulimit value] [--cpus value] [--cpumask {N[,N][,N-N]|all|auto}] [--nodemask {N[,N][,N-N]|all}]

[--ipadd addr[/mask]] [--ipdel addr|all]

[--netif_add <ifname[,mac,host_ifname,host_mac]]>] [--netif_del <ifname>]

[--ifname <ifname> [--mac <mac>] [--host_ifname <name>] [--host_mac <mac>] [--ipadd <addr>] [--ipdel <addr>] [--gw <addr>] [--gw6 <addr>] [--dhcp <yes|no>] [--dhcp6 <yes|no>] [--network <id>] [--configure <none|all>]]

[--ext_ipadd addr] [--ext_ipdel addr|all] [--hostname name] [--nameserver addr] [--searchdomain name] [--userpasswd user:password [--crypted]]

[--onboot yes|no] [--bootorder number]

[--rate dev:class:Kbits] [--ratebound yes|no]

[--root path] [--noatime yes|no] [--bindmount_add [src:]dst[,nosuid,noexec,nodev] [--bindmount_del dst|all] [--mount_opts opt[,opt]]

[--devnodes device:r|w|rw|none] [--netdev_add name] [--netdev_del name] [--pci_add [domain:]bus:slot.func] [--pci_del n[domain:]bus:slot.func] [--iptables name[,...]] [--netfilter mode] [--disabled yes|no] [--applyconfig name] [--setmode restart|ignore] [--description desc] [--name name] [--ioprio prio] [--iolimit limit] [--iopslimit limit] [--features name:on|off[,...]] [--distribution dist]

[--ha_enable yes|no] [--ha_prio number]

vzctl [--quiet | --verbose] destroy | mount | umount | start | restart | status | enter | console |

vzctl stop ctid|name [--fast] [--skip-umount]

vzctl start ctid|name [--wait] [--skip-fsck]

vzctl monitor ctid|name|0

vzctl suspend ctid|name

vzctl resume ctid|name [--skip-fsck]

vzctl snapshot ctid|name [--id uuid] [--name name] [--description desc] [--skip-suspend]

vzctl snapshot-switch | snapshot-delete ctid|name --id uuid

vzctl snapshot-mount CTID --id uuid --target path

vzctl snapshot-umount CTID --id uuid

vzctl snapshot-list CTID [-H] [-o field[,field...] [--id uuid]

vzctl [--quiet | --verbose] exec | exec2 | exec3 ctid|name command [arg ...]

vzctl convert ctid|name

vzctl register path ctid [--force]

vzctl unregister ctid|name

vzctl compact ctid|name [--defrag]

vzctl --help | --version

## DESCRIPTION
Utility vzctl runs on host server (HS) and performs direct manipulations with Container (CT).

Containers can be referred to by numeric ctid (or name which can be assigned with --name option). Note that CT ID <= 100 are reserved for OpenVZ internal purposes.

## OPTIONS

### Flags
These flags can be used with any vzctl command.

--quiet

Disables logging to a console (a terminal). Logging to a log file is not affected.

--verbose

Sets console (terminal) logging level to maximum value. Logging to a log file is not affected.

### Setting CT parameters
set ctid

This command sets various CT parameters. If flag --save is given, parameters are saved in CT configuration file ve.conf(5). If CT is currently running, vzctl applies these parameters to CT, in case --setmode option specified apply logic for parameters that can't be applied or tunning CT will be changed, if restart - restart CT, if ignore - ignore error. Parameters that can not be applied runtime are quotaugidlimit, bindmount, features, and iptables. The following options can be used with set command.

Miscellaneous parameters

--setmode restart|ignore

Change default mode for apply parameters that can not be applied on running CT. restart - restart CT, ignore - ignore error.

--onboot yes|no

Sets whether this CT will be started during system boot up. CT will not be auto-started during system boot up unless this parameter is set to yes.

--bootorder number

Sets the boot order priority for this CT. The higher the number is, the earlier in the boot process this container starts. By default this parameter is unset, this is considered to be the lowest priority, so containers with unset bootorder will start last.

--root path

Sets path to root directory for this CT. This is essentially a mount point for CT root. Argument can contain literal string $VEID, which will be substituted with numeric CT ID. Changing this parameter is not recommended, better edit vz(5) global configuration file.

--userpasswd user:password

Sets password for given user in CT, creating the user if it does not exists. Note that this option is not saved in configuration file at all (so --save flag is useless), it is applied to CT (by modifying its /etc/passwd and /etc/shadow files). If the --crypted parameter is specified, the system assumes that the passwords are encrypted.

In case CT root is not mounted, it is automatically mounted, then all appropriate file changes are applied, then it is unmounted.

Note that CT area should be created before using this option.

--disabled yes|no

Disable CT start. For force start disabled CT option --force can be used.

--name name

Bind CT with name, it allows to use name instead of CT ID. The valid symbols for name are [0-9][aA-Zz][ -_.] and all international symbols.

--description desc

Assign description for CT. It can be viewed by vzlist(8) utility.

--distribution dist

Assign distribution for CT. It can be viewed by vzlist(8) utility.

Network related parameters

--ipadd addr[/mask

Adds the IP address and subnet mask for the Container. To assign network masks to Containers operating in the venet0 mode, the USE_VENET_MASK parameter in the Containers configuration file must be set to "yes". Note that this option is incremental, so addr are added to already existing ones.

--ipdel addr | all

Removes IP address addr from CT. If you want to remove all addresses, use --ipdel all.

--ext_ipadd addr

Assign the external IP address to the Container. External IP addresses are considered valid IP addresses by the venet0 adapter, though they are not set as alias addresses inside Containers and are not announced via Address Resolution Protocol (ARP). You can assign the same external IP address to several Containers, irrespective of whether they reside on the same or different Hardware Nodes.

--ext_ipdel addr

Remove the external IP address from the Container. To delete all external IP addresses assigned to the Container, use ext_ipdel all.

--netif_add ifname[,mac,host_ifname,host_mac]

Adds virtual ethernet device to given CT. Where ifname is ethernet device name in the CT, mac its MAC address, host_ifname is ethernet device name on the host and host_mac its MAC address. MAC addresses has format like XX:XX:XX:XX:XX:XX. All parameters except ifname are option and automatically generated if not specified. Per-interface configuration.

To select the interface to configure, use --ifname name option.

--mac XX:XX:XX:XX:XX:XX - MAC address of interface inside CT

--host_ifname name - interface name for virtual interface on host server

--host_mac XX:XX:XX:XX:XX:XX - MAC address of interface on host server

--gw ipaddr - default IPv4 gateway for interface

--gw6 ipaddr - default IPv6 gateway for interface

--ipadd ipaddr - add IP address(es) to interface

--ipdel ipaddr - delete IP address(es) from interface

--dhcp yes|no - turn on/off IPv4 dhcp

--dhcp6 yes|no - turn on/off IPv6 dhcp

--configure none|all - apply/ignore the network settings (gw,ip,dhcp) from the Container configuration file. Configuring any of the network settings automatically sets this option to "all".

--network id - connect virtual interface to virtual network with the given id. The valid symbols for network are [0-9][aA-Zz][ -_.#()] and all international symbols.

--mac_filter on|off - enable/disable packets filtering by MAC address and MAC changing on veth device inside CT.

--netif_del dev_name

Removes virtual ethernet device from CT.

--hostname name

Sets CT hostname and writes it to the appropriate file inside CT (distribution-dependent).

--nameserver addr

Sets DNS server IP address for CT. If you want to set several nameservers, you should do it at once, so use --nameserver option multiple times in one call to vzctl, as all the name server values set in previous calls to vzctl gets overwritten.

--searchdomain name

Sets DNS search domains for CT. If you want to set several search domains, you should do it at once, so use --searchdomain option multiple times in one call to vzctl, as all the search domain values set in previous calls to vzctl gets overwritten.

Resource limits

The following options sets barrier and limit for various user beancounters. Each option requires one or two arguments. In case of one argument, vzctl sets barrier and limit to the same value. In case of two colon-separated arguments, the first is a barrier, and the second is a limit. Arguments are in items, pages or bytes. Note that the page size is architecture-specific, it is 4096 bytes on IA32 platform.

There is an ability to accept different suffixes for set parameters (except the parameters that name started with num). E.g. vzctl set XXX --privvmpages 5M:6M should set privvmpages barrier to 5 megabytes and limit to 6 megabytes.

Available suffixes are:

t, T -- terabytes

g, G -- gigabytes

m, M -- megabytes

k, K -- kilobytes

p, P -- pages (page is 4096 bytes on x86 architecture, other arches may differ)

-p, --numproc items[:items]

Maximum number of processes and kernel-level threads. Setting the barrier and the limit to different values does not make practical sense.

--vmguarpages pages[:pages]

Memory allocation guarantee. This parameter controls how much memory is available to CT. The barrier is the amount of memory that CT's applications are guaranteed to be able to allocate. The meaning of the limit is currently unspecified; it should be set to 2,147,483,647.

-l, --lockedpages pages[:pages]

Maximum number of pages acquired by mlock(2).

--privvmpages pages[:pages]

Allows controlling the amount of memory allocated by the applications. For shared (mapped as MAP_SHARED) pages, each CT really using a memory page is charged for the fraction of the page (depending on the number of others using it). For "potentially private" pages (mapped as MAP_PRIVATE), CT is charged either for a fraction of the size or for the full size if the allocated address space. It the latter case, the physical pages associated with the allocated address space may be in memory, in swap or not physically allocated yet. The barrier and the limit of this parameter control the upper boundary of the total size of allocated memory. Note that this upper boundary does not guarantee that CT will be able to allocate that much memory. The primary mechanism to control memory allocation is the --vmguarpages guarantee.

--shmpages pages[:pages]

Maximum IPC SHM segment size. Setting the barrier and the limit to different values does not make practical sense.

-n, --numfile items[:items]

Maximum number of open files. Setting the barrier and the limit to different values does not make practical sense.

-f, --numflock items[:items]

Maximum number of file locks. Safety gap should be between barrier and limit.

-t, --numpty items[:items]

Number of pseudo-terminals (PTY). Note that in OpenVZ each CT can have no more than 255 PTYs. Setting the barrier and the limit to different values does not make practical sense.

-i, --numsiginfo items[:items]

Number of siginfo structures. Setting the barrier and the limit to different values does not make practical sense.

-e, --numiptent num[:num]

Number of iptables (netfilter) entries. Setting the barrier and the limit to different values does not make practical sense.

--physpages pages[:pages]

This parameter limits the physical memory (RAM) available to processes inside a container. The barrier is ignored, and the limit sets the limit.

--swappages pages[:pages]

This parameter limits the amount of swap space that can be allocated to processes running in a Container.

--ram bytes

The amount of RAM that can be used by the processes of a Container, in bytes. You can use the following suffixes to set RAM in other measurement units:

k, K -- kilobytes

m, M -- megabytes

g, G -- gigabytes

t, T -- terabytes

--swap bytes

The amount of swap space that can be used by the Container for swapping out memory once the RAM is exceeded, in bytes. You can use the following suffixes to set swap in other measurement units:

k, K -- kilobytes

m, M -- megabytes

g, G -- gigabytes

t, T -- terabytes

--vm_overcommit N

This parameter controls the memory allocation guarantee. It is calculated as (physpages + swappages) * N. By default, the parameter is equal to 1.

--memguarantee auto|value

Set the amount of memory (RAM) that will be guaranteed to a Container. The guaranteed memory is a percentage of total RAM that is set for the Container with the '--memsize' option. By default, memory guarantee is set to 'auto' (0% - no gurantee).

-e, --numnetif num

Maximum number of network interfaces. --pagecache-isolation yes|no By default page cache evicted from a memory cgroup (Container) on local pressure is stored in Nodes memory unmodified in case there is free RAM on the Node, thus the pages can be fetched back later without costly disk accesses improving the overall Node performance. Enable page cache isolation (set to yes) tuned off this logic.

CPU fair scheduler parameters

These parameters control CPU usage by CT.

--cpuunits num

sets CPU weight for CT. Argument is positive number, which passed to and used in kernel fair scheduler. The larger the number is, the more CPU time this CT get. Maximum value is 500000, minimal is 8. Number is relative to weights of all the other running CTs. If cpuunits not specified the default value 1000 is used.

--cpulimit num

Sets the CPU limit, in percent or megahertz (MHz), the Container is not allowed to exceed. By default, the limit is set in percent. To specify the limit in MHz, specify "m" after the value. Note: If the computer has 2 CPUs, the total CPU time equals 200%.

--cpus num

sets number of CPUs available in the CT.

--cpumask {N[,N][N-N]|all|auto}

Defines the CPUs on the physical server to use for executing the processes running in the Container. A CPU affinity mask can be a single CPU number or a CPU range separated by commas (0,2,3-10). If used with the --nodemask option, value of auto automatically assigns to a Container all CPUs from the specified NUMA node. Without the --nodemask option, it applies the default settings to a Container.

--nodemask {N[,N][N-N]|all}

Defines the NUMA node on the physical server to use for executing the processes running in the Container. A node mask can be a single number or a range separated by commas (0,2,3-10). --nodemask must be used with the --cpumask option.

--iptables name[,...]

Restrict access to iptable modules inside CT (by default modules defined in the IPTABLES variable in the global configuration file vz.conf(5) are accessible inside CT). Multiple comma-separated values can be specified. You can use the following values for name: iptable_filter, iptable_mangle, ipt_limit, ipt_multiport, ipt_tos, ipt_TOS, ipt_REJECT, ipt_TCPMSS, ipt_tcpmss, ipt_ttl, ipt_LOG, ipt_length, ip_conntrack, ip_conntrack_ftp, ip_conntrack_irc, ipt_conntrack, ipt_state, ipt_helper, iptable_nat, ip_nat_ftp, ip_nat_irc, ipt_owner.

--netfilter mode

Restrict access to iptables modules inside the Container. The following modes are available:

disabled -- no modules are allowed.

stateless -- (default) all modules except NAT and conntracks are allowed.

stateful -- all modules except NAT are allowed.

full -- all modules are allowed.

Network devices control parameters

--netdev_add name

move network device from host server to specified CT

--netdev_del name

delete network device from specified CT

Disk quota parameters

--diskspace num

Sets disk quota, in blocks. One block is currently equal to 1Kb.

--quotaugidlimit num

sets maximum number of user/group IDs in CT for which disk quota in CT will be accounted. If this value is set to 0, user and group quotas will not be accounted inside CT. Note that if you have previously set value of this parameter to 0, changing it while CT is running will not take effect. --jquota on|off Enables or disables journaled user/group quota for a ploop-based Container. Journaled quota is enabled by default.

Traffic shaping parameters

--rate dev:class:Kbits

Sets CT output bandwidth over specified network interface for specified traffic class. Traffic classes must be described in networks_classes(5) file.

--ratebound yes|no

If this parameter is set to yes then CT output bandwidth specified by --rate option will be bandwidth limit and guarantee. Otherwise --rate sets CT output bandwidth guarantee for traffic and limit is set by TOTALRATE global option.

Mount option

--noatime yes|no

Sets noatime flag (do not update inode access times) on file system. Default is yes for CT with class_id=1, otherwise no.

--mount_opts opt[,opt]

Specify the set of mount options for ploop-based Containers. The supported options are pfcache_csum (enables the cached ext4 file system) and nopfcache_csum (disables the cached ext4 file system).

--bindmount_add [src:]dst[,nosuid,noexec,nodev]

On CT start directory src will be mounted under CT $VE_ROOT/dst. If the src directory is not specified, it is created under $VE_PRIVATE/mnt/dst with permissions taken from CT $VE_ROOT/dst.

--bindmount_del dst|all

Remove directory dst from config file

Device access management

--devnodes device:r|w|rw|none

Give access (r - read, w - write, rw - read/write, none - no access) to special file /dev/device from CT.

I/O priority management

--ioprio priority

Assigns I/O priority to CT. Priority range is 0-7. The greater priority is, the more time for I/O activity CT has. By default each CT has priority of 4.

--iolimit limit[B|K|M|G]

Assigns I/O limit to CT. If no suffix is provided, the value is assumed to be in bytes per second. Available suffixes are:

b, B -- bytes

k, K -- kilobytes

m, M -- megabytes

g, G -- gigabytes

t, T -- terabytes By default each CT has limit of 0 (unlimited). The maximum disk I/O bandwidth limit you can set for a Container is 2 GB per second.

--iopslimit limit

Assigns Input/Output Operations Per Second limit to CT.

Features management

--features name:on|off[,...]

Enable/disable feature for CT. Supported features are: bridge, ipgre, ipip, nfs, nfsd, ppp, sit, time. Multiple comma-separated values can be specified.

PCI device management

--pci_add [domain:]bus:slot.func

Give the container an access to a PCI device. All numbers are hexadecimal as printed by lspci(8) in the first column.

--pci_del [domain:]bus:slot.func

Delete PCI device from the container.

Apply config

--applyconfig name

Read CT parameters from CT sample configuration file /etc/vz/conf/ve-name.conf-sample, and apply them, if --save option specified save to CT config file. The following parameters are not changed: HOSTNAME, IP_ADDRESS, TEMPLATE, OSTEMPLATE, VE_ROOT, VE_PRIVATE.

High Availability Cluster

--ha_enable yes|no

Adds the Container to (yes) or removes it (no) from the High Availability Cluster. By default, the parameter is set to yes.

--ha_prio number

Sets the Container priority in the High Availability Cluster. Containers with a higher priority are restarted first in the case of a system failure. If the parameter is not set for a Container (default), it has the lowest priority and is restarted after all Containers with any priorities set.

### Performing CT actions
create ctid [--ostemplate name] [--config name] [--private path] [--root path] [--name name] [--description desc] [--force]

Creates CT area. This operation should be done once, before the first startup of CT. If the --config name option is specified, values from example configuration file /etc/vz/conf/ve-name.conf-sample are put into CT configuration file. If CT configuration file already exists, it will be removed.

You can use --root path option to sets the path to the mount point for CT root directory (default is VE_ROOT specified in vz(5) file). Argument can contain literal string $VEID, which will be substituted with numeric CT ID.

You can use --private path option to set the path to directory in which all the files and directories specific to this very CT are stored (default is VE_PRIVATE specified in vz(5) file). Argument can contain literal string $VEID, which will be substituted with numeric CT ID.

You can use the --force option to create a Container if your storage/disk drive has less than 10 GB of free disk space.

destroy|delete ctid

Removes CT private area by deleting all files, directories and configuration file of this CT. Also delete command can be used as alias for destroy.

start ctid [--wait] [--skip-fsck]

Mounts (if necessary) and starts CT, if --wait option specified wait until default runlevel is entered. If the --skip-fsck option is specified, the filesystem check will be skipped.

stop ctid [--fast] [--skip-umount]

Stops the Container and unmounts it (unless --skip-umount is given). Normally, to stop a Container, halt(8) is executed inside; option --fast makes vzctl use reboot(2) syscall instead which is faster but can lead to unclean Container shutdown.

restart ctid [--wait]

Restart CT, stop if running and start. if --wait option specified wait until default runlevel is entered.

status ctid

Shows CT status. Basically this is a line with five or six words separated by spaces. First word is literally VEID.

Second word is numeric CT ID.

Third word is showing whether CT exists or not, it can be either exist or deleted.

Fourth word is showing the status of CT filesystem, it can be either mounted or unmounted.

Fifth word shows if CT is running, it can be either running or down.

Sixth word, if exists, is suspended. It appears if a dump file exists for a stopped container (see suspend).

This command can also be usable from scripts.

mount ctid

Mounts CT private area.

umount ctid

Unmounts CT private area. Note that stop does umount automatically.

exec ctid command

Executes command in CT. Environment variables are not set inside CT. Signal handlers may differ from default settings. If command is -, commands are read from stdin.

exec2 ctid command

The same as exec, but return code is that of command.

exec3 ctid command

The same as exec2, but not quotes command args.

enter ctid

Enters into CT. This option is a back-door for host root only.

console ctid [-s|--start] [N]

Attach to the Container's console tty number N. If N is not specified, 2 (i.e. tty2) is used. Use 1 to attach to Container's system console, see log messages from init etc. Note that you can even attach to a console if a Container is not yet running. To exit from the console, press "Esc" then "." (note this sequence is only recognized after Enter). If option --start is given, vzctl doesn't attach to a console, instead it starts getty for ttyN. Usually, getty is preconfigured to start on tty1 and tty2 only.

reinstall ctid [--skipbackup] [--resetpwdb] [--scripts script] [--skipscripts] [--vzpkg_opts opts]

The reinstall command creates a new private area, installs all applications, copies CT credentials from the old CT (unless --resetpwdb is given), and moves old CT private area to /old directory (unless --skipbackup option is given). To customize the reinstall process, two scripts should be created. The first one, vps.reinstall, creates a new private area. If this script exits with exit code of 128, it indicates that standard reinstall procedure will be done. The second script, vps.configure, is run inside CT there the old CT is mounted under '/old' directory.

pause <ctid>

Pause the specified Container.

reinstall ctid [--listscripts] [--desc]

List reinstall scripts if --desc option specified output description.

runscript ctid

Run the specified shell script in the Container. For a running Container, the command jumps into the Container and runs the script. For a stopped Container, it enters the Container, mounts the root (/) filesystem, and executes the script. In this case, only a process for the vzctl session, the script, and processes launched by the script are running in the Container.

execaction ctid

Run the distribution action for the Container by name, like SET_DNS or SET_HOSTNAME.

monitor ctid | 0

Display in real-time actions or events for ctid. In case ctid is 0, display actions and events for all CTs. Valid only on 2.6 kernel.

convert ctid

In OpenVZ, Containers use the new layout. The convert command converts a Container from the old layout to a new one.

register path ctid [--force

Register the Container using the configuration file path/ve.conf and having ID ctid. If the --force option is specified, all validation checks will be skipped.

unregister ctid|name

Unregister the specified Container.

compact <ctid> [--defrag]

Compact container image.

Container action scripts

Action scripts can be used to perform actions on containers at various stages of container operation. The following commands can trigger action scripts: start, stop, restart, mount, and umount.

Two types of scripts are supported: global, triggered for each container on host, and per-container, triggered for specific containers. Custom action scripts can be created manually and must be assigned specific file names to be triggered.

Custom action scripts can be of two types:

• Global, executed for all containers on host. Such scripts must have the prefix 'vps' (e.g., 'vps.mount') and need to be placed in '/etc/vz/conf/'.

• per-container, executed for specific containers. Such scripts must not have the prefix 'vps' and need to be placed in '/var/lib/vz/private/<CT_UUID>/scripts/'.

vps.mount, mount

Executed after a container is mounted. Can be global or container-specific.

start

Executed in container context on container start.

stop

Executed in container context on container stop.

vps.umount, umount

Executed before a container unmounted. Can be global or container-specific.

NOTE: All action scripts except start and stop are executed in the host context. The start and stop scripts are executed in the container context.

The environment passed to the mount and umount scripts is the standard environment of the parent (e.g., vzctl) with two additional variables: $VEID and $VE_CONFFILE. The first has the container UUID and the second has the full path to container's configuration file. Other container configuration parameters required for the script (such as $VE_ROOT) can be obtained from the global and per-container configuration files.

### Suspend/Restore
Checkpointing is an extension of OpenVZ kernel 2.6 which allows to save full state of running CT and to restore it later.

suspend ctid

This command saves all the state of running CT to a dump file and stops the CT. The dump files is named /VE_PRIVATE/dump/Dump.

resume ctid [--skip-fsck]

This command restores CT from dump file created by suspend command. The start or resume actions will invalidate dump file so it will be removed. If the --skip-fsck option is specified, the filesystem check will be skipped.

### Snapshotting
Snapshotting is a feature based on checkpointing and ploop shapshots. It allows to save a complete state of container file system. Plus, if the container is running, it's in-memory state (as in checkpointing). Note that snapshot functionality is only working for containers on ploop device.

snapshot CTID [--id uuid] [--skip-suspend]

Creates a container snapshot. If uuid is not specified, it is auto-generated. If a container is running, and --skip-suspend option is not specified, it's checkpointed and then restored. If a container is not running, only file system state is saved.

snapshot-switch CTID --id uuid

Switches the container to a snapshot identified by uuid. Note that the current container state and its file system state is lost! If given snapshot contains CT memory dump, it is restored, otherwise it is stopped.

snapshot-delete CTID --id uuid

Removes a specified snapshot.

snapshot-mount CTID --id uuid --target path

Mounts a snapshot specified by uuid to path. Note that this is read-only mount.

snapshot-umount CTID --id uuid

Unmounts the snapshot specified by uuid.

snapshot-list CTID [-H] [-o field[,field...] [--id uuid]

Lists all snapshots. Active snapshot is marked with * sign. You can suppress displaying header using -H option.

You can use the -o option to display only the specified field(s). List of available fields can be obtained using -L option.

### Other options
--help

Prints help message with a brief list of possible options.

--version

Prints vzctl version.

## DIAGNOSTICS
vzctl returns 0 upon successful execution. If something goes wrong, it returns an appropriate error code.

### System errors
1

Setting UBC parameters failed

2

Setting fair scheduler parameters failed

3

System error

4

Not enough memory error

5

Kernel does not have support for CT, or some VZ modules are not loaded

6

Not enough system resources

7

Creation of the virtual server failed

8

Command run by vzctl exec returned non-zero exit status

9

CT is locked by another vzctl operation

10

Global configuration file not found

14

CT configuration file not found

11

One of vzctl helper scripts not found

12

VZ license not loaded, or invalid class ID

### Parameter errors
20

Invalid command line parameter

21

Invalid value for command line parameter

22

CT root directory is not set

23

CT private directory is not set

24

CT template directory is not set

25

Traffic shaping parameter RATE is not set

26

Traffic shaping parameter TOTALRATE is not set

27

Not all needed parameters set, unable to start CT

28

Not all UBC parameters set, unable to start CT

29

Package set parameter is not specified during create

30

Traffic shaping parameter BANDWIDTH is not set

76

Class ID is not set

77

Lock dir is not set

133

Failed to setup CT start wait functionality

### CT errors
31

CT is not running

32

CT is already running

33

Unable to stop CT

79

Per CT action script returned with error

85

CT config file contain invalid data (belong to diferent config versions)

105

CT start disabled

140

Failed to register CT

141

CT owner check failed

142

Failed to unregister CT

### File system errors
40

CT area is not mounted

41

CT area is mounted, can not destroy CT area

43

CT private area does not exist

44

CT private area already exists

46

Not enough disk space

47

CT private area is not created properly

48

Can not create new CT private area

49

Can not create mount point

50

Can not mount CT private area

51

Can not umount CT private area

52

Can not umount disk image, device is busy

231

Error deleting CT private area

53

Unknown mount type

54

Can not create directory

56

Unsupported /sbin/init

82

Can't copy sample config file, or sample config file not exist

### Disk quota errors
60

Error during "quota on" operation

66

Error during "quota off" operation

61

Error during "quota init" operation

62

Error during "quota set" operation

67

Ugid quota can not be turned ON on mounted CT. It must be initialized first.

63

Can not init quota - disk space limit is not set

64

Can not init quota - disk inode limit is not set

65

Can not set ugid quota limit

### Errors of vzctl set
70

Invalid host name

71

Invalid IP address

72

Invalid DNS server address

73

Invalid DNS domain name

74

Error changing password

34

Error adding IP address

78

IP address already in use

106

Error setting iptables parameter

135

Error setting meminfo parameter

137

Can not set CT name

146

Error setting cpumask parameter

147

Unable to configure PCI device

148

Error setting IO parameters

149

Error setting nodemask parameter

### Traffic shaping error
80

Can not set up traffic shaping

### Traffic accounting error
81

Can not set up traffic accounting

### Template error
91

Private area tarball not found.

87

Unable to install applications.

### Reinstall error
93

Unable to get installed packages

94

Reinstall error

55

Not enough quota limits to create temporary CT

### Checkpointing error
16

Checkpoint error

17

Restore error

### Ploop errors
151

Failed to create ploop image

152

Failed to mount ploop image

153

Failed to unmount ploop image

154

Failed to resize ploop image

155

Failed to convert CT to ploop

156

Failed to create ploop snapshot

157

Failed to merge ploop snapshots

158

Failed to delete ploop snapshot

159

Failed to switch to snapshot

160

Failed to mount ploop snapshot

## EXAMPLES
To create and start "light" CT with ID 1000 using centos-6 package set, and IP address 192.168.10.200:

vzctl create 1000 --ostemplate centos-6 --config light

vzctl set 1000 --ipadd 192.168.10.200 --save

vzctl start 1000

To set number of processes barrier/limit to 80/100 processes and PTY barrier/limit to 16/20 PTYs:

vzctl set 1000 --numproc 80:100 -t 16:20 --save

To execute command ls -la in this CT:

vzctl exec 1000 /bin/ls -la

To execute command pipe ls -l / | sort in this CT:

vzctl exec 1000 /bin/sh -c 'ls -l / | sort'

To stop this CT:

vzctl stop 1000

To permanently remove this CT:

vzctl destroy 1000

## FILES
/etc/vz/vz.conf

/etc/vz/conf/CTID.conf

/proc/vz/veinfo

/proc/vz/vzquota

/proc/user_beancounters

## SEE ALSO
vz(5), ve.conf(5), networks_classes(5), vzcreate(8), vz-start(5), vz-stop(5).

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzdiskcheck

title: vzdiskcheck(8)

text:
# vzdiskcheck(8)

## NAME
vzdiskcheck - show information about disk space usage of /vz by Containers.

## SYNOPSIS
vzdiskcheck [-v] [-x]

## DESCRIPTION
This script outputs information on the disk usage in /vz.

## OPTIONS
-v

Display information for each CT.

-x

Output in XML format.

## RETURN CODE
Returns 0 upon success.

## SEE ALSO
vzctl(8).

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzeventd

title: vzeventd(8)

summary: OpenVZ Container events daemon

text:
# vzeventd(8)

## NAME
vzeventd - OpenVZ Container events daemon

## SYNOPSIS
vzeventd

## DESCRIPTION
vzeventd listens to the OpenVZ kernel for Container events and executes appropriate event scripts. Each script must be named after the corresponding event and placed in the folder /etc/vz/vzevent.d.

The supported event scripts are:

ve-start

ve-stop

ve-reboot

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzgetpa

title: vzgetpa(8)

text:
# vzgetpa(8)

## NAME
vzgetpa - utility that prints location of CT private area.

## SYNOPSIS
vzgetpa veid

## DESCRIPTION
This script prints the location of CT private area for CT with id veid, using global configuration file, and per-CT configuration file (if it exist).

## DIAGNOSTICS
Returns 0 upon success. If CT id given as an argument is empty or invalid (not a number), script returns 1.

## SEE ALSO
vz(5), ve.conf(5).

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzlist

title: vzlist(8)

summary: CT listing utility.

text:
# vzlist(8)

## NAME
vzlist - CT listing utility.

## SYNOPSIS
vzlist [-a|-S] [-H] [-o field[,field...]] [-s [-]field] [-h host_pattern] [-N name_pattern] [-d descr_pattern] [-i ifname] [ctid [ctid...] | -1]

vzlist -L

## DESCRIPTION
The vzlist utility lists CTs. By default only running CTs are listed. With ctid specified, only specified CTs are listed, ctid of -1 is used to output CT IDs only, one per line.

For the fields that can have many values (e.g. ip or netif), all the values are displayed only for the last (i.e. leftmost) column; otherwise, only the first value is shown.

## OPTIONS
-H, --no-header

Suppress displaying the header.

-j, --json

Output in JSON format.

-a, --all

List all CTs.

-S, --stopped

List only stopped CTs.

-n, --name

Display CT names (instead of hostnames).

-o, --output field[,field...]

Display only the specified field(s).

-s, --sort field

Sort by the value of field (possible arguments are the same as for -o). The - before the field name means sorting in the reverse order.

### Output filters
List of CTs can be further filtered using the following options. For patterns (except for --netif) one can use the same wildcards as in shell (i.e. *, ?, and []). Note: to avoid expansion of wildcards by the shell, one have to escape the pattern by either putting it into single quotes (like 'a*a') or by adding a backslash before the wildcard character (like a\*a).

-h, --hostname pattern

List only those CTs whose hostname matches the pattern.

-N, --name_filter pattern

List only CTs whose names match the pattern.

-d, --description desc_pattern

List only those CTs whose descriptions match the desc_pattern.

-i, --netif host_ifname

List only CTs whose host interface names match the host_ifname pattern. Note that you can not use wildcards with this option.

### Possible fields
-L, --list

List all the fields that can be used for both output (-o, --output) and the sorting order (-s, --sort). For the user beancounter fields, if suffix is not specified, current usage (a.k.a. "held") value is show. One can also use the following suffixes:

.m

maxheld

.b

barrier

.l

limit

.f

fail counter

For the disk quota fields, if suffix is not specified, current usage is shown. One can also use the following suffixes:

.s

soft limit

.h

hard limit

## RETURN CODE
Returns 0 upon success.

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vznetstat

title: vznetstat(8)

text:
# vznetstat(8)

## NAME
vznetstat - display network traffic statistics per CT.

## SYNOPSIS
vznetstat [-4|-6] [-v ctid] [-c class] [-a] [-r] [-h]

## DESCRIPTION
The utility displays incoming and outcoming traffic for Containers for each defined network class. The output is grouped by CT ID. The network classes are described in the /etc/vz/conf/networks_classes file. If no options are specified the network statistics for all running Containers is printed.

Note that for the CT ID of 0, the traffic of the HS (the host server itself) is shown. The figures for HS does not include CT traffic.

## OPTIONS
-v ctid

Display statistics only for the CTs with the given ctid.

-c class

Display statistics only for the given network class.

-a

Display all classes (16).

-r

Round off the statistics figures from bytes to K(b), M(b) or G(b).

-h

Print short usage information.

-4

Display ipv4 statistics.

-6

Display ipv6 statistics.

## RETURN CODE
Returns 0 upon success.

## EXAMPLES
To display statistics for all CTs:

```
    vznetstat
```

To display statistics for CTs 101 and 102 for network classes 1 and 2:

```
    vznetstat -v 101 -v 102 -c 1 -c 2
```

## SEE ALSO
networks_classes(5).

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzpid

title: vzpid(8)

text:
# vzpid(8)

## NAME
vzpid - display the CT id given the process id (pid).

## SYNOPSIS
vzpid [-h] [pid [...]]

## DESCRIPTION
This script displays the CT id the process with the given id belongs to.

## OPTIONS
pid

Enter the pid of the process to display the CT id where the process takes place.

## RETURN CODE
Returns 0 upon a successful execution.

## SEE ALSO
vzctl(8).

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzpurge

title: vzpurge(8)

text:
# vzpurge(8)

## NAME
vzpurge - utility to remove unused CT private areas.

## SYNOPSIS
vzpurge

## DESCRIPTION
This script finds and removes all CT private areas, which have no appropriate configuration file (/etc/vz/conf/veid.conf). To find private areas, value of VE_PRIVATE variable in /etc/vz/vz.conf configuration file is used.

If CT is running, it is stopped. If CT is mounted, it is unmounted.

## NOTES
This script makes assumption that CT private area is unused if CT has no configuration file, so using it can be dangerous as you can lost your data. Use it if you are absolutely sure what you are doing.

## SEE ALSO
vzctl(8), vz(5).

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzsplit

title: vzsplit(8)

text:
# vzsplit(8)

## NAME
vzsplit - generate a sample CT configuration file with a certain set of system resource control parameters.

## SYNOPSIS
vzsplit [-n numve] [-f conf_name] [-s swapsize] [-p path]

## DESCRIPTION
The vzsplit utility is used to split the host server into equal parts. It generates a full set of system resource control parameters for the given number of Containers. The values are calculated from the total physical memory of the host server the utility runs on and the number of Containers the host servershall be able to run even if the given number of Containers consume all resources available. Without any option vzsplit prompts for the desired number of Containers and outputs the resulting resource control parameters to the screen. If there is not enough system resources to run the specified number of CTs, an appropriate message is shown and the sample configuration file is not generated.

## OPTIONS
-n numve

Specify the number of CTs.

-f conf_name

Specify the configuration file name. The program output is placed to /etc/vz/conf/ve-conf_name.conf-sample.

-s swapsize

Specify the swap size in Kbytes. If not provided in the option, the swap size will be read from /proc/meminfo.

-p path

Specify path where CTs will reside. By default /var/lib/vz used.

## DIAGNOSTICS
vzsplit returns 0 upon a sucessful execution. If anything goes wrong, it returns 1.

## SEE ALSO
ve.conf(5).

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vztactl

title: vztactl(8)

summary: traffic accounting utility.

text:
# vztactl(8)

## NAME
vztactl - traffic accounting utility.

## SYNOPSIS
vztactl [class_load <net_classes_file>] [class_unload] [class_list] [reset_ve_stat <ctid>] [reset_all_stat]

## DESCRIPTION
This utility used to manage traffic accounting.

## OPTIONS
class_load net_classes_file

Load traffic classes from file net_classes_file.

class_unload class

Unload traffic classes.

class_list

Get list loadded traffic classes.

reset_ve_stat ctid

Reset traffic statistic for CT ctid.

reset_all_stat

Reset statistics for all CTs.

## RETURN CODE
Returns 0 upon success.

## SEE ALSO
networks_classes(5).

## COPYRIGHT
Copyright (c) 1999-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzubc

title: vzubc(8)

text:
# vzubc(8)

## NAME
vzubc - show User Beancounters in a human-readable format

## SYNOPSIS
vzubc [option ...] [CTID ...]

## DESCRIPTION
This utility aims to show current values for User Beancounter in a human-readable format. Values that are in pages are converted into bytes, then long values are converted into kilo-, mega- gigabytes etc. For held and maxheld, it shows how close the values are to the barrier and to the limit. Zero and unlimited values are shown as -.

One or several CTIDs can be specified to limit the output to the given containers. Each CTID can be either a name or a numeric ID. Note that names can only be used if there is a container on the system with that name (vzlist -o ctid name command is used for name to ID conversion). Unknown CTIDs are ignored.

The utility can also be used from inside the container, in this case it only shows the values for that container (and it doesn't make sense to specify CTID argument).

## OPTIONS
-w, --watch

Watch mode: run itself under watch(1), redisplaying the output every 2 seconds (by default) until interrupted by Ctrl-C.

-wd

Make watch(1) highlight the differences between current and previous output. Corresponds to watch -d option.

-wt

Instruct watch(1) to not show its title (interval, command, and current time at the top of the display, as well as the following blank line). Corresponds to watch -t option.

-wn time

Refresh interval for watch(1), in seconds (corresponds to watch -n time).

-q, --quiet

Quiet mode. In this mode, vzubc only shows beancounters with fails and those with held/maxheld values close to limits. -v, --verbose Verbose mode. In this mode, vzubc also shows beancounters with barrier set to unlimited (those are hidden by default).

-qh ratio

Quiet threshold for held to limit ratio. Default is 0.5 (50%).

-qm ratio

Quiet threshold for maxheld to limit ratio. Default is 0.8 (80%).

-r, --relative

Relative mode: for fail counters, instead of showing the absolute value, calculate the difference from the previous run. This mode is denoted by a + sign before the FAIL column header.

-rd dir

Set a directory for saving fail counters to dir (default is /tmp/vzubc.store).

-rc

Clear all saved fail counter data.

-i, --incremental

Incremental mode. Shows an additional column with a difference in held value from the previous run. This option also affects quiet mode: all lines with changed held values are shown. Held data is saved to the same directory as fail counter data.

-id dir

A synonym for -rd.

-ic

Clear all saved held data.

-c, --color

Enable color highlighting. Not compatible with --watch. Same thresholds as for quiet mode are used to highlight "more important" lines, plus the lines with non-zero fail counters are highlighted.

-f | --file filename

Read User Beancounters from filename. By default this is /proc/bc/resources or, if that one is not available, /proc/user_beancounters. Use - to read from standard input.

## EXAMPLES
vzubc 101 web dns

Show all beancounters for CTID 101 and for CTs named web and dns.

vzubc -w -wd -wn 10 101

Display beancounters for CT 101 every 10 seconds, highlighting the changes. Interrupt with Control-C.

vzubc -q -c

Show beancounters with held or maxheld close to limits, plus those with non-zero fail counters, with colors.

vzubc -q -qh 0.8 -qm 1

Show beancounters with held value equal to or more than 80% of a limit, and/or with maxheld value equal or more than a limit, plus those with non-zero fail counters.

vzubc -w -q -r

Display beancounters with held and maxheld close to limits, plus those with increasing fail counters.

vzubc -r -q -qh 2 -qm 2

Only show beancounters with increased (since the last run) fail counters.

vzubc -rc -ic

Show all beancounters, and clear all saved data for relative and incremental mode (i.e. saved values for fail counter and held).

## FILES

```
/proc/bc/resources
/proc/user_beancounters
/tmp/vzubc.store/ubc.*
```

## EXIT STATUS
Returns 0 upon successful execution, 1 otherwise.

## SEE ALSO
watch(1), vzlist(8), vzmemcheck(8), vzcfgvalidate(8), http://wiki.openvz.org/UBC.

## LICENSE
Copyright (C) 2011, Parallels, Inc. Licensed under GNU GPL.


vzmigrate

package: vzmigrate

title: vzmigrate(8)

text:
# vzmigrate(8)

## NAME
vzmigrate - utility for container migration between hardware nodes.

## SYNOPSIS
vzmigrate

[-r yes|no] [-sfvh] [--keeper[=veid] [--ssh=ssh_options] [--ssh-cipher=ssh_cipher] [--keep-dst] [--keep-images] [--online] [--noiter] [--readonly] [--require-realtime] [--dry-run] [--new-id=CTID] [--new-name=CT_name] [--new-private=CT_private] [--new-root=CT_root] [--nonsharedfs] [--whole-file] [--timeout value] [user@]dst_node {CT_list}

{CT_list} := source_CTID[:dst_CTID[:dst_CT_private[:dst_CT_root]]] [...]

without --new-id, --new-name, --new-private, --new-root option(s), or

{CT List} := source_CTID

otherwise.

## DESCRIPTION
This utility is used for CT(s) migrating from one (source) node to another (destination) node. The list of containers to migrate is specified by the CT_list. A different dst_CTID can be specfied if you want to change CT ID during migration; in addition, dst_CT_private and dst_CT_root paths can also be changed.

Either stopped or running CT can be migrated. For a stopped CT, simple CT private area transfer is performed (by means of rsync(1), unless shared storage is set up). For running CTs, the migration may be slow (with a minute or more of downtime), fast (seconds of downtime) or online (zero downtime).

## OPTIONS
-s, --nostart

Do not attempt to restore CT state (start/mount CT) after successful migration on destination node, when it was running/mounted on source node. It means that CT should be started/mounted manually on the destination node. Option doesn't affect CT that was stopped at the migration time.

-r, --remove-area yes|no

Whether to remove private area on source node for successfully migrated CT. Private area will be saved with .migrated suffix. This command line option overrides the REMOVEMIGRATED configuration parameter in global configuration file vz(5).

-f, --nodeps[=opt,opt...]

Skip some or all checks on the destination node before performing migration. The argument is comma-separated set of checks to skip. The following checks can be skipped:

all

all checks (this is the default if opt is not provided)

cpu_check

cpu capabilities

disk_space

required free disk space

technologies

technologies used

license

license

rate

container's RATE configuration parameters

bindmount

container's external bind mounts

To prevent CT from filesystem errors due to absent template files, it will not be started on the destination node after migration, and has to be started manually.

-h, --help

Get usage info.

--ssh=ssh_options

Additional options that will be passed to ssh during establishing connection with destination node. Please be careful with these, make sure to NOT pass the destination hostname.

--ssh-cipher=ssh_cipher

Override the cipher configured in the SSH configuration file. Both the source and destination servers must support the chosen cipher. Note, passing anything but a cipher may lead to unpredictable behavior.

--keeper=[veid]

Keeper CT identification. The service CT ID is used if not specified. Keeper CT is needed to keep CT IP addresses during migration (it is used to e.g. show web page that CT is being migrated).

--keep-dst

Don't clean synced destination CT private area in case of some error. It is usefull to use this option on big CT migration to protect of syncing CT private area again in case of some error (on CT stop for example) occured during first migration attempt.

--keep-images

Don't remove c/r images after a successful migration.

--online

Perform online (zero-downtime) migration: during the migration the CT hangs for a while and after the migration it continues working as though nothing has happened. Options --keeper and --nostart are ignored if this option is set. By default iterative scheme is used for online migration, that is most of the CT memory are transfered before CT suspend. This method introduces the smallest delay in service.

--noiter

Do not use iterative scheme during online migration.

--readonly

Allows to skip locking the source container and writing any migration-related information to the source server. Use the option if the source server's filesystem is remounted as readonly (e.g., due to corruption).

--require-realtime

Force to use only realtime scheme for online migration. Migration fails if this method is not available for some reason. It is useful to ensure that delay in service will be minimal.

--dry-run

Option that will perform only checks and will not perform actual data transfer.

--new-id=CTID

Set destination container ID.

--new-name=CT_name

Set destination container name (i.e. rename the container while migrating).

--new-private=CT_private

Set destination CT private.

--new-root = CT_root

Set destination CT root.

--nonsharedfs

Force migrate of CT private from a shared partition to non-shared.

-W, --whole-file

Use rsync's --whole-file option.

-t, --timeout value

Set connection timeout, in seconds.

--compress

Enable ZSTD channel compression.

-v, --verbose

Be verbose.

## NOTES
If you want to "migrate" CT within the same hardware node, you use vzmlocal(8) instead.

You can set disk IO limits for migrating Containers by configuring the VZ_TOOLS_BCID and VZ_TOOLS_IOLIMIT parameters in the global configuration file vz(5).

## EXAMPLES
To migrate CT#101 as CT#1001 to 192.168.1.130 by user "test":

vzmigrate test@192.168.1.130 101:1001

## EXIT STATUS
0

Command completed successfully.

1

Bad command line options.

2

System error.

3

Can't lock CT.

4

Can't connect to destination (source) node.

5

CT is broken or improper.

6

CT private area copying/moving failed.

7

Can't start destination CT.

8

Can't stop source CT.

9

CT already exists on destination node.

10

CT doesn't exist on source node.

11

Failed package sets dependencies. Use -f options to forcedly migrate such CT, CT will not be started on destination side.

12

You attempt to migrate CT which IP addresses already in use (there is running CT) on destination node. Use -f options to forcedly migrate such CT, CT will not be started on destination side.

13

You attempt to migrate CT that contains mount script. Use -f options to forcedly migrate such CT, CT will not be started on destination side.

21

Connection to remote host is broken.

22

Connection to remote host closed due to timeout.

25

Programm terminated.

26

Migrate protocol error.

27

Failed to access template directory.

29

Clone is forbidden for suspended CT.

30

License check failed.

31

Disk space check failed.

32

Technologies check failed for destination node.

33

Rate check filed.

34

Source and destination CTs are equals.

35

UUID-collision, directory already exits.

36

CT config contains bind mount.

37

This CT layout is not supported on destination node.

38

This CT format is not supported on destination node.

39

Can't get source CT format.

40

Can't migrate vzcache2 area (old protocol).

41

Can't migrate suspended CT (old protocol).

43

libvzctl error.

45

This name already used by other CT.

46

CT private directory on the destination node resides on the non-shared partition, use --nonsharedfs option to force copying CT private data.

48

Can not perform online migration to/from elder version.

49

Too long message

52

External program failed

56

Insufficient cpu capabilities on destination node

57

CT has unsupported features

61

The IPv6 module is not loaded on the destination node.

62

The SLM module is not loaded on the destination node.

63

Mounting namespaces in the container is not allowed by the destination node kernel.

73

Can not perform online migration via p.haul.

74

Can not perform migration for container with attached backup.

104

--dry-run option was used.

## SEE ALSO
rsync(1), vzmsrc(8), vzmlocal(8), vz(5)

## COPYRIGHT
Copyright (c) 2001-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2020 Virtuozzo International GmbH. All rights reserved.


vzmlocal

title: vzmlocal(8)

text:
# vzmlocal(8)

## NAME
vzmlocal - utility for local moving/copying Containers within the bounds of one hardware node.

## SYNOPSIS
vzmlocal [-fh] [--online] {CT List}

{CT List} = <source CT ID>[:[<dst CTID>][:[<dstCT private>][:<dstCTroot>]]] [...]

vzmlocal [-fh] [--online] -C {CT List}

{CT List} = <source CT ID>:<dst CTID>[:[<dstCT private>][:<dstCTroot>]] [...]

## DESCRIPTION
This utility is used for CT(s) local moving/copying within the bounds of one hardware node.

{CT List} - List of CTs for moving/copying.

## OPTIONS
By default utility works in moving CT(s) mode.

-C, --copy

Do CT(s) copying not moving.

-f, --nodeps[=[all][,cpu_check][,disk_space][,technologies][,license][,rate]]

Ignore an absence of required package sets on destination node. To prevent CT against errors in filesystem due to absent template files, it will not be started on destination node after migration and must be started manually.

Additional parameters:

all - as is -f.

cpu_check - to pass check of the cpu capabilities.

disk_space - to pass check of the disk usage.

technologies - to pass check of the used technologies.

license - to pass check of the license.

rate - to pass check of the RATE config parameters.

bindmount - to pass check of the external bind mounts in config.

--online

Copy the main content of a running Container to a clone before suspending the Container. Using this option, you can reduce the Container downtime to a minimum, making it almost unnoticeable to end users.

-h, --help

Get usage info.

## MOVING/COPYING
Utility may copying/moving either stopped or running CT.

## EXAMPLES
\# vzmlocal -C 200:201

Clone CT 200. New CT will be numbered 201. Disposition of its private and root areas will be autogenerated.

\# vzmlocal -C 200:202::/mnt/root202

Clone CT 200. New CT will be numbered 202 and its root area will reside under /mnt/root202

\# vzmlocal 300:301:/sda2/private/build_server

Renumber CT 300 to 301 and move its private area under /sda2/private/build_server

\# vzmlocal 301:::/mnt/root/build_server

Move root area of CT 301 under /mnt/root/build_server

## EXIT STATUS
See vzmigrate (8)

## SEE ALSO
rsync(1), vzmsrc(8), vzmigrate(8), vz(5)

## COPYRIGHT
Copyright (c) 2001-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzmpipe

title: vzmpipe(8)

text:
# vzmpipe(8)

## NAME
vzmpipe - Utility that's used as shell for special user created for Containers migration purposes

## SYNOPSIS
/usr/sbin/vzmpipe

## DESCRIPTION
You DON'T need to use it directly. It is used as shell for special user.

## COPYRIGHT
Copyright (c) 2001-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzmsrc

title: vzmsrc(8)

text:
# vzmsrc(8)

## NAME
vzmsrc, vzmdest - Utilities for migration containers to another node. vzmdestmpl - Utility for migration templates to another node.

## SYNOPSIS
vzmsrc -agent [-r yes|no] [-s] <src serviceCT address>

<dst serviceCT address> {CT List}

vzmdest -agent <src serviceCT address> <dst serviceCT

address> {CT List}

vzmdestmpl -agent <src serviceCT address> <dst serviceCT

address> template ...

## DESCRIPTION
These utilities used by another higher level utility (vzagent). You DON'T need to use them directly. If you want to migrate VE/Template manually, see vzmigrate(8), vzmtemplate(8).

## SEE ALSO
vzmigrate(8) vzmtemplate(8)

## COPYRIGHT
Copyright (c) 2001-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.


vzmtemplate

title: vzmtemplate(8)

text:
# vzmtemplate(8)

## NAME
vzmtemplate - utility for migration OpenVZ templates between nodes.

## SYNOPSIS
vzmtemplate [-bh] [--ssh=<ssh_options>]

<[user@]destination_node_address> template ...

## DESCRIPTION
This utility is used for ez template(s) migrating from one (source) node to another (destination) node. It requires that you have root@ access on destination node. Unlike vzmigrate, vzmtemplate doesn't remove template from source node.

## OPTIONS
-b, --batch

Run in batch mode to facilitate utility output analyzing by calling script.

-h, --help

Get usage info.

--ssh=<ssh options>

Additional options that will be passed ssh during establishing connection with destination node. Please be carefully with passed options, DON'T pass destination hostname.

## MIGRATION
Utility can migrate either application or OS templates. Migration OS template also migrate tarballs of this templates. Now utility migrates template at whole (all base versions & updates).

## EXAMPLES
To migrate ez os-template centos-4-x86 to 192.168.1.130:

vzmtemplate 192.168.1.130 centos-4-x86

To migrate ez app-template mod_ssl for centos-4-x86 to 192.168.1.130:

vzmtemplate 192.168.1.130 mod_ssl@centos-4-x86

## EXIT STATUS
0 EXIT_OK

Command completed successfully.

1 EXIT_USAGE

Bad command line options.

2 EXIT_SYSTEM

System error.

3 EXIT_LOCK

Can't lock template.

4 EXIT_CONNECT

Can't connect to destination (source) node.

6 EXIT_COPY

Template area copying failed.

9 EXIT_EXISTS

Template with more last version already exists on destination node.

10 EXIT_NOTEXIST

Template doesn't exist on source node.

14 EXIT_OBSOLETE

Functionality is no longer supported.

## SEE ALSO
vzmigrate(8) vz(5)

## COPYRIGHT
Copyright (c) 2001-2017, Parallels International GmbH. All rights reserved. Copyright (c) 2017-2019 Virtuozzo International GmbH. All rights reserved.