ovn-controller

package: ovn-host

title: ovn-controller(8)

summary: Open Virtual Network local controller

text:
# ovn-controller(8)

## NAME
ovn-controller - Open Virtual Network local controller

## SYNOPSIS
ovn-controller [options] [ovs-database]

## DESCRIPTION
ovn-controller is the local controller daemon for OVN, the Open Virtual Network. It connects up to the OVN Southbound database (see ovn-sb(5)) over the OVSDB protocol, and down to the Open vSwitch database (see ovs-vswitchd.conf.db(5)) over the OVSDB protocol and to ovs-vswitchd(8) via OpenFlow. Each hypervisor and software gateway in an OVN deployment runs its own independent copy of ovn-controller; thus, ovn-controller’s downward connections are machine-local and do not run over a physical network.

## ACL LOGGING
ACL log messages are logged through ovn-controller’s logging mechanism. ACL log entries have the module acl_log at log level info. Configuring logging is described below in the Logging Options section.

## OPTIONS

### Daemon Options
--pidfile[=pidfile]

Causes a file (by default, program.pid) to be created indicating the PID of the running process. If the pidfile argument is not specified, or if it does not begin with /, then it is created in .

If --pidfile is not specified, no pidfile is created.

--overwrite-pidfile

By default, when --pidfile is specified and the specified pidfile already exists and is locked by a running process, the daemon refuses to start. Specify --overwrite-pidfile to cause it to instead overwrite the pidfile.

When --pidfile is not specified, this option has no effect.

--detach

Runs this program as a background process. The process forks, and in the child it starts a new session, closes the standard file descriptors (which has the side effect of disabling logging to the console), and changes its current directory to the root (unless --no-chdir is specified). After the child completes its initialization, the parent exits.

--monitor

Creates an additional process to monitor this program. If it dies due to a signal that indicates a programming error (SIGABRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU, or SIGXFSZ) then the monitor process starts a new copy of it. If the daemon dies or exits for another reason, the monitor process exits.

This option is normally used with --detach, but it also functions without it.

--no-chdir

By default, when --detach is specified, the daemon changes its current working directory to the root directory after it detaches. Otherwise, invoking the daemon from a carelessly chosen directory would prevent the administrator from unmounting the file system that holds that directory.

Specifying --no-chdir suppresses this behavior, preventing the daemon from changing its current working directory. This may be useful for collecting core files, since it is common behavior to write core dumps into the current working directory and the root directory is not a good directory to use.

This option has no effect when --detach is not specified.

--no-self-confinement

By default this daemon will try to self-confine itself to work with files under well-known directories determined at build time. It is better to stick with this default behavior and not to use this flag unless some other Access Control is used to confine daemon. Note that in contrast to other access control implementations that are typically enforced from kernel-space (e.g. DAC or MAC), self-confinement is imposed from the user-space daemon itself and hence should not be considered as a full confinement strategy, but instead should be viewed as an additional layer of security.

--user=user:group

Causes this program to run as a different user specified in user:group, thus dropping most of the root privileges. Short forms user and :group are also allowed, with current user or group assumed, respectively. Only daemons started by the root user accepts this argument.

On Linux, daemons will be granted CAP_IPC_LOCK and CAP_NET_BIND_SERVICES before dropping root privileges. Daemons that interact with a datapath, such as ovs-vswitchd, will be granted three additional capabilities, namely CAP_NET_ADMIN, CAP_NET_BROADCAST and CAP_NET_RAW. The capability change will apply even if the new user is root.

On Windows, this option is not currently supported. For security reasons, specifying this option will cause the daemon process not to start.

### Logging Options
-v[spec]

--verbose=[spec]

Sets logging levels. Without any spec, sets the log level for every module and destination to dbg. Otherwise, spec is a list of words separated by spaces or commas or colons, up to one from each category below:

- A valid module name, as displayed by the vlog/list command on ovs-appctl(8), limits the log level change to the specified module.

- syslog, console, or file, to limit the log level change to only to the system log, to the console, or to a file, respectively. (If --detach is specified, the daemon closes its standard file descriptors, so logging to the console will have no effect.)

On Windows platform, syslog is accepted as a word and is only useful along with the --syslog-target option (the word has no effect otherwise).

•

off, emer, err, warn, info, or dbg, to control the log level. Messages of the given severity or higher will be logged, and messages of lower severity will be filtered out. off filters out all messages. See ovs-appctl(8) for a definition of each log level.

Case is not significant within spec.

Regardless of the log levels set for file, logging to a file will not take place unless --log-file is also specified (see below).

For compatibility with older versions of OVS, any is accepted as a word but has no effect.

-v

--verbose

Sets the maximum logging verbosity level, equivalent to --verbose=dbg.

-vPATTERN:destination:pattern

--verbose=PATTERN:destination:pattern

Sets the log pattern for destination to pattern. Refer to ovs-appctl(8) for a description of the valid syntax for pattern.

-vFACILITY:facility

--verbose=FACILITY:facility

Sets the RFC5424 facility of the log message. facility can be one of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock, ftp, ntp, audit, alert, clock2, local0, local1, local2, local3, local4, local5, local6 or local7. If this option is not specified, daemon is used as the default for the local system syslog and local0 is used while sending a message to the target provided via the --syslog-target option.

--log-file[=file]

Enables logging to a file. If file is specified, then it is used as the exact name for the log file. The default log file name used if file is omitted is /var/log/ovn/program.log.

--syslog-target=host:port

Send syslog messages to UDP port on host, in addition to the system syslog. The host must be a numerical IP address, not a hostname.

--syslog-method=method

Specify method as how syslog messages should be sent to syslog daemon. The following forms are supported:

- libc, to use the libc syslog() function. Downside of using this options is that libc adds fixed prefix to every message before it is actually sent to the syslog daemon over /dev/log UNIX domain socket.

- unix:file, to use a UNIX domain socket directly. It is possible to specify arbitrary message format with this option. However, rsyslogd 8.9 and older versions use hard coded parser function anyway that limits UNIX domain socket use. If you want to use arbitrary message format with older rsyslogd versions, then use UDP socket to localhost IP address instead.

- udp:ip:port, to use a UDP socket. With this method it is possible to use arbitrary message format also with older rsyslogd. When sending syslog messages over UDP socket extra precaution needs to be taken into account, for example, syslog daemon needs to be configured to listen on the specified UDP port, accidental iptables rules could be interfering with local syslog traffic and there are some security considerations that apply to UDP sockets, but do not apply to UNIX domain sockets.

- null, to discard all messages logged to syslog.

The default is taken from the OVS_SYSLOG_METHOD environment variable; if it is unset, the default is libc.

### PKI Options
PKI configuration is required in order to use SSL for the connections to the Northbound and Southbound databases.

-p privkey.pem

--private-key=privkey.pem

Specifies a PEM file containing the private key used as identity for outgoing SSL connections.

-c cert.pem

--certificate=cert.pem

Specifies a PEM file containing a certificate that certifies the private key specified on -p or --private-key to be trustworthy. The certificate must be signed by the certificate authority (CA) that the peer in SSL connections will use to verify it.

-C cacert.pem

--ca-cert=cacert.pem

Specifies a PEM file containing the CA certificate for verifying certificates presented to this program by SSL peers. (This may be the same certificate that SSL peers use to verify the certificate specified on -c or --certificate, or it may be a different one, depending on the PKI design in use.)

-C none

--ca-cert=none

Disables verification of certificates presented by SSL peers. This introduces a security risk, because it means that certificates cannot be verified to be those of known trusted hosts.

--bootstrap-ca-cert=cacert.pem

When cacert.pem exists, this option has the same effect as -C or --ca-cert. If it does not exist, then the executable will attempt to obtain the CA certificate from the SSL peer on its first SSL connection and save it to the named PEM file. If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL connections must be authenticated by a certificate signed by the CA certificate thus obtained.

This option exposes the SSL connection to a man-in-the-middle attack obtaining the initial CA certificate, but it may be useful for bootstrapping.

This option is only useful if the SSL peer sends its CA certificate as part of the SSL certificate chain. The SSL protocol does not require the server to send the CA certificate.

This option is mutually exclusive with -C and --ca-cert.

--peer-ca-cert=peer-cacert.pem

Specifies a PEM file that contains one or more additional certificates to send to SSL peers. peer-cacert.pem should be the CA certificate used to sign the program’s own certificate, that is, the certificate specified on -c or --certificate. If the program’s certificate is self-signed, then --certificate and --peer-ca-cert should specify the same file.

This option is not useful in normal operation, because the SSL peer must already have the CA certificate for the peer to have any confidence in the program’s identity. However, this offers a way for a new installation to bootstrap the CA certificate on its first SSL connection.

### Other Options
-h

--help

Prints a brief help message to the console.

-V

--version

Prints version information to the console.

## CONFIGURATION
ovn-controller retrieves most of its configuration information from the local Open vSwitch’s ovsdb-server instance. The default location is db.sock in the local Open vSwitch’s "run" directory. It may be overridden by specifying the ovs-database argument as an OVSDB active or passive connection method, as described in ovsdb(7).

ovn-controller assumes it gets configuration information from the following keys in the Open_vSwitch table of the local OVS instance:

external_ids:system-id

The chassis name to use in the Chassis table. Changing the system-id while ovn-controller is running is not directly supported. Users have two options: either first gracefully stop ovn-controller or manually delete the stale Chassis and Chassis_Private records after changing the system-id.

external_ids:hostname

The hostname to use in the Chassis table.

external_ids:ovn-bridge

The integration bridge to which logical ports are attached. The default is br-int. If this bridge does not exist when ovn-controller starts, it will be created automatically with the default configuration suggested in ovn-architecture(7).

external_ids:ovn-bridge-datapath-type

This configuration is optional. If set, then the datapath type of the integration bridge will be set to the configured value. If this option is not set, then ovn-controller will not modify the existing datapath-type of the integration bridge.

external_ids:ovn-remote

The OVN database that this system should connect to for its configuration, in one of the same forms documented above for the ovs-database.

external_ids:ovn-monitor-all

A boolean value that tells if ovn-controller should monitor all records of tables in ovs-database. If set to false, it will conditionally monitor the records that is needed in the current chassis.

It is more optimal to set it to true in use cases when the chassis would anyway need to monitor most of the records in ovs-database, which would save the overhead of conditions processing, especially for server side. Typically, set it to true for environments that all workloads need to be reachable from each other.

Default value is false.

external_ids:ovn-remote-probe-interval

The inactivity probe interval of the connection to the OVN database, in milliseconds. If the value is zero, it disables the connection keepalive feature.

If the value is nonzero, then it will be forced to a value of at least 1000 ms.

external_ids:ovn-openflow-probe-interval

The inactivity probe interval of the OpenFlow connection to the OpenvSwitch integration bridge, in seconds. If the value is zero, it disables the connection keepalive feature.

If the value is nonzero, then it will be forced to a value of at least 5s.

external_ids:ovn-encap-type

The encapsulation type that a chassis should use to connect to this node. Multiple encapsulation types may be specified with a comma-separated list. Each listed encapsulation type will be paired with ovn-encap-ip.

Supported tunnel types for connecting hypervisors are geneve and stt. Gateways may use geneve, vxlan, or stt.

Due to the limited amount of metadata in vxlan, the capabilities and performance of connected gateways will be reduced versus other tunnel formats.

external_ids:ovn-encap-ip

The IP address that a chassis should use to connect to this node using encapsulation types specified by external_ids:ovn-encap-type.

external_ids:ovn-bridge-mappings

A list of key-value pairs that map a physical network name to a local ovs bridge that provides connectivity to that network. An example value mapping two physical network names to two ovs bridges would be: physnet1:br-eth0,physnet2:br-eth1.

external_ids:ovn-encap-csum

ovn-encap-csum indicates that encapsulation checksums can be transmitted and received with reasonable performance. It is a hint to senders transmitting data to this chassis that they should use checksums to protect OVN metadata. Set to true to enable or false to disable. Depending on the capabilities of the network interface card, enabling encapsulation checksum may incur performance loss. In such cases, encapsulation checksums can be disabled.

external_ids:ovn-encap-tos

ovn-encap-tos indicates the value to be applied to OVN tunnel interface’s option:tos as specified in the Open_vSwitch database Interface table. Please refer to Open VSwitch Manual for details.

external_ids:ovn-cms-options

A list of options that will be consumed by the CMS Plugin and which specific to this particular chassis. An example would be: cms_option1,cms_option2:foo.

external_ids:ovn-transport-zones

The transport zone(s) that this chassis belongs to. Transport zones is a way to group different chassis so that tunnels are only formed between members of the same group(s). Multiple transport zones may be specified with a comma-separated list. For example: tz1,tz2,tz3.

If not set, the Chassis will be considered part of a default transport zone.

external_ids:ovn-chassis-mac-mappings

A list of key-value pairs that map a chassis specific mac to a physical network name. An example value mapping two chassis macs to two physical network names would be: physnet1:aa:bb:cc:dd:ee:ff,physnet2:a1:b2:c3:d4:e5:f6. These are the macs that ovn-controller will replace a router port mac with, if packet is going from a distributed router port on vlan type logical switch.

external_ids:ovn-is-interconn

The boolean flag indicates if the chassis is used as an interconnection gateway.

external_ids:ovn-match-northd-version

The boolean flag indicates if ovn-controller needs to check ovn-northd version. If this flag is set to true and the ovn-northd’s version (reported in the Southbound database) doesn’t match with the ovn-controller’s internal version, then it will stop processing the southbound and local Open vSwitch database changes. The default value is considered false if this option is not defined.

external_ids:ovn-ofctrl-wait-before-clear

The time, in milliseconds, to wait before clearing flows in OVS after OpenFlow connection/reconnection during ovn-controller initialization. The purpose of this wait is to give time for ovn-controller to compute the new flows before clearing existing ones, to avoid data plane down time during ovn-controller restart/upgrade at large scale environments where recomputing the flows takes more than a few seconds or even longer. It is difficult for ovn-controller to determine when the new flows computing is completed, because of the dynamics in the cloud environments, which is why this configuration is provided for users to adjust based on the scale of the environment. By default, it is 0, which means clearing existing flows without waiting. Not setting the value, or setting it too small, may result in data plane down time during upgrade/restart, while setting it too big may result in unnecessary extra control plane latency of applying new changes of CMS during upgrade/restart. In most cases, a slightly bigger value is not harmful, because the extra control plane latency happens only once during the OpenFlow connection. To get a reasonable range of the value setting, it is recommended to run the below commands on a node in the target environment and then set this configuration to twice the value of Maximum shown in the output of the second command.

- ovn-appctl -t ovn-controller inc-engine/recompute

- ovn-appctl -t ovn-controller stopwatch/show flow-generation

external_ids:ovn-enable-lflow-cache

The boolean flag indicates if ovn-controller should enable/disable the logical flow in-memory cache it uses when processing Southbound database logical flow changes. By default caching is enabled.

external_ids:ovn-limit-lflow-cache

When used, this configuration value determines the maximum number of logical flow cache entries ovn-controller may create when the logical flow cache is enabled. By default the size of the cache is unlimited.

external_ids:ovn-memlimit-lflow-cache-kb

When used, this configuration value determines the maximum size of the logical flow cache (in KB) ovn-controller may create when the logical flow cache is enabled. By default the size of the cache is unlimited.

external_ids:ovn-trim-limit-lflow-cache

When used, this configuration value sets the minimum number of entries in the logical flow cache starting with which automatic memory trimming is performed. By default this is set to 10000 entries.

external_ids:ovn-trim-wmark-perc-lflow-cache

When used, this configuration value sets the percentage from the high watermark number of entries in the logical flow cache under which automatic memory trimming is performed. E.g., if the trim watermark percentage is set to 50%, automatic memory trimming happens only when the number of entries in the logical flow cache gets reduced to less than half of the last measured high watermark. By default this is set to 50.

external_ids:ovn-trim-timeout-ms

When used, this configuration value specifies the time, in milliseconds, since the last logical flow cache operation after which ovn-controller performs memory trimming regardless of how many entries there are in the cache. By default this is set to 30000 (30 seconds).

ovn-controller reads the following values from the Open_vSwitch database of the local OVS instance:

datapath-type from Bridge table

This value is read from local OVS integration bridge row of Bridge table and populated in other_config:datapath-type of the Chassis table in the OVN_Southbound database.

iface-types from Open_vSwitch table

This value is populated in external_ids:iface-types of the Chassis table in the OVN_Southbound database.

private_key, certificate, ca_cert, and bootstrap_ca_cert from SSL table

These values provide the SSL configuration used for connecting to the OVN southbound database server when an SSL connection type is configured via external_ids:ovn-remote. Note that this SSL configuration can also be provided via command-line options, the configuration in the database takes precedence if both are present.

## OPEN VSWITCH DATABASE USAGE
ovn-controller uses a number of external_ids keys in the Open vSwitch database to keep track of ports and interfaces. For proper operation, users should not change or clear these keys:

external_ids:ovn-chassis-id in the Port table

The presence of this key identifies a tunnel port within the integration bridge as one created by ovn-controller to reach a remote chassis. Its value is the chassis ID of the remote chassis.

external_ids:ct-zone-* in the Bridge table

Logical ports and gateway routers are assigned a connection tracking zone by ovn-controller for stateful services. To keep state across restarts of ovn-controller, these keys are stored in the integration bridge’s Bridge table. The name contains a prefix of ct-zone- followed by the name of the logical port or gateway router’s zone key. The value for this key identifies the zone used for this port.

external_ids:ovn-localnet-port in the Port table

The presence of this key identifies a patch port as one created by ovn-controller to connect the integration bridge and another bridge to implement a localnet logical port. Its value is the name of the logical port with type set to localnet that the port implements. See external_ids:ovn-bridge-mappings, above, for more information.

Each localnet logical port is implemented as a pair of patch ports, one in the integration bridge, one in a different bridge, with the same external_ids:ovn-localnet-port value.

external_ids:ovn-l2gateway-port in the Port table

The presence of this key identifies a patch port as one created by ovn-controller to connect the integration bridge and another bridge to implement a l2gateway logical port. Its value is the name of the logical port with type set to l2gateway that the port implements. See external_ids:ovn-bridge-mappings, above, for more information.

Each l2gateway logical port is implemented as a pair of patch ports, one in the integration bridge, one in a different bridge, with the same external_ids:ovn-l2gateway-port value.

external-ids:ovn-l3gateway-port in the Port table

This key identifies a patch port as one created by ovn-controller to implement a l3gateway logical port. Its value is the name of the logical port with type set to l3gateway. This patch port is similar to the OVN logical patch port, except that l3gateway port can only be bound to a paticular chassis.

external-ids:ovn-logical-patch-port in the Port table

This key identifies a patch port as one created by ovn-controller to implement an OVN logical patch port within the integration bridge. Its value is the name of the OVN logical patch port that it implements.

external-ids:ovn-startup-ts in the Bridge table

This key represents the timestamp (in milliseconds) at which ovn-controller process was started.

external-ids:ovn-nb-cfg in the Bridge table

This key represents the last known OVN_Southbound.SB_Global.nb_cfg value for which all flows have been successfully installed in OVS.

external-ids:ovn-nb-cfg-ts in the Bridge table

This key represents the timestamp (in milliseconds) of the last known OVN_Southbound.SB_Global.nb_cfg value for which all flows have been successfully installed in OVS.

external_ids:ovn-installed and external_ids:ovn-installed-ts in the Interface table

This key is set after all openflow operations corresponding to the OVS interface have been processed by ovs-vswitchd. At the same time a timestamp, in milliseconds since the epoch, is stored in external_ids:ovn-installed-ts.

## OVN SOUTHBOUND DATABASE USAGE
ovn-controller reads from much of the OVN_Southbound database to guide its operation. ovn-controller also writes to the following tables:

Chassis

Upon startup, ovn-controller creates a row in this table to represent its own chassis. Upon graceful termination, e.g. with ovs-appctl -t ovn-controller exit (but not SIGTERM), ovn-controller removes its row.

Encap

Upon startup, ovn-controller creates a row or rows in this table that represent the tunnel encapsulations by which its chassis can be reached, and points its Chassis row to them. Upon graceful termination, ovn-controller removes these rows.

Port_Binding

At runtime, ovn-controller sets the chassis columns of ports that are resident on its chassis to point to its Chassis row, and, conversely, clears the chassis column of ports that point to its Chassis row but are no longer resident on its chassis. The chassis column has a weak reference type, so when ovn-controller gracefully exits and removes its Chassis row, the database server automatically clears any remaining references to that row.

MAC_Binding

At runtime, ovn-controller updates the MAC_Binding table as instructed by put_arp and put_nd logical actions. These changes persist beyond the lifetime of ovn-controller.

## RUNTIME MANAGEMENT COMMANDS
ovs-appctl can send commands to a running ovn-controller process. The currently supported commands are described below.

exit

Causes ovn-controller to gracefully terminate.

ct-zone-list

Lists each local logical port and its connection tracking zone.

meter-table-list

Lists each meter table entry and its local meter id.

group-table-list

Lists each group table entry and its local group id.

inject-pkt microflow

Injects microflow into the connected Open vSwitch instance. microflow must contain an ingress logical port (inport argument) that is present on the Open vSwitch instance.

The microflow argument describes the packet whose forwarding is to be simulated, in the syntax of an OVN logical expression, as described in ovn-sb(5), to express constraints. The parser understands prerequisites; for example, if the expression refers to ip4.src, there is no need to explicitly state ip4 or eth.type == 0x800.

connection-status

Show OVN SBDB connection status for the chassis.

recompute

Trigger a full compute iteration in ovn-controller based on the contents of the Southbound database and local OVS database.

This command is intended to use only in the event of a bug in the incremental processing engine in ovn-controller to avoid inconsistent states. It should therefore be used with care as full recomputes are cpu intensive.

sb-cluster-state-reset

Reset southbound database cluster status when databases are destroyed and rebuilt.

If all databases in a clustered southbound database are removed from disk, then the stored index of all databases will be reset to zero. This will cause ovn-controller to be unable to read or write to the southbound database, because it will always detect the data as stale. In such a case, run this command so that ovn-controller will reset its local index so that it can interact with the southbound database again.

debug/delay-nb-cfg-report seconds

This command is used to delay ovn-controller updating the nb_cfg back to OVN_Southbound database. This is useful when ovn-nbctl --wait=hv is used to measure end-to-end latency in a large scale environment. See ovn-nbctl(8) for more details.

lflow-cache/flush

Flushes the ovn-controller logical flow cache.

lflow-cache/show-stats

Displays logical flow cache statistics: enabled/disabled, per cache type entry counts.

inc-engine/show-stats

Display ovn-controller engine counters. For each engine node the following counters have been added:

- recompute

- compute

- abort

inc-engine/clear-stats

Reset ovn-controller engine counters.


ovn-controller-vtep

package: ovn-vtep

title: ovn-controller-vtep(8)

summary: Open Virtual Network local controller for vtep enabled physical switches\[char46]

text:
# ovn-controller-vtep(8)

## NAME
ovn-controller-vtep - Open Virtual Network local controller for vtep enabled physical switches.

## SYNOPSIS
ovn-controller-vtep [options] [--vtep-db=vtep-database] [--ovnsb-db=ovnsb-database]

## DESCRIPTION
ovn-controller-vtep is the local controller daemon in OVN, the Open Virtual Network, for VTEP enabled physical switches. It connects up to the OVN Southbound database (see ovn-sb(5)) over the OVSDB protocol, and down to the VTEP database (see vtep(5)) over the OVSDB protocol.

### PKI Options
PKI configuration is required in order to use SSL for the connections to the VTEP and Southbound databases.

-p privkey.pem

--private-key=privkey.pem

Specifies a PEM file containing the private key used as identity for outgoing SSL connections.

-c cert.pem

--certificate=cert.pem

Specifies a PEM file containing a certificate that certifies the private key specified on -p or --private-key to be trustworthy. The certificate must be signed by the certificate authority (CA) that the peer in SSL connections will use to verify it.

-C cacert.pem

--ca-cert=cacert.pem

Specifies a PEM file containing the CA certificate for verifying certificates presented to this program by SSL peers. (This may be the same certificate that SSL peers use to verify the certificate specified on -c or --certificate, or it may be a different one, depending on the PKI design in use.)

-C none

--ca-cert=none

Disables verification of certificates presented by SSL peers. This introduces a security risk, because it means that certificates cannot be verified to be those of known trusted hosts.

--bootstrap-ca-cert=cacert.pem

When cacert.pem exists, this option has the same effect as -C or --ca-cert. If it does not exist, then the executable will attempt to obtain the CA certificate from the SSL peer on its first SSL connection and save it to the named PEM file. If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL connections must be authenticated by a certificate signed by the CA certificate thus obtained.

This option exposes the SSL connection to a man-in-the-middle attack obtaining the initial CA certificate, but it may be useful for bootstrapping.

This option is only useful if the SSL peer sends its CA certificate as part of the SSL certificate chain. The SSL protocol does not require the server to send the CA certificate.

This option is mutually exclusive with -C and --ca-cert.

--peer-ca-cert=peer-cacert.pem

Specifies a PEM file that contains one or more additional certificates to send to SSL peers. peer-cacert.pem should be the CA certificate used to sign the program’s own certificate, that is, the certificate specified on -c or --certificate. If the program’s certificate is self-signed, then --certificate and --peer-ca-cert should specify the same file.

This option is not useful in normal operation, because the SSL peer must already have the CA certificate for the peer to have any confidence in the program’s identity. However, this offers a way for a new installation to bootstrap the CA certificate on its first SSL connection.

## CONFIGURATION
ovn-controller-vtep retrieves its configuration information from both the ovnsb and the vtep database. If the database locations are not given from command line, the default is the db.sock in local OVSDB’s ’run’ directory. The datapath location must take one of the following forms:

•

ssl:host:port

The specified SSL port on the give host, which can either be a DNS name (if built with unbound library) or an IP address (IPv4 or IPv6). If host is an IPv6 address, then wrap host with square brackets, e.g.: ssl:[::1]:6640. The --private-key, --certificate and either of --ca-cert or --bootstrap-ca-cert options are mandatory when this form is used.

•

tcp:host:port

Connect to the given TCP port on host, where host can be a DNS name (if built with unbound library) or IP address (IPv4 or IPv6). If host is an IPv6 address, then wrap host with square brackets, e.g.: tcp:[::1]:6640.

•

unix:file

On POSIX, connect to the Unix domain server socket named file.

On Windows, connect to a localhost TCP port whose value is written in file.


owampd

package: owamp-server

title: owampd(8)

summary: One-way latency server.

text:
# owampd(8)

## NAME
owampd - One-way latency server.

## SYNOPSIS
owampd [options]

## DESCRIPTION
owampd is a server program specifically designed to run one side of one-way latency tests. The client program owping is available to run the other side of the test.

Aside from actually running the tests, the main function of owampd is to determine which tests are allowed, based upon the policy restrictions configured by the system administrator.

owampd was designed to be run as a stand-alone daemon process. It uses the classic accept/fork model of handling new requests.

Most of the command line options for owampd have analogous options in the owamp-server.conf file. The command line takes precedence.

## OPTIONS
-a authmode

Specify the authentication modes the server is willing to use for communication. authmode should be set as a character string with any or all of the characters "AEO". The modes are:

A

[A]uthenticated. This mode encrypts the control connection and encrypts part of each test packet.

E

[E]ncrypted. This mode encrypts the control connection and encrypts each test packet in full. (This mode forces an encryption step between the fetching of a timestamp and when the packet is sent. This adds more computational delay to the time reported by OWAMP for each packet.)

O

[O]pen. No encryption of any kind is done.

The server can specify all the modes with which it is willing to communicate. The most strict mode that both the server and the client are willing to use will be selected.

Default:

"AEO".

-c confdir

Specify the directory that holds the owampd configuration files: .conf, .limits and .pfs.

Default:

Current working directory.

-d datadir

Specify the directory that holds the buffered data files. The data files are the result of one-way latency tests where the server is the receiving host. The data files are used to buffer the data, at least until a client downloads the file. Policy restrictions can be used to set how much disk space a given connection can use, as well as to determine when each file is deleted. (See the .limits(5) manual page.)

Default:

Current working directory.

-e facility

Syslog facility to which messages are logged.

Default:

LOG_DAEMON

-f

Disables the requirement that owampd be run with non-root permissions. There are legitimate reasons to run owampd as root, but it is more risky. (For example, some operating systems require root permissions to set some DSCP values requested by a client.) This additional option was added to ensure that root permissions are only used when explicitly intended.

-G group

Specify the gid for the owampd process. group can be specified using a valid group name or by using -gid. This option is only used if owampd is started as root.

This option can be useful to limit logfile permissions to only users in this group.

-h

Print a help message.

-P 0 | lowport-highport

Specify the specific port range to use on the local host for OWAMP-Test packets. This can be specified in two ways. First, as 0 which would indicate owampd should allow the system to pick the port (ephemeral). Second, as a range: lowport must be a smaller value than highport and both numbers must be valid port values. (16 bit unsigned integer values)

Default:

0

-R vardir

Specify the directory to hold the .pid file.

Default:

Current working directory

-S nodename:port

Specify the address and port on which owampd will listen for requests. nodename can be specified using a DNS name or using the textual representation of the address. It is possible to set the source address, without setting the port, simply by leaving off the ':' and port specification. Likewise, a non-default port can be specified for all system addresses (wildcard) by starting the specification string with a ':'. If an IPv6 address is specified, note that the accepted format contains nodename in square brackets, such as: [fe80::fe9f:62d8]. This ensures the port number is distinct from the address specification.

Default:

nodename is wildcarded as any currently available address. port is 861.

-U user

Specify the uid the owampd process should run as. user can be specified using a valid user name or by using -uid. This option is only used if owampd is started as root.

In the default case, owampd should be started as root so it can bind the protected port 861. (See -S option.) owampd will release root permissions shortly after binding to this protected port and requests will be serviced by processes running with permissions defined by the user.

-v

Set verbose output. Messages will still only go to syslog unless the -Z option is specified.

-Z

Run the master owampd process in the foreground. In this mode, error messages are printed to STDERR as well as being sent to syslog. Also, normal terminal controls are available. (i.e., <Cntr-C> will cause the daemon to kill it's child processes and exit.) This is useful for debugging.

## REQUIREMENTS
The owampd daemon requires a very well synchronized and stable clock. owampd requires that NTP be running to synchronize the system clock. NTP needs to be setup in a more methodical way than on most systems for the results to be meaningful. Please see the OWAMP web site (http://e2epi.internet2.edu/owamp/) for details concerning proper configuration of NTP for OWAMP.

## ERRORS
owampd uses syslog to output error messages including access information. The facility configuration option is used to determine what syslog facility is used. The levels used are as follows:

LOG_ERR

Used for messages indicating fatal errors. The requested action will not be performed.

LOG_WARNING

Used for messages indicating an unexpected or dangerous condition.

LOG_INFO

Used for access messages.

LOG_DEBUG

Used to indicate reasons for actions. For example, if an access is denied due to policy choices that will be noted with this log level.

These levels were chosen to give the system-administrator the ability to separate access log information from error log information in a straight forward manner.

## SIGNALS
The owampd process makes use of a number of signals to perform IPC between the various processes involved:

SIGALRM

Used throughout to set timers where appropriate.

SIGCHLD

Used to keep track of the state of child processes.

SIGINT

SIGTERM

SIGHUP

Used to terminate any owampd process. These signals are caught by the parent daemon and it manages the complete shutdown of all the owampd processes.

SIGPIPE

Disabled throughout owampd.

SIGUSR1

Used to tell a spawned off receiver/sender process that all control setup interaction is complete and the test can continue at the determined time. (This is an indication that the StartSessions message was received for those familiar with the OWAMP protocol.)

SIGUSR2

Used to tell a spawned off receiver/sender process to terminate a session early. (This is an indication that a StopSessions message was received for those familiar with the OWAMP protocol.)

## FILES
owamp-server.pid

owamp-server.conf

owamp-server.limits

owamp-server.pfs

## ENVIRONMENT VARIABLES
OWAMP uses environment variables for some debugging options.

OWAMP Environment Variable

Description

OWAMP_DEBUG_TIMEOFFSET

Offset time by this amount (seconds)

## SEE ALSO
There are more details on configuring the owampd daemon in the owamp-server.conf(5) manual page. Details on configuring the policy are in the owamp-server.limits(5) and owamp-server.pfs(5) manual pages. Information on the client is in the owping(1) manual page. For more of an overview of the full functionality and architecture, see the http://e2epi.internet2.edu/owamp/ web site.

## ACKNOWLEDGMENTS
This material is based in part on work supported by the National Science Foundation (NSF) under Grant No. ANI-0314723. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the NSF.


twampd

title: twampd(8)

summary: Two-way active measurement server.

text:
# twampd(8)

## NAME
twampd - Two-way active measurement server.

## SYNOPSIS
twampd [options]

## DESCRIPTION
twampd is a server program that allows a client to perform two-way or round-trip latency measurements. The application of timestamps in the reflector enables greater accuracy over the other most common facility for round-trip measurements, ICMP Echo Request/Reply.

Aside from running the tests, the main function of twampd is to determine which tests are allowed, based upon the policy restrictions configured by the system administrator.

twampd was designed to be run as a stand-alone daemon process. It uses the classic accept/fork model of handling new requests.

Most of the command line options for twampd have analogous options in the twamp-server.conf file. The command line takes precedence.

## OPTIONS
-a authmode

Specify the authentication modes the server is willing to use for communication. authmode should be set as a character string with any or all of the characters "AEO". The modes are:

A

[A]uthenticated. This mode encrypts the control connection and encrypts part of each test packet.

E

[E]ncrypted. This mode encrypts the control connection and encrypts each test packet in full. (This mode forces an encryption step between the fetching of a timestamp and when the packet is sent. This adds more computational delay to the time reported by TWAMP for each packet.)

O

[O]pen. No encryption of any kind is done.

The server can specify all the modes with which it is willing to communicate. The most strict mode that both the server and the client are willing to use will be selected.

Default:

"AEO".

-c confdir

Specify the directory that holds the twampd configuration files: .conf, .limits and .pfs.

Default:

Current working directory.

-d datadir

Specify the directory that holds the buffered data files. The data files are the result of one-way latency tests where the server is the receiving host. The data files are used to buffer the data, at least until a client downloads the file. Policy restrictions can be used to set how much disk space a given connection can use, as well as to determine when each file is deleted. (See the .limits(5) manual page.)

Default:

Current working directory.

-e facility

Syslog facility to which messages are logged.

Default:

LOG_DAEMON

-f

Disables the requirement that twampd be run with non-root permissions. There are legitimate reasons to run twampd as root, but it is more risky. (For example, some operating systems require root permissions to set some DSCP values requested by a client.) This additional option was added to ensure that root permissions are only used when explicitly intended.

-G group

Specify the gid for the twampd process. group can be specified using a valid group name or by using -gid. This option is only used if twampd is started as root.

This option can be useful to limit logfile permissions to only users in this group.

-h

Print a help message.

-P 0 | lowport-highport

Specify the specific port range to use on the local host for TWAMP-Test packets. This can be specified in two ways. First, as 0 which would indicate twampd should allow the system to pick the port (ephemeral). Second, as a range: lowport must be a smaller value than highport and both numbers must be valid port values. (16 bit unsigned integer values)

Default:

0

-R vardir

Specify the directory to hold the .pid file.

Default:

Current working directory

-S nodename:port

Specify the address and port on which twampd will listen for requests. nodename can be specified using a DNS name or using the textual representation of the address. It is possible to set the source address, without setting the port, simply by leaving off the ':' and port specification. Likewise, a non-default port can be specified for all system addresses (wildcard) by starting the specification string with a ':'. If an IPv6 address is specified, note that the accepted format contains nodename in square brackets, such as: [fe80::fe9f:62d8]. This ensures the port number is distinct from the address specification.

Default:

nodename is wildcarded as any currently available address. port is 862.

-U user

Specify the uid the twampd process should run as. user can be specified using a valid user name or by using -uid. This option is only used if twampd is started as root.

In the default case, twampd should be started as root so it can bind the protected port 862. (See -S option.) twampd will release root permissions shortly after binding to this protected port and requests will be serviced by processes running with permissions defined by the user.

-v

Set verbose output. Messages will still only go to syslog unless the -Z option is specified.

-Z

Run the master twampd process in the foreground. In this mode, error messages are printed to STDERR as well as being sent to syslog. Also, normal terminal controls are available. (i.e., <Cntr-C> will cause the daemon to kill it's child processes and exit.) This is useful for debugging.

## REQUIREMENTS
Unlike OWAMP, the TWAMP protocol does not require a well synchronized clock. However, the clock should be stable.

## ERRORS
twampd uses syslog to output error messages including access information. The facility configuration option is used to determine what syslog facility is used. The levels used are as follows:

LOG_ERR

Used for messages indicating fatal errors. The requested action will not be performed.

LOG_WARNING

Used for messages indicating an unexpected or dangerous condition.

LOG_INFO

Used for access messages.

LOG_DEBUG

Used to indicate reasons for actions. For example, if an access is denied due to policy choices that will be noted with this log level.

These levels were chosen to give the system-administrator the ability to separate access log information from error log information in a straight forward manner.

## SIGNALS
The twampd process makes use of a number of signals to perform IPC between the various processes involved:

SIGALRM

Used throughout to set timers where appropriate.

SIGCHLD

Used to keep track of the state of child processes.

SIGINT

SIGTERM

SIGHUP

Used to terminate any twampd process. These signals are caught by the parent daemon and it manages the complete shutdown of all the twampd processes.

SIGPIPE

Disabled throughout twampd.

SIGUSR1

Used to tell a spawned off receiver/sender process that all control setup interaction is complete and the test can continue at the determined time. (This is an indication that the StartSessions message was received for those familiar with the TWAMP protocol.)

SIGUSR2

Used to tell a spawned off receiver/sender process to terminate a session early. (This is an indication that a StopSessions message was received for those familiar with the TWAMP protocol.)

## FILES
twamp-server.pid

twamp-server.conf

twamp-server.limits

twamp-server.pfs

## ENVIRONMENT VARIABLES
twampd uses environment variables for some debugging options.

Environment Variable

Description

OWAMP_DEBUG_TIMEOFFSET

Offset time by this amount (seconds)

## SEE ALSO
There are more details on configuring the twampd daemon in the twamp-server.conf(5) manual page. Details on configuring the policy are in the twamp-server.limits(5) and twamp-server.pfs(5) manual pages. Information on the client is in the twping(1) manual page. For more of an overview of the full functionality and architecture, see the http://e2epi.internet2.edu/owamp/ web site.

## ACKNOWLEDGMENTS
This material is based in part on work supported by the National Science Foundation (NSF) under Grant No. ANI-0314723. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the NSF.


title: p11-kit(8)

text:
# p11-kit(8)

## NAME
p11-kit - Tool for operating on configured PKCS#11 modules

## SYNOPSIS
p11-kit list-modules

p11-kit extract ...

p11-kit server ...

## DESCRIPTION
p11-kit is a command line tool that can be used to perform operations on PKCS#11 modules configured on the system.

See the various sub commands below. The following global options can be used:

-v, --verbose

Run in verbose mode with debug output.

-q, --quiet

Run in quiet mode without warning or failure messages.

## LIST MODULES
List system configured PKCS#11 modules.

```
$ p11-kit list-modules
```

The modules, information about them and the tokens present in the PKCS#11 modules will be displayed.

## EXTRACT
Extract certificates from configured PKCS#11 modules.

This operation has been moved to a separate command trust extract. See trust(1) for more information

## SERVER
Run a server process that exposes PKCS#11 module remotely.

```
$ p11-kit server pkcs11:token1 pkcs11:token2 ...
$ p11-kit server --provider /path/to/pkcs11-module.so pkcs11:token1 pkcs11:token2 ...
```

This launches a server that exposes the given PKCS#11 tokens on a local socket. The tokens must belong to the same module. To access the socket, use p11-kit-client.so module. The server address and PID are printed as a shell-script snippet which sets the appropriate environment variable: P11_KIT_SERVER_ADDRESS and P11_KIT_SERVER_PID.

## EXTRACT TRUST
Extract standard trust information files.

This operation has been moved to a separate command trust extract-compat. See trust(1) for more information

## REMOTE
Run a PKCS#11 module remotely.

```
$ p11-kit remote /path/to/pkcs11-module.so
$ p11-kit remote pkcs11:token1 pkcs11:token2 ...
```

This is not meant to be run directly from a terminal. But rather in a remote option in a pkcs11.conf(5) file.

This exposes the given PKCS#11 module or tokens over standard input and output. Those two forms, whether to expose a module or tokens, are mutually exclusive and if the second form is used, the tokens must belong to the same module.

## BUGS
Please send bug reports to either the distribution bug tracker or the upstream bug tracker at https://github.com/p11-glue/p11-kit/issues/.

## SEE ALSO
pkcs11.conf(5)

Further details available in the p11-kit online documentation at https://p11-glue.github.io/p11-glue/p11-kit/manual/.


pacemakerd

package: pacemaker

title: pacemakerd(8)

text:
# pacemakerd(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
pacemakerd [options]

## DESCRIPTION
pacemakerd - primary Pacemaker daemon that launches and monitors all subsidiary Pacemaker daemons

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

-F, --features

Display full version and list of features Pacemaker was built with

-f, --foreground

(Ignored) Pacemaker always runs in the foreground

-p, --pid-file=FILE

(Ignored) Daemon pid file location

-S, --shutdown

Instruct Pacemaker to shutdown on this machine

-s, --standby

Start node in standby state

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors

## REPORTING BUGS
Report bugs to https://bugs.clusterlabs.org/enter_bug.cgi?product=Pacemaker


package: pacemaker-cli

title: attrd_updater(8)

text:
# attrd_updater(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
attrd_updater {-n <attribute> | -P <pattern>} <command> [options]

## DESCRIPTION
query and update Pacemaker node attributes

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-required

Show required arguments

--help-command

Show command options (mutually exclusive)

--help-additional

Show additional options

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Required Arguments:
-n, --name=NAME

The attribute's name

-P, --pattern=PATTERN

Operate on all attributes matching this pattern (with -B, -D, -U, or -Y)

### Command:
-U, --update=VALUE

Update attribute's value. Required: -n/--name or -P/--pattern. Optional: -d/--delay (if specified, the delay will be used if the attribute needs to be created, but ignored if the attribute already exists), -s/--set, -p/--private, -W/--wait, -z/--utilization.

-B, --update-both=VALUE

Update attribute's value and time to wait (dampening) in pacemaker-attrd. If this causes the value or dampening to change, the attribute will also be written to the cluster configuration, so be aware that repeatedly changing the dampening reduces its effectiveness. Requires -d/--delay

-Y, --update-delay

Update attribute's dampening in pacemaker-attrd. If this causes the dampening to change, the attribute will also be written to the cluster configuration, so be aware that repeatedly changing the dampening reduces its effectiveness. Requires -d/--delay

-Q, --query

Query the attribute's value from pacemaker-attrd

-D, --delete

Unset attribute from pacemaker-attrd. At the moment, there is no way to remove an attribute. This option will instead set its value to the empty string.

-R, --refresh

(Advanced) Force the pacemaker-attrd daemon to resend all current values to the CIB

### Additional Options:
-d, --delay=SECONDS

The time to wait (dampening) in seconds for further changes before sending to the CIB

-s, --set=SET

(Advanced) The attribute set in which to place the value

-N, --node=NODE

Set the attribute for the named node (instead of the local one)

-A, --all

Show values of the attribute for all nodes (query only)

-l, --lifetime=SECTION

(Not yet implemented) Lifetime of the node attribute (silently ignored by cluster)

-p, --private

If this creates a new attribute, never write the attribute to CIB

-W, --wait=UNTIL

Wait for some event to occur before returning. Values are 'no' (wait only for the attribute daemon to acknowledge the request), 'local' (wait until the change has propagated to where a local query will return the request value, or the value set by a later request), or 'cluster' (wait until the change has propagated to where a query anywhere on the cluster will return the requested value, or the value set by a later request). Default is 'no'.

-z, --utilization

When creating a new attribute, create it as a node utilization attribute instead of an instance attribute. If the attribute already exists, its existing type (utilization vs. instance) will be used regardless. (with -B, -U, -Y)

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors

## REPORTING BUGS
Report bugs to https://bugs.clusterlabs.org/enter_bug.cgi?product=Pacemaker


cibadmin

title: cibadmin(8)

text:
# cibadmin(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
cibadmin <command> [options]

## DESCRIPTION
query and edit the Pacemaker configuration

## OPTIONS

### Help Options:
-?, --help

Show help options

--help-all

Show all help options

--help-commands

Show command help

--help-data

Show data help

--help-additional

Show additional options

### Commands:
-u, --upgrade

Upgrade the configuration to the latest syntax

-Q, --query

Query the contents of the CIB

-E, --erase

Erase the contents of the whole CIB

-B, --bump

Increase the CIB's epoch value by 1

-C, --create

Create an object in the CIB (will fail if object already exists)

-M, --modify

Find object somewhere in CIB's XML tree and update it (fails if object does not exist unless -c is also specified)

-P, --patch

Supply an update in the form of an XML diff (see crm_diff(8))

-R, --replace

Recursively replace an object in the CIB

-D, --delete

Delete first object matching supplied criteria (for example, <op id="rsc1_op1" name="monitor"/>). The XML element name and all attributes must match in order for the element to be deleted.

-d, --delete-all

When used with --xpath, remove all matching objects in the configuration instead of just the first one

-a, --empty=[schema]

Output an empty CIB. Accepts an optional schema name argument to use as the validate-with value. If no schema is given, the latest will be used.

-5, --md5-sum

Calculate the on-disk CIB digest

-6, --md5-sum-versioned

Calculate an on-the-wire versioned CIB digest

### Data:
-X, --xml-text=value

Retrieve XML from the supplied string

-x, --xml-file=value

Retrieve XML from the named file

-p, --xml-pipe

Retrieve XML from stdin

### Additional Options:
-f, --force

Force the action to be performed

-t, --timeout=value

Time (in seconds) to wait before declaring the operation failed

-U, --user=value

Run the command with permissions of the named user (valid only for the root and hacluster accounts)

-s, --sync-call

Wait for call to complete before returning

-l, --local

Command takes effect locally (should be used only for queries)

-o, --scope=value

Limit scope of operation to specific section of CIB Valid values: configuration, nodes, resources, constraints, crm_config, rsc_defaults,

op_defaults, acls, fencing-topology, tags, alerts, status

If both --scope/-o and --xpath/-a are specified, the last one to appear takes effect

-A, --xpath=value

A valid XPath to use instead of --scope/-o If both --scope/-o and --xpath/-a are specified, the last one to appear takes effect

-e, --node-path

When performing XPath queries, return paths of any matches found (for example, "/cib/configuration/resources/clone[@id='dummy-clone']/primitive[@id='dummy']")

-S, --show-access=[value]

Whether to use syntax highlighting for ACLs (with -Q/--query and -U/--user) Allowed values: 'color' (default for terminal), 'text' (plain text, default for non-terminal),

'namespace', or 'auto' (use default value)

Default value: 'auto'

--score

Treat new attribute values as atomic score updates where possible (with --modify/-M). This currently happens by default and cannot be disabled, but this default behavior is deprecated and will be removed in a future release. Set this flag if this behavior is desired. This option takes effect when updating XML attributes. For an attribute named "name", if the new value is "name++" or "name+=X" for some score X, the new value is set as follows: If attribute "name" is not already set to some value in the element being updated, the new value is set as a literal string. If the new value is "name++", then the attribute is set to its existing value (parsed as a score) plus 1. If the new value is "name+=X" for some score X, then the attribute is set to its existing value plus X, where the existing value and X are parsed and added as scores. Scores are integer values capped at INFINITY and -INFINITY. Refer to Pacemaker Explained and to the char2score() function for more details on scores, including how they're parsed and added.

-c, --allow-create

(Advanced) Allow target of --modify/-M to be created if it does not exist

-n, --no-children

(Advanced) When querying an object, do not include its children in the result

-N, --node=value

(Advanced) Send command to the specified host

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

## EXAMPLES
Query the configuration from the local node:

\# cibadmin --query --local

Query just the cluster options configuration:

\# cibadmin --query --scope crm_config

Query all 'target-role' settings:

\# cibadmin --query --xpath "//nvpair[@name='target-role']"

Remove all 'is-managed' settings:

\# cibadmin --delete-all --xpath "//nvpair[@name='is-managed']"

Remove the resource named 'old':

\# cibadmin --delete --xml-text '<primitive id="old"/>'

Remove all resources from the configuration:

\# cibadmin --replace --scope resources --xml-text '<resources/>'

Replace complete configuration with contents of $HOME/pacemaker.xml:

\# cibadmin --replace --xml-file $HOME/pacemaker.xml

Replace constraints section of configuration with contents of $HOME/constraints.xml:

\# cibadmin --replace --scope constraints --xml-file $HOME/constraints.xml

Increase configuration version to prevent old configurations from being loaded accidentally:

\# cibadmin --modify --score --xml-text '<cib admin_epoch="admin_epoch++"/>'

Edit the configuration with your favorite $EDITOR:

\# cibadmin --query > $HOME/local.xml

\# $EDITOR $HOME/local.xml

\# cibadmin --replace --xml-file $HOME/local.xml

Assuming terminal, render configuration in color (green for writable, blue for readable, red for denied) to visualize permissions for user tony:

\# cibadmin --show-access=color --query --user tony | less -r

### SEE ALSO:

crm(8), pcs(8), crm_shadow(8), crm_diff(8)

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


cibsecret

title: cibsecret(8)

text:
# cibsecret(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## DESCRIPTION
cibsecret - manage sensitive information in Pacemaker CIB

### Usage:

cibsecret [<options>] <command> [<parameters>]

## OPTIONS
--help

Show this message, then exit

--version

Display version information, then exit

-C

Don't read or write the CIB

### Commands and their parameters:

set <resource-id> <resource-parameter> <value>

Set the value of a sensitive resource parameter.

get <resource-id> <resource-parameter>

Display the locally stored value of a sensitive resource parameter.

check <resource-id> <resource-parameter>

Verify that the locally stored value of a sensitive resource parameter matches its locally stored MD5 hash.

stash <resource-id> <resource-parameter>

Make a non-sensitive resource parameter that is already in the CIB sensitive (move its value to a locally stored and protected file). This may not be used with -C.

unstash <resource-id> <resource-parameter>

Make a sensitive resource parameter that is already in the CIB non-sensitive (move its value from the locally stored file to the CIB). This may not be used with -C.

delete <resource-id> <resource-parameter>

Remove a sensitive resource parameter value.

sync

Copy all locally stored secrets to all other nodes.

This command manages sensitive resource parameter values that should not be stored directly in Pacemaker's Cluster Information Base (CIB). Such values are handled by storing a special string directly in the CIB that tells Pacemaker to look in a separate, protected file for the actual value.

The secret files are not encrypted, but protected by file system permissions such that only root can read or modify them.

Since the secret files are stored locally, they must be synchronized across all cluster nodes. This command handles the synchronization using (in order of preference) pssh, pdsh, or ssh, so one of those must be installed. Before synchronizing, this command will ping the cluster nodes to determine which are alive, using fping if it is installed, otherwise the ping command. Installing fping is strongly recommended for better performance.

Known limitations:

This command can only be run from full cluster nodes (not Pacemaker Remote nodes).

Changes are not atomic, so the cluster may use different values while a change is in progress. To avoid problems, it is recommended to put the cluster in maintenance mode when making changes with this command.

Changes in secret values do not trigger an agent reload or restart of the affected resource, since they do not change the CIB. If a response is desired before the next cluster recheck interval, any CIB change (such as setting a node attribute) will trigger it.

If any node is down when changes to secrets are made, or a new node is later added to the cluster, it may have different values when it joins the cluster, before "cibsecret sync" is run. To avoid this, it is recommended to run the sync command (from another node) before starting Pacemaker on the node.

## EXAMPLES

cibsecret set ipmi_node1 passwd SecreT_PASS

cibsecret get ipmi_node1 passwd

cibsecret check ipmi_node1 passwd

cibsecret stash ipmi_node2 passwd

cibsecret sync

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


title: crm_attribute(8)

text:
# crm_attribute(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_attribute -n <attribute> <command> [options]

## DESCRIPTION
crm_attribute - query and update Pacemaker cluster options and node attributes

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-selections

Show selecting options

--help-command

Show command options

--help-additional

Show additional options

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Selecting attributes:
-a, --all

With -L/--list-options, include advanced and deprecated options in the output. This is always treated as true when --output-as=xml is specified.

-i, --id=XML_ID

(Advanced) Operate on instance of specified attribute with this XML ID

-n, --name=NAME

Operate on attribute or option with this name. For queries, this is optional, in which case all matching attributes will be returned.

-P, --pattern=PATTERN

Operate on all attributes matching this pattern (with -v, -D, or -G)

-p, --promotion=RESOURCE

Operate on node attribute used as promotion score for specified resource, or resource given in OCF_RESOURCE_INSTANCE environment variable if none is specified; this also defaults -l/--lifetime to reboot (normally invoked from an OCF resource agent)

-s, --set-name=NAME

(Advanced) Operate on instance of specified attribute that is within set with this XML ID

### Commands:
-L, --list-options=TYPE

List all available options of the given type. Allowed values: cluster

-D, --delete

Delete the attribute/option (with -n or -P)

-G, --query

Query the current value of the attribute/option. See also: -n, -P

-v, --update=VALUE

Update the value of the attribute/option (with -n or -P)

### Additional options:
-d, --default=VALUE

(Advanced) Default value to display if none is found in configuration

-l, --lifetime=LIFETIME

Lifetime of the node attribute. Valid values: reboot, forever

-N, --node=NODE

Set a node attribute for named node (instead of a cluster option). See also: -l

-t, --type=SECTION

Which part of the configuration to update/delete/query the option in. Valid values: crm_config, rsc_defaults, op_defaults, tickets

--score

Treat new attribute values as atomic score updates where possible (with --update/-v, when running against a CIB file or updating an attribute outside the status section; enabled by default if --promotion/-p is specified)

This currently happens by default and cannot be disabled, but

this default behavior is deprecated and will be removed in a future release (exception: this will remain the default with --promotion/-p). Set this flag if this behavior is desired.

This option takes effect when updating XML attributes. For an

attribute named "name", if the new value is "name++" or "name+=X" for some score X, the new value is set as follows:

* If attribute "name" is not already set to some value in

the element being updated, the new value is set as a literal string.

* If the new value is "name++", then the attribute is set to

its existing value (parsed as a score) plus 1.

* If the new value is "name+=X" for some score X, then the

attribute is set to its existing value plus X, where the existing value and X are parsed and added as scores.

Scores are integer values capped at INFINITY and -INFINITY.

Refer to Pacemaker Explained and to the char2score() function for more details on scores, including how they're parsed and added.

-W, --wait=UNTIL

Wait for some event to occur before returning. Values are 'no' (wait only for the attribute daemon to acknowledge the request), 'local' (wait until the change has propagated to where a local query will return the request value, or the value set by a later request), or 'cluster' (wait until the change has propagated to where a query anywhere on the cluster will return the requested value, or the value set by a later request). Default is 'no'. (with -N, and one of -D or -u)

-z, --utilization

Set an utilization attribute for the node.

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

-q, --quiet

Print only the value on stdout

## EXAMPLES
Add new node attribute called 'location' with the value of 'office' for host 'myhost':

crm_attribute --node myhost --name location --update office

Query the value of the 'location' node attribute for host 'myhost':

crm_attribute --node myhost --name location --query

Change the value of the 'location' node attribute for host 'myhost':

crm_attribute --node myhost --name location --update backoffice

Delete the 'location' node attribute for host 'myhost':

crm_attribute --node myhost --name location --delete

Query the value of the 'cluster-delay' cluster option:

crm_attribute --type crm_config --name cluster-delay --query

Query value of the 'cluster-delay' cluster option and print only the value:

crm_attribute --type crm_config --name cluster-delay --query --quiet

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


title: crm_diff(8)

text:
# crm_diff(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_diff original_xml operation [options]

## DESCRIPTION
Compare two Pacemaker configurations (in XML format) to produce a custom diff-like output, or apply such an output as a patch

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-xml

Show original XML options

--help-operation

Show operation options

--help-additional

Show additional options

### Original XML:
-o, --original=FILE

XML is contained in the named file

-O, --original-string=STRING

XML is contained in the supplied string

### Operation:
-n, --new=FILE

Compare the original XML to the contents of the named file

-N, --new-string=STRING

Compare the original XML with the contents of the supplied string

-p, --patch=FILE

Patch the original XML with the contents of the named file

### Additional Options:
-c, --cib

Compare/patch the inputs as a CIB (includes versions details)

-s, --stdin

-u, --no-version

Generate the difference without versions details

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

## EXAMPLES
Obtain the two different configuration files by running cibadmin on the two cluster setups to compare:

\# cibadmin --query > cib-old.xml

\# cibadmin --query > cib-new.xml

Calculate and save the difference between the two files:

\# crm_diff --original cib-old.xml --new cib-new.xml > patch.xml

Apply the patch to the original file:

\# crm_diff --original cib-old.xml --patch patch.xml > updated.xml

Apply the patch to the running cluster:

\# cibadmin --patch -x patch.xml

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


title: crm_error(8)

text:
# crm_error(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_error [options] -- <rc> [...]

## DESCRIPTION
crm_error - display name or description of a Pacemaker error code

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

-n, --name

Show error's name with its description (useful for looking for sources of the error in source code)

-l, --list

Show all known errors (enabled by default if no rc is specified)

-X, --exit

Interpret as exit code rather than legacy function return value

-r, --rc

Interpret as return code rather than legacy function return value

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors

## REPORTING BUGS
Report bugs to https://bugs.clusterlabs.org/enter_bug.cgi?product=Pacemaker


title: crm_failcount(8)

text:
# crm_failcount(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_failcount <command> [<options>]

## DESCRIPTION
crm_failcount - Query or delete resource fail counts

### Common options:
--help

Display this text, then exit

--version

Display version information, then exit

-V, --verbose

Specify multiple times to increase debug output

-q, --quiet

Print only the value (if querying)

### Commands:
-G, --query

Query the current value of the resource's fail count

-D, --delete

Delete resource's recorded failures

### Additional Options:
-r, --resource=value

Name of the resource to use (required)

-n, --operation=value

Name of operation to use (instead of all operations)

-I, --interval=value

If operation is specified, its interval

-N, --node=value

Use failcount on named node (instead of local node)

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


title: crm_master(8)

text:
# crm_master(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_master <command> [<options>]

## DESCRIPTION
crm_master - Query, update, or delete a resource's promotion score

This command is deprecated. Use crm_attribute with the --promotion option instead.

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


title: crm_mon(8)

text:
# crm_mon(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_mon [options]

## DESCRIPTION
Provides a summary of cluster's current state.

Outputs varying levels of detail in a number of different formats.

## OPTIONS

### Help Options:
-?, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-display

Show display options

--help-additional

Show additional options

--help-deprecated

Show deprecated options

### Output Options:
--output-as=FORMAT

Specify output format as one of: console (default), html, text, xml, none

--output-to=DEST

Specify file name for output (or "-" for stdout)

--html-cgi

Add CGI headers (requires --output-as=html)

--html-stylesheet=URI

Link to an external stylesheet (requires --output-as=html)

--html-title=TITLE

Specify a page title (requires --output-as=html)

### Display Options:
-I, --include=SECTION(s)

A list of sections to include in the output. See `Output Control` help for more information.

-U, --exclude=SECTION(s)

A list of sections to exclude from the output. See `Output Control` help for more information.

--node=NODE

When displaying information about nodes, show only what's related to the given node, or to all nodes tagged with the given tag

--resource=RSC

When displaying information about resources, show only what's related to the given resource, or to all resources tagged with the given tag

-n, --group-by-node

Group resources by node

-r, --inactive

Display inactive resources

-f, --failcounts

Display resource fail counts

-o, --operations

Display resource operation history

-t, --timing-details

Display resource operation history with timing details

-c, --tickets

Display cluster tickets

-m, --fence-history=LEVEL

Show fence history: 0=off, 1=failures and pending (default without option), 2=add successes (default without value for option), 3=show full history without reduction to most recent of each flavor

-L, --neg-locations

Display negative location constraints [optionally filtered by id prefix]

-A, --show-node-attributes

Display node attributes

-D, --hide-headers

Hide all headers

-R, --show-detail

Show more details (node IDs, individual clone instances)

--show-description

Show resource descriptions

-b, --brief

Brief output

### Additional Options:
-i, --interval=TIMESPEC

Update frequency (default is 5 seconds)

-1, --one-shot

Display the cluster status once and exit

-d, --daemonize

Run in the background as a daemon. Requires at least one of --output-to and --external-agent.

-p, --pid-file=FILE

(Advanced) Daemon pid file location

-E, --external-agent=FILE

A program to run when resource operations take place

-e, --external-recipient=RCPT

A recipient for your program (assuming you want the program to send something to someone).

-W, --watch-fencing

Listen for fencing events. For use with --external-agent.

### Deprecated Options:
-h, --as-html=FILE

Write cluster status to the named HTML file. Use --output-as=html --output-to=FILE instead.

-X, --as-xml

Write cluster status as XML to stdout. This will enable one-shot mode. Use --output-as=xml instead.

-s, --simple-status

Display the cluster status once as a simple one line output (suitable for nagios)

-N, --disable-ncurses

Disable the use of ncurses. Use --output-as=text instead.

-w, --web-cgi

Web mode with output suitable for CGI (preselected when run as *.cgi). Use --output-as=html --html-cgi instead.

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

-Q, --quiet

Be less descriptive in output.

## NOTES
If this program is called as crm_mon.cgi, --output-as=html and --html-cgi are automatically added to the command line arguments.

Time Specification:

The TIMESPEC in any command line option can be specified in many different formats. It can be an integer number of seconds, a number plus units (us/usec/ms/msec/s/sec/m/min/h/hr), or an ISO 8601 period specification.

## OUTPUT CONTROL
By default, a particular set of sections are written to the output destination. The default varies based on the output format: XML includes all sections by default, while other output formats include less. This set can be modified with the --include and --exclude command line options. Each option may be passed multiple times, and each can specify a comma-separated list of sections. The options are applied to the default set, in order from left to right as they are passed on the command line. For a list of valid sections, pass --include=list or --exclude=list.

## INTERACTIVE USE
When run interactively, crm_mon can be told to hide and show various sections of output. To see a help screen explaining the options, press '?'. Any key stroke aside from those listed will cause the screen to refresh.

## EXAMPLES
Display the cluster status on the console with updates as they occur:

crm_mon

Display the cluster status once and exit:

crm_mon -1

Display the cluster status, group resources by node, and include inactive resources in the list:

crm_mon --group-by-node --inactive

Start crm_mon as a background daemon and have it write the cluster status to an HTML file:

crm_mon --daemonize --output-as html --output-to /path/to/docroot/filename.html

Display the cluster status as XML:

crm_mon --output-as xml

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


title: crm_node(8)

text:
# crm_node(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_node [command] [options]

## DESCRIPTION
crm_node - Tool for displaying low-level node information

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-commands

Show command help

--help-additional

Show additional options

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Commands:
-i, --cluster-id

Display this node's cluster id

-l, --list

Display all known members (past and present) of this cluster

-n, --name

Display the name used by the cluster for this node

-p, --partition

Display the members of this partition

-q, --quorum

Display a 1 if our partition has quorum, 0 if not

-N, --name-for-id=ID

Display the name used by the cluster for the node with the specified ID

-R, --remove=NAME

(Advanced) Remove the (stopped) node with the specified name from Pacemaker's configuration and caches (the node must already have been removed from the underlying cluster stack configuration

### Additional Options:
-f, --force

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

-Q, --quiet

Be less descriptive in output.

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors

## REPORTING BUGS
Report bugs to https://bugs.clusterlabs.org/enter_bug.cgi?product=Pacemaker


title: crm_report(8)

text:
# crm_report(8)

## NAME
crm_report - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_report [options] [DEST]

## DESCRIPTION
crm_report - Create archive of everything needed when reporting cluster problems

### Required option:
-f, --from TIME

time prior to problems beginning (as "YYYY-M-D H:M:S" including the quotes)

## OPTIONS
-V

increase verbosity (may be specified multiple times)

-h, --help

display this message

-v, --version

display software version

--features

display software features

-t, --to TIME

time at which all problems were resolved (as "YYYY-M-D H:M:S" including the quotes; default "now")

-T, --cts TEST

CTS test or set of tests to extract

--cts-log

CTS master logfile

-n, --nodes NODES

node names for this cluster (only needed if cluster is not active on this host; accepts -n "a b" or -n a -n b)

-M

do not search for cluster logs

-l, --logfile FILE

log file to collect (in addition to detected logs if -M is not specified; may be specified multiple times)

-p PATT

additional regular expression to match variables to be masked in output (default: "passw.*")

-L PATT

additional regular expression to match in log files for analysis (default: CRIT: ERROR:)

-S, --single-node

don't attempt to collect data from other nodes

-c, --cluster TYPE

force the cluster type instead of detecting (currently only corosync is supported)

-C, --corosync

force the cluster type to be corosync

-u, --user USER

username to use when collecting data from other nodes (default root)

-D, --max-depth

search depth to use when attempting to locate files

-e, --rsh

command to use to run commands on other nodes (default ssh -T)

-d, --as-directory

leave result as a directory tree instead of archiving

--sos-mode

use defaults suitable for being called by sosreport tool (behavior subject to change and not useful to end users)

DEST, --dest DEST

custom destination directory or file name

crm_report works best when run from a cluster node on a running cluster, but can be run from a stopped cluster node or a Pacemaker Remote node.

If neither --nodes nor --single-node is given, crm_report will guess the node list, but may have trouble detecting Pacemaker Remote nodes. Unless --single-node is given, the node names (whether specified by --nodes or detected automatically) must be resolvable and reachable via the command specified by -e/--rsh using the user specified by -u/--user.

## EXAMPLES

crm_report -f "2011-12-14 13:05:00" unexplained-apache-failure crm_report -f 2011-12-14 -t 2011-12-15 something-that-took-multiple-days crm_report -f 13:05:00 -t 13:12:00 brief-outage


title: crm_resource(8)

text:
# crm_resource(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_resource <query>|<command> [options]

## DESCRIPTION
crm_resource - perform tasks related to Pacemaker cluster resources

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-queries

Show query help

--help-commands

Show command help

--help-locations

Show location help

--help-advanced

Show advanced option help

--help-additional

Show additional options

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Queries:
-L, --list

List all cluster resources with status

-l, --list-raw

List IDs of all instantiated resources (individual members rather than groups etc.)

-O, --list-operations

List active resource operations, optionally filtered by --resource and/or --node

-o, --list-all-operations

List all resource operations, optionally filtered by --resource and/or --node

--list-options=TYPE

List all available options of the given type Allowed values: primitive(primitive resource meta-attributes), fencing (parameters common to all fencing resources)

--list-standards

List supported standards

--list-ocf-providers

List all available OCF providers

--list-agents=STD:PROV

List all agents available for the named standard and/or provider

--list-ocf-alternatives=AGENT

List all available providers for the named OCF agent

--show-metadata=SPEC

Show the metadata for the named class:provider:agent

-q, --query-xml

Show XML configuration of resource (after any template expansion)

-w, --query-xml-raw

Show XML configuration of resource (before any template expansion)

-g, --get-parameter=PARAM

Display named parameter for resource (use instance attribute unless --element, --meta, or --utilization is specified)

-W, --locate

Show node(s) currently running resource

-a, --constraints

Display the location and colocation constraints that apply to a resource, and if --recursive is specified, to the resources directly or indirectly involved in those colocations. If the named resource is part of a group, or a clone or bundle instance, constraints for the collective resource will be shown unless --force is given.

-A, --stack

Equivalent to --constraints --recursive

-Y, --why

Show why resources are not running, optionally filtered by --resource and/or --node

### Commands:
--validate=LEVEL

Validate resource configuration by calling agent's validate-all action. The configuration may be specified either by giving an existing resource name with -r, or by specifying --class, --agent, and --provider arguments, along with any number of --option arguments. An optional LEVEL argument can be given to control the level of checking performed.

-C, --cleanup

If resource has any past failures, clear its history and fail count. Optionally filtered by --resource, --node, --operation and --interval (otherwise all). --operation and --interval apply to fail counts, but entire history is always clear, to allow current state to be rechecked. If the named resource is part of a group, or one numbered instance of a clone or bundled resource, the clean-up applies to the whole collective resource unless --force is given.

-R, --refresh

Delete resource's history (including failures) so its current state is rechecked. Optionally filtered by --resource and --node (otherwise all). If the named resource is part of a group, or one numbered instance of a clone or bundled resource, the refresh applies to the whole collective resource unless --force is given.

-p, --set-parameter=PARAM

Set named parameter for resource (requires -v). Use instance attribute unless --element, --meta, or --utilization is specified.

-d, --delete-parameter=PARAM

Delete named parameter for resource. Use instance attribute unless --element, --meta or, --utilization is specified.

### Locations:
-M, --move

Create a constraint to move resource. If --node is specified, the constraint will be to move to that node, otherwise it will be to ban the current node. Unless --force is specified this will return an error if the resource is already running on the specified node. If --force is specified, this will always ban the current node. Optional: --lifetime, --promoted. NOTE: This may prevent the resource from running on its previous location until the implicit constraint expires or is removed with --clear.

-B, --ban

Create a constraint to keep resource off a node. Optional: --node, --lifetime, --promoted. NOTE: This will prevent the resource from running on the affected node until the implicit constraint expires or is removed with --clear. If --node is not specified, it defaults to the node currently running the resource for primitives and groups, or the promoted instance of promotable clones with promoted-max=1 (all other situations result in an error as there is no sane default).

-U, --clear

Remove all constraints created by the --ban and/or --move commands. Requires: --resource. Optional: --node, --promoted, --expired. If --node is not specified, all constraints created by --ban and --move will be removed for the named resource. If --node and --force are specified, any constraint created by --move will be cleared, even if it is not for the specified node. If --expired is specified, only those constraints whose lifetimes have expired will be removed.

-e, --expired

Modifies the --clear argument to remove constraints with expired lifetimes.

-u, --lifetime=TIMESPEC

Lifespan (as ISO 8601 duration) of created constraints (with -B, -M) see https://en.wikipedia.org/wiki/ISO_8601#Durations)

--promoted

Limit scope of command to promoted role (with -B, -M, -U). For -B and -M, previously promoted instances may remain active in the unpromoted role.

--master

Deprecated: Use --promoted instead

### Advanced:
-D, --delete

(Advanced) Delete a resource from the CIB. Required: -t

-F, --fail

(Advanced) Tell the cluster this resource has failed

--restart

(Advanced) Tell the cluster to restart this resource and anything that depends on it

--wait

(Advanced) Wait until the cluster settles into a stable state

--digests

(Advanced) Show parameter hashes that Pacemaker uses to detect configuration changes (only accurate if there is resource history on the specified node). Required: --resource, --node. Optional: any NAME=VALUE parameters will be used to override the configuration (to see what the hash would be with those changes).

--force-demote

(Advanced) Bypass the cluster and demote a resource on the local node. Unless --force is specified, this will refuse to do so if the cluster believes the resource is a clone instance already running on the local node.

--force-stop

(Advanced) Bypass the cluster and stop a resource on the local node

--force-start

(Advanced) Bypass the cluster and start a resource on the local node. Unless --force is specified, this will refuse to do so if the cluster believes the resource is a clone instance already running on the local node.

--force-promote

(Advanced) Bypass the cluster and promote a resource on the local node. Unless --force is specified, this will refuse to do so if the cluster believes the resource is a clone instance already running on the local node.

--force-check=LEVEL

(Advanced) Bypass the cluster and check the state of a resource on the local node. An optional LEVEL argument can be given to control the level of checking performed.

### Additional Options:
-N, --node=NAME

Node name

--recursive

Follow colocation chains when using --set-parameter or --constraints

-t, --resource-type=ELEMENT

Resource XML element (primitive, group, etc.) (with -D)

-v, --parameter-value=PARAM

Value to use with -p

-m, --meta

Use resource meta-attribute instead of instance attribute (with -p, -g, -d)

-z, --utilization

Use resource utilization attribute instead of instance attribute (with -p, -g, -d)

--element

Use resource element attribute instead of instance attribute (with -p, -g, -d)

-n, --operation=OPERATION

Operation to clear instead of all (with -C -r)

-I, --interval=N

Interval of operation to clear (default 0) (with -C -r -n)

--class=CLASS

The standard the resource agent conforms to (for example, ocf). Use with --agent, --provider, --option, and --validate.

--agent=AGENT

The agent to use (for example, IPaddr). Use with --class, --provider, --option, and --validate.

--provider=PROVIDER

The vendor that supplies the resource agent (for example, heartbeat). Use with --class, --agent, --option, and --validate.

--option=PARAM

Specify a device configuration parameter as NAME=VALUE (may be specified multiple times). Use with --validate and without the -r option.

-s, --set-name=ID

(Advanced) XML ID of attributes element to use (with -p, -d)

-i, --nvpair=ID

(Advanced) XML ID of nvpair element to use (with -p, -d)

-T, --timeout=N

(Advanced) Abort if command does not finish in this time (with --restart, --wait, --force-*)

--all

List all options, including advanced and deprecated (with --list-options)

-f, --force

Force the action to be performed. See help for individual commands for additional behavior.

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

-Q, --quiet

Be less descriptive in output.

-r, --resource=ID

Resource ID

## EXAMPLES
List the available OCF agents:

\# crm_resource --list-agents ocf

List the available OCF agents from the linux-ha project:

\# crm_resource --list-agents ocf:heartbeat

Move 'myResource' to a specific node:

\# crm_resource --resource myResource --move --node altNode

Allow (but not force) 'myResource' to move back to its original location:

\# crm_resource --resource myResource --clear

Stop 'myResource' (and anything that depends on it):

\# crm_resource --resource myResource --set-parameter target-role--meta --parameter-value Stopped

Tell the cluster not to manage 'myResource' (the cluster will not attempt to start or stop the resource under any circumstances; useful when performing maintenance tasks on a resource):

\# crm_resource --resource myResource --set-parameter is-managed--meta --parameter-value false

Erase the operation history of 'myResource' on 'aNode' (the cluster will 'forget' the existing resource state, including any errors, and attempt to recover theresource; useful when a resource had failed permanently and has been repaired by an administrator):

\# crm_resource --resource myResource --cleanup --node aNode

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


title: crm_rule(8)

text:
# crm_rule(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_rule <mode> [options]

## DESCRIPTION
evaluate rules from the Pacemaker configuration

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-modes

Show modes of operation

--help-data

Show data options

--help-additional

Show additional options

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Modes (mutually exclusive):
-c, --check

Check whether a rule is in effect

### Data:
-X, --xml-text

Use argument for XML (or stdin if '-')

### Additional Options:
-d, --date

Whether the rule is in effect on a given date

-r, --rule

The ID of the rule to check (may be specified multiple times)

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors

## REPORTING BUGS
Report bugs to https://bugs.clusterlabs.org/enter_bug.cgi?product=Pacemaker


title: crm_shadow(8)

text:
# crm_shadow(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_shadow <query>|<command> [options]

## DESCRIPTION
perform Pacemaker configuration changes in a sandbox

This command sets up an environment in which configuration tools (cibadmin, crm_resource, etc.) work offline instead of against a live cluster, allowing changes to be previewed and tested for side effects.

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-queries

Show query help

--help-commands

Show command help

--help-additional

Show additional options

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Queries:
-w, --which

Indicate the active shadow copy

-p, --display

Display the contents of the active shadow copy

-d, --diff

Display the changes in the active shadow copy

-F, --file

Display the location of the active shadow copy file

### Commands:
-c, --create=name

Create the named shadow copy of the active cluster configuration

-e, --create-empty=name

Create the named shadow copy with an empty cluster configuration. Optional: --validate-with

-C, --commit=name

Upload the contents of the named shadow copy to the cluster

-D, --delete=name

Delete the contents of the named shadow copy

-E, --edit

Edit the contents of the active shadow copy with your favorite $EDITOR

-r, --reset=name

Recreate named shadow copy from the active cluster configuration

-s, --switch=name

(Advanced) Switch to the named shadow copy

### Additional Options:
-f, --force

(Advanced) Force the action to be performed

-b, --batch

(Advanced) Don't spawn a new shell

-a, --all

(Advanced) Upload entire CIB, including status, with --commit

-v, --validate-with

(Advanced) Create an older configuration version

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

## EXAMPLES
Create a blank shadow configuration:

\# crm_shadow --create-empty myShadow

Create a shadow configuration from the running cluster

\# crm_shadow --create myShadow

Display the current shadow configuration:

\# crm_shadow --display

Discard the current shadow configuration (named myShadow):

\# crm_shadow --delete myShadow --force

Upload current shadow configuration (named myShadow) to running cluster:

\# crm_shadow --commit myShadow

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors