System

Add a certificate or certificate chain to the system’s trust store

Adds a certificate or CA to the Hammerspace trust store. By default, cert-add accepts only root CA certificates. You do not need to add the Hammerspace system root CA — it is generated and distributed automatically.

Display this help and exit

The certificate or certificate chain in PEM format (Required)

PEM-format certificate content to add. Accepts a multi-line, quoted PEM string.

Allow adding intermediate CA certificates to the trust store (defaults to only adding root CA certificates)

Adds an intermediate CA certificate (rather than a root CA).

Allow adding self-signed non-CA certificates to the trust store (defaults to only adding root CA certificates)

Adds a self-signed, non-CA certificate (for example, a pinned server certificate).

List the system root CA certificate(s)

Lists the Hammerspace-generated system root CA certificate(s). The active CA is used to sign all internal node certificates.

Display this help and exit

List a specific CA by role. Possible values: SYSTEM_ACTIVE | SYSTEM_OLD.

Lists a specific CA by role. Valid values: SYSTEM_ACTIVE (the CA that signs node certificates and CSR-signed certificates) and SYSTEM_OLD (reserved for a CA that has been replaced; Hammerspace 5.3 provides no way to replace the system CA).

Sign a certificate signing request (CSR) with the system root CA certificate

Signs a Certificate Signing Request (CSR) using the Hammerspace system CA and returns a signed certificate that a client can install. The certificate is valid for 365 days and supports client authentication (clientAuth) only, so it cannot be used by a storage server. Include at least one IP address in the CSR’s Subject Alternative Name (SAN) field: the command does not require it, but peers that check the certificate generally match against the SAN.

Display this help and exit

The certificate signing request in PEM format

PEM-format CSR content to sign. Accepts a multi-line, quoted PEM string.

Add the certificate to the system’s inventory of known certificates

Adds the signed certificate to the Hammerspace certificate inventory, where its expiration date is shown. Hammerspace does not alert you before the certificate expires. Recommended.

List the known certificate(s)

Lists all certificates known to the system, including the system root CA and the per-node certificates signed by it.

Print extra information for each element

Displays detailed output, including validity dates and subject information.

Display this help and exit

The ID of the certificate to list

Retrieves a specific certificate by its ID.

List certificates that have this origin. Possible values: SYSTEM_CA | SYSTEM_ISSUED | CSR_SIGNED_BY_CA | UPLOADED_ROOT_CA | UPLOADED_INTERMEDIATE_CA | UPLOADED_PINNED_CERT.

Filters the list by how a certificate was added to the system. Valid values: SYSTEM_CA (the Hammerspace root CA), SYSTEM_ISSUED (the certificate issued to each Anvil and DSX node), CSR_SIGNED_BY_CA (certificates created by signing a CSR with the system CA), UPLOADED_ROOT_CA (an uploaded self-signed CA certificate), UPLOADED_INTERMEDIATE_CA (an uploaded intermediate CA certificate, added with --trust-intermediate-ca), and UPLOADED_PINNED_CERT (an uploaded self-signed certificate that is not a CA, added with --trust-self-signed-certificate).

Remove a certificate from the system’s trust store

Removes an uploaded CA certificate or pinned certificate, or a certificate signed from a CSR, from the trust store. Retrieve the certificate ID with cert-list first. SYSTEM_CA and SYSTEM_ISSUED certificates are managed by Hammerspace and cannot be removed.

Display this help and exit

The ID of the certificate to remove (Required)

Update cluster configuration

Causes the command to be executed asynchronously. A reference task identifier will be returned

The amount of time any GFS participant may remain in a SUSPECTED operational state before that state automatically transitioned to DOWN. May be formatted as 10seconds, 1minute, "1 hour 30 minutes", etc. When no units are specified, minutes are assumed

Display this help and exit

Disallow TLS for all external and internal NFS connections

Require TLS with mutual authentication for all external and internal NFS connections

When running a task-based command synchronously, monitor for task completion indefinitely

Determines whether online license activation is allowed. Allowed values:[YES, NO]

Disable Prometheus exporters

Enable Prometheus exporters

The URL of the HTTP proxy server (in the form http://a.b.c.d:pp)

Clear the HTTP proxy server configuration

An X.509 certificate, with an optional CA chain, in certificate PEM format that identifies the management server to the client

Reset the server to use an internally-generated self-signed certificate

An unencrypted RSA private key in PKCS#1 or PKCS#8 PEM format that is paired with the server certificate in the server-certificate-chain bundle

Specifies the timezone

View the cluster configuration

Configure DNS

Skip validation of new DNS server configuration

Display this help and exit

Set DNS server(s)

Clear DNS servers

View the DNS configuration

Update data portal

The data portal UUID. Required unless any of the following is specified: --data-portal-type, --node-name

The data portal type. Required unless any of the following is specified: --data-portal-id, --node-name Possible values: SMB | NFS_V3 | NFS_V4_1 | S3.

Set the data portal admin state to DOWN

Set the data portal admin state to UP

Display this help and exit

The node name. Required unless any of the following is specified: --data-portal-type, --data-portal-id

Add an SMTP gateway which will be used for events and call home through a mail server

The type of connection security to use (default: NONE). Possible values: NONE | TLS | STARTTLS.

The connection security mode used for the SMTP connection. Choose the mode that matches what your mail server expects:

Disable SMTP email

Enable SMTP email

Source email address from which the events will be sent

Display this help and exit

SMTP host

SMTP password

SMTP port

SMTP username

View current configuration

List events generated by the system

Include only cleared events

List events after "from-date", in the format [yyyy-MM-dd|dd-MMM-yyyy] [HH:mm:ss] Examples: "2025-06-21 02:42", "25-FEB-2025 19:25:30"

Print extra information for each element

Display this help and exit

The ID of the event to list

The number of last-emitted events to list

List all events with severity greater than or equal to the given severity. Possible values: DEBUG | INFORMATIONAL | NOTICE | WARNING | ERROR | CRITICAL | ALERT | EMERGENCY.

List all events of a given type.

Include only uncleared events

List events before "until-date", in the format [yyyy-MM-dd|dd-MMM-yyyy] [HH:mm:ss] Examples: "2025-06-21 02:42", "25-FEB-2025 19:25:30"

Clear events generated by the system

Clear all events. Required unless any of the following is specified: --type, --created-before, --created-after, --id

Clear events (Required)

Clear events after "created-after", in the format [yyyy-MM-dd|dd-MMM-yyyy] [HH:mm:ss] Examples: "2025-06-21 02:42", "25-FEB-2025 19:25:30". Required unless any of the following is specified: --type, --all, --created-before, --id

Clear events before "created-before", in the format [yyyy-MM-dd|dd-MMM-yyyy] [HH:mm:ss] Examples: "2025-06-21 02:42", "25-FEB-2025 19:25:30". Required unless any of the following is specified: --type, --all, --created-after, --id

Display this help and exit

The ID of the event to clear. Required unless any of the following is specified: --type, --all, --created-before, --created-after

Clear all events of a given type. Required unless any of the following is specified: --all, --created-before, --created-after, --id

List the configured heartbeats

Display this help and exit

Sends the specified heartbeat type to support

Display this help and exit

The ID of the heartbeat to send. Required unless any of the following is specified: --type, --name

The name of the heartbeat to send. Required unless any of the following is specified: --type, --id

The type of the heartbeat to send. Required unless any of the following is specified: --name, --id Possible values: HEALTH | CAPACITY.

Update the heartbeat configuration

Disables periodic heartbeat sending. Required unless any of the following is specified: --enable, --interval

Enables periodic heartbeat sending. Required unless any of the following is specified: --disable, --interval

Display this help and exit

The ID of the heartbeat configuration to be updated. Required unless any of the following is specified: --type, --name

Periodic heartbeat sending interval (default units: seconds, otherwise specify units, e.g. "5 minutes"). Required unless any of the following is specified: --enable, --disable

The name of the heartbeat configuration to be updated. Required unless any of the following is specified: --type, --id

The type of the heartbeat configuration to be updated. Required unless any of the following is specified: --name, --id Possible values: HEALTH | CAPACITY.

Map a federated user’s group to an internal Role. For example, map the members of a particular Active Directory group to the admin Role

Name of the group to map to the internal role (Required)

Display this help and exit

The ID of an internal role. Required unless "--mgmt-role-name" is specified

The name of an internal role. Required unless "--mgmt-role-id" is specified

A name for the group to role mapping. If missing, group::role is used. (Required)

Delete an identity group mapping

Display this help and exit

The ID of the identity group mapping to delete. Required unless "--name" is specified

The name of the identity group mapping to delete. Required unless "--id" is specified

List the identity group mappings

Print extra information for each element

Display this help and exit

List a specific identity group mapping by ID

List a specific identity group mapping by name

Update an identity group mapping

The name of a new identity group to associate with the role

Display this help and exit

The ID of the identity group mapping to update. Required unless "--name" is specified

The ID the role to associate with the identity group

The name the role to associate with the identity group

The name of the identity group mapping to update. Required unless "--id" is specified

Add an Identity Provider (IdP) such as Active Directory for purposes of federated authentication and authorization. See also the identity-group-mapping commands

The amount of time to wait for the system to connect to the IdP. May be formatted as 10seconds, 1minute, "1 hour 30 minutes", etc. When no units are specified, seconds are assumed

The type of connection security to use (default: NONE). Possible values: NONE | TLS | STARTTLS.

The connection security mode used for the LDAP connection to the identity provider. NONE connects in cleartext (normally port 389). TLS uses LDAPS, negotiating TLS immediately on connect (normally port 636). STARTTLS connects in cleartext and then upgrades the connection in place with the STARTTLS command. SSL is accepted as a synonym for TLS.

The name of an IdP domain. When adding an AD IdP, this specifies the AD domain (Required)

Instructs the system to follow referrals when resolving usernames. Typically, only required when there are cross-domain memberships

Display this help and exit

The name of this IdP (Required)

The amount of time to wait for the system to read from the IdP. May be formatted as 10seconds, 1minute, "1 hour 30 minutes", etc. When no units are specified, seconds are assumed

A comma-separated list of fully-qualified domain names or IP addresses, optionally followed by a colon-separated TCP port. The list may not contain spaces.

(Required)

A comma-separated list of fully-qualified domain names or IP addresses. The list may not contain spaces. To use a non-standard port, append it to a server entry, for example dc1.example.com:636

The type of IdP being added. Possible values: AD.

Enable validation of server certificates for SSL/TLS connections.

Enable validation of the identity provider’s server certificate. Applies when --connection-security is TLS or STARTTLS. Before enabling validation, install the issuing CA (and any intermediates) so Hammerspace trusts the server certificate, from the GUI under Administration  TLS  Trusted Certificates or with cert-add; otherwise logins fail during the TLS handshake.

If you omit this option, certificate validation is disabled. idp-add has no option to disable validation; to turn validation off after enabling it, use idp-update --validate-server-certs-disable.

List the federated Identity Providers (IdPs)

Print extra information for each element

Display this help and exit

List a specific IdP by ID

List a specific IdP by name

Remove a federated Identity Provider (IdP)

Display this help and exit

The ID of the IdP to remove. Required unless "--name" is specified

The name of the IdP to remove. Required unless "--id" is specified

Update a federated Identity Provider (IdP)

The amount of time to wait for the system to connect to the IdP. May be formatted as 10seconds, 1minute, "1 hour 30 minutes", etc. When no units are specified, seconds are assumed

The type of connection security to use. Possible values: NONE | TLS | STARTTLS.

A domain name

Instructs the system to follow referrals when resolving usernames. Typically, only required when there are cross-domain memberships

Display this help and exit

The ID of the IdP to update. Required unless "--name" is specified

Instructs the system to not follow referrals when resolving usernames

The name of the IdP to update. Required unless "--id" is specified

The amount of time to wait for the system to read from the IdP. May be formatted as 10seconds, 1minute, "1 hour 30 minutes", etc. When no units are specified, seconds are assumed

A comma-separated list of fully-qualified domain names or IP addresses, optionally followed by a colon-separated TCP port. The list may not contain spaces.

Disable validation of server certificates for SSL/TLS connections.

Enable validation of server certificates for SSL/TLS connections.

Add a key management system (KMS)

Authentication username (* required for AWS_KMS)

An X.509 certificate in certificate PEM format that identifies the client to the server (* required for NCIPHER_WSOP)

An RSA private key in PKCS#1 or PKCS#8 PEM format that is paired with the client-certificate (* required for NCIPHER_WSOP)

Any comment to be associated with the KMS

The endpoint (URI or host:port) of the KMS (* required for and exclusive to NCIPHER_WSOP)

Display this help and exit

The key identifier to use with the KMS (* required for AWS_KMS and NCIPHER_WSOP)

A name for the KMS (Required)

The passphrase (* required for and exclusive to PASSPHRASE). If not specified, it will be prompted for.

Authentication password (* required for AWS_KMS)

An X.509 certificate, with optional CA chain, in certificate PEM format that identifies the KMS server to the client (* required for and exclusive to NCIPHER_WSOP)

The type of KMS system being added. Possible values: NCIPHER_WSOP | AWS_KMS | PASSPHRASE. (Required)

List the key management systems (KMS)s

Print extra information for each element

Display this help and exit

The ID of the KMS to list

The internal ID of the KMS to list

The name of the KMS to list

Remove a key management system

Force the removal of a KMS, even if object storage volumes exist

Display this help and exit

The ID of the KMS to remove. Required unless any of the following is specified: --internal-id, --name

The internal ID of the KMS to remove. Required unless any of the following is specified: --name, --id

The name of the KMS to remove. Required unless any of the following is specified: --internal-id, --id

Update a key management system (KMS)

Authentication username (exclusive to AWS_KMS)

Prompt for a new passphrase for the PASSPHRASE KMS

An X.509 certificate in Base64-encoded PEM format (with the BEGIN and END tags) that identifies the client to the server (exclusive to NCIPHER_WSOP)

An RSA private key in Base64-encoded PEM format (with the BEGIN and END tags) that is paired with the client-certificate (exclusive to NCIPHER_WSOP)

Any comment to be associated with the KMS

The endpoint (URI or host:port) of the NCIPHER_WSOP KMS

Display this help and exit

The ID of the KMS to update. Required unless any of the following is specified: --internal-id, --name

The internal ID of the KMS to update. Required unless any of the following is specified: --name, --id

The key identifier to use with the KMS

The name of the KMS to update. Required unless any of the following is specified: --internal-id, --id

A new name for the KMS

A new passphrase for the PASSPHRASE KMS

Authentication password (exclusive to AWS_KMS)

An X.509 certificate with optional CA chain in Base64-encoded PEM format (with the BEGIN and END tags) that identifies the NCIPHER_WSOP KMS server to the client

Update information for the local site.

The name of the data center location of the site

Clears the data center location

Alternate specification of the location in <latitude>,<longitude> format

Clears both the latitude and longitude

Display this help and exit

The latitude (-90.0 to 90.0) of the site

Clears the latitude

The longitude (-180.0 to 180.0) of the site

Clears the longitude

The new name of the local site

An address which overrides the site’s data address. When specified, this address will be used as the effective data address advertised to other sites. When not specified, the cluster’s data address will be used as the effective address

Clears the override-data-address

An address which overrides the site’s mgmt address. When specified, this address will be used as the effective mgmt address advertised to other sites. When not specified, the cluster’s mgmt address will be used as the effective address

Clears the override-mgmt-address

Alternate specification of the location in Plus Code format

View the local site

Add and activate a license

The license activation ID

Causes the command to be executed asynchronously. A reference task identifier will be returned

Number of 1TB units of storage capacity to allocate to this license. Only applicable with capacity-based licenses

Display this help and exit

A management IP of a metered license server

The password for the user named by the license-server-username parameter

A user who has administrative rights on the metered license server

When running a task-based command synchronously, monitor for task completion indefinitely

The type of license to add. Possible values: NODE | FILE_CAPACITY | OBJECT_CAPACITY | METERED. (Required)

List all licenses

The activation ID of the license to list

Display this help and exit

Add and activate a license via an offline process. A request file is generated and obtained via one of the export parameters. The request file is then exchanged for a response file by the license administrator or at the license portal. The response file is then uploaded to complete the process.

The license activation ID (Required)

Number of 1TB units of storage capacity to allocate to this license. Only applicable with capacity-based licenses

Causes an activation request to be copied to an ftp, scp, or mailto location. Examples: ftp://example.com/uploads, scp://example.com/uploads, mailTo:john.doe@example.com. Required unless "--import-uri" is specified

Display this help and exit

The location of the activation response file to be uploaded which will complete the offline license add process. Examples: ftp://example.com/uploads/capabilityResponse.bin, scp://example.com/uploads/capabilityResponse.bin. Required unless any of the following is specified: --export-uri, --type

The type of license to add. Required unless "--import-uri" is specified. Possible values: NODE | FILE_CAPACITY | OBJECT_CAPACITY.

Cancel a pending offline license operation for a given activation ID. If the initial request has already been uploaded to the license server, use the appropriate license-offline command to complete the operation.

The license activation ID associated with the pending offline request (Required)

Display this help and exit

Deactivate and remove a license via an offline process. A request file is generated and obtained via one of the export parameters. The request file is then exchanged for a response file by the license administrator or at the license portal. The response file is then uploaded to complete the update process.

The license activation ID (Required)

Causes a remove request file to be copied to an ftp, scp, or mailto location. Examples: ftp://example.com/uploads, scp://example.com/uploads, mailTo:john.doe@example.com. Required unless "--import-uri" is specified

Display this help and exit

The location of the activation response file to be uploaded which will complete the offline license add process. Examples: ftp://example.com/uploads/capabilityResponse.bin, scp://example.com/uploads/capabilityResponse.bin. Required unless "--export-uri" is specified

Update a license via an offline process. This supports administrative changes that do not affect capacity, such as expiration date extensions. A request file is generated and obtained via one of the export parameters. The request file is then exchanged for a response file by the license administrator or at the license portal. The response file is then uploaded to complete the update process.

The license activation ID (Required)

New number of 1TB units of storage capacity to allocate to this license

Causes an update request file to be copied to an ftp, scp, or mailto location. Examples: ftp://example.com/uploads, scp://example.com/uploads, mailTo:john.doe@example.com. Required unless "--import-uri" is specified

Display this help and exit

The location of the activation response file to be uploaded which will complete the offline license add process. Examples: ftp://example.com/uploads/capabilityResponse.bin, scp://example.com/uploads/capabilityResponse.bin. Required unless "--export-uri" is specified

Deactivate and remove a license

The license activation ID (Required)

Causes the command to be executed asynchronously. A reference task identifier will be returned

When license-remove is invoked from the licensed client, the presence of the force parameter will cause the license to be removed from the client even if the license server can not be reached. When invoked from the license server, the force parameter is required and will cause the license server’s record of the license to be deleted.

Display this help and exit

When running a task-based command synchronously, monitor for task completion indefinitely

Update the allocated capacity for a capacity-based license

The license activation ID (Required)

Causes the command to be executed asynchronously. A reference task identifier will be returned

New number of 1TB units of storage capacity to allocate to this license

Display this help and exit

For a metered license, update the IP of server to which usage reporting is sent. The IP must identify the license server which originally granted the client license.

When running a task-based command synchronously, monitor for task completion indefinitely

List metrics

Field names in the format: <table-name>.<column-name> (e.g., network.bytesSent) (Required)

Shows metrics after date "from-date" (default: now - 1h)

Computational aggregate function. Possible values: MIN | MAX | MEAN | MEDIAN.

Time grouping interval. For example, 60s (seconds), 60m (minutes), 24h (hours), 7d (days), 52w (weeks)

Display this help and exit

Total number of samples per column (default: 1000)

Name criteria on the metrics

Object type criteria on the metrics

Shows metrics before date "until-date"

Shows metrics on an object with the specified UUID

Manage configured Name Services

Configures and manages LDAP name services used for user and group resolution on the NFS data path. When called without an operation flag, name-service-config defaults to --list. Operations (--add, --list, --update, --remove, --resolution-order, --resolve-user, --resolve-group, --resolve-user-groups, --test-connect) cannot be combined in one command.

Add a new LDAP Name Service

The network address of the LDAP server in the form <host>[:port]. Host can be an IP address or a DNS name. Port is optional. Can be repeated. Required when adding, optional for update

IP address or DNS hostname of the LDAP server, with an optional :port suffix (1–65535). Required for --add, optional for --update. If the port is omitted, the connection test tries port 389 and then 636; a port is required if --no-connection-test is used. Repeat --address once per server; do not separate addresses with commas. On --update, the addresses given replace all existing addresses. More than one address works only with --no-connection-test, --transport-mode, and a port on every address.

Clear both the Bind Distinguished Name (Bind DN) and the Bind Secret/password

Removes the Bind DN and Bind Secret from the name service. Used with --update.

The Bind Distinguished Name used to authenticate and search the directory. Example: cn=search-user,ou=people,dc=example,dc=com

Bind distinguished name for authenticated access. Must be used with --bind-secret. On --add, a plain account name is expanded to cn=<name>,<domain in dc= form>; on --update, give a full DN.

The Bind Secret/password of the LDAP user described by the Bind Distinguished Name (Bind DN)

Password for the Bind DN. Must be used with --bind-dn when adding a name service; on --update, give it alone to change only the secret. The CLI does not prompt for the secret; it is given on the command line. In 5.3, --bind-secret is also required on every --update of a name service that has a Bind DN, except with --bind-clear.

The domain name of the LDAP Name Service. Optional: the management name will be used if not provided. Add only

Domain name (for example, corp.example.com). If omitted on --add, the --name value is used as the domain name and must be a valid domain name. Must be unique (case-insensitive) and is immutable after creation. The LDAP server must serve a naming context for the domain (dc=corp,dc=example,dc=com).

Display this help and exit

The ID (UUID) of the Name Service

UUID of the name service. Valid on --list, --update, and --remove. Illegal on --add.

The internal ID of the Name Service

Integer ID of the name service. Valid on --list, --update, and --remove. Illegal on --add.

List configured Name Services

Lists all configured name services in resolution order.

The management name of the Name Service

Management name of the name service. Maximum 255 characters; must be unique (case-insensitive). Required for --add; optional for --list, --update, and --remove.

The new management name of the LDAP Name Service. Update only

Skip the pre-add or pre-update connectivity validation test

Skips the connection test. Requires --transport-mode and a port in each --address value. On --update, the connection test runs only when the addresses, ports, transport mode, or search base change, even without this option.

Remove a configured LDAP Name Service

A comma-separated list of Name Service identifiers (names, UUIDs, or internal IDs)
describing the order in which they will be used for name resolution.
Any configured Name Services not provided will be sorted to the end of the list in indeterminate order

Reorders existing name services. Provide a comma-separated list of names, UUIDs, or internal IDs (all identifiers must be of the same type). Any name service whose identifier is not listed is sorted to the end with no guaranteed order.

Supply a group name to test how Hammerspace resolves it. Can be qualified or unqualified

Looks up a group. Uses the same qualified/unqualified domain behavior as --resolve-user.

Supply a username to test how Hammerspace resolves it. Can be qualified or unqualified

Looks up a user against configured name services via SSSD. Unqualified names (for example, jsmith) are looked up in every configured domain, with a result for each domain; qualified names (for example, jsmith@corp.example.com) are looked up only in the specified domain, and a domain that is not configured returns an error.

Supply a username to test how Hammerspace resolves its groups. Can be qualified or unqualified

Lists all groups a user belongs to. Uses the same qualified/unqualified domain behavior as --resolve-user.

The LDAP schema. Defaults to RFC2307. Possible values: RFC2307 | RFC2307BIS.

The LDAP search base. Defaults to the domain’s root if not provided.

(default) dc=example,dc=com; (custom) ou=people,dc=example,dc=com

LDAP search base in domain-component syntax, for example dc=corp,dc=example,dc=com. Pass "" to set a blank search base.

Reset the LDAP search base to the domain’s root. Update only

Resets the search base to the domain’s root (for example, dc=corp,dc=example,dc=com). Used with --update.

Test connectivity to provided Name Service(s). Provide a single identifier, or a comma-separated
list of Name Service identifiers (names, UUIDs, or internal IDs) describing the Name Service(s) to test

Reruns the connection test for configured name services, using their saved address, port, transport mode, search base, and bind credentials. All identifiers in a list must be of the same type. The test checks that an LDAPS or StartTLS certificate names the configured address, but not that it is trusted.

The Transport to use for connections. Optional: a connection test will determine
the most secure supported transport if not provided. Possible values: STARTTLS | LDAPS | LDAP.

Connection transport mode: LDAP, LDAPS, or STARTTLS (not case-sensitive). If omitted, the connection test tries STARTTLS, then LDAPS, then LDAP, and keeps the first that works. Required if --no-connection-test is used.

Reset the transport mode to use the default (discovered) value for the LDAP server

Clears the transport mode so it is re-determined. Used with --update. Cannot be used with --no-connection-test.

Update a configured LDAP Name Service

Configure NIS servers

Disable NIS service, clear NIS servers

Enable NIS service

Display this help and exit

NIS servers configuration in the form domain:server, example: --servers somedomain.local:192.168.3.17. This parameter may be repeated.

View NIS configuration

Create a notification rule

Notification format. Possible values: PLAIN | XML. (Required)

Display this help and exit

Rule name (Required)

Severity threshold. Selecting a threshold means that users will be notified on any events with severity greater than or equal to the selected threshold. Possible values: DEBUG | INFORMATIONAL | NOTICE | WARNING | ERROR | CRITICAL | ALERT | EMERGENCY. (Required)

Destination users (each must have an email address)

List notification rules

Print extra information for each element

Display this help and exit

Notification rule identifier

Notification rule name

Remove a notification rule

Display this help and exit

Notification rule identifier. Required unless "--name" is specified

Notification rule name. Required unless "--id" is specified

Update a notification rule

Display this help and exit

Notification rule identifier. Required unless "--name" is specified

Notification rule name. Required unless "--id" is specified

New notification format. Required unless any of the following is specified: --new-threshold, --new-name Possible values: PLAIN | XML.

New name. Required unless any of the following is specified: --new-format, --new-threshold

New severity threshold. Required unless any of the following is specified: --new-format, --new-name Possible values: DEBUG | INFORMATIONAL | NOTICE | WARNING | ERROR | CRITICAL | ALERT | EMERGENCY.

Configure NTP

Display this help and exit

Comma-separated list of NTP server hostnames or IP addresses.

Clear all NTP servers

View NTP configuration

Collect logs and information from all nodes

Collect from all available nodes. Required unless any of the following is specified: --current, --push, --node

Causes the command to be executed asynchronously. A reference task identifier will be returned

Collect from current node. For push requests, use this option to send only the current node. Required unless any of the following is specified: --all, --push, --node

Display this help and exit

Collect locally

Optional message to include with the support bundle request. Use quotes if the message contains spaces

Optional message to include with the support bundle request. Use quotes if the message contains spaces. Do not include passwords or other secrets.

The message is recorded in the System Management logs, which are collected in the generated bundle. For example:

When running a task-based command synchronously, monitor for task completion indefinitely

Collect from specific node. Required unless any of the following is specified: --current, --all, --push

Collect and push to Support Center. Defaults to all nodes unless --current, --all, or --node is specified. Required unless any of the following is specified: --current, --all, --node

Add a remote site

Display this help and exit

The management address of the remote site (Required)

Automatically trust the remote site’s client certificate

Discover a remote site and, optionally, synchronize data on the local instance of the remote site

Display this help and exit

The management address (IP or DNS) of the remote site (Required)

Synchronize data on the local site instance with discovered remote values

List known remote sites

Print extra information for each element

Display this help and exit

The ID of the site to be listed

The internal ID of the site to be listed

The name of the site to be listed

Remove a remote site. Note that if the site is sharing an object volume with this site, it will automatically be re-added

Display this help and exit

The ID of the site to be removed. Required unless any of the following is specified: --internal-id, --name

The internal ID of the site to be removed. Required unless any of the following is specified: --name, --id

The name of the site to be removed. Required unless any of the following is specified: --internal-id, --id

Update a remote site. Use this to override the management and data address when configuring a Global File System. Overriding addresses is commonly used when network topologies are using NAT.

Display this help and exit

The ID of the site to be updated. Required unless any of the following is specified: --internal-id, --name

The internal ID of the site to be updated. Required unless any of the following is specified: --name, --id

The remote site’s name. Required unless any of the following is specified: --internal-id, --id

Do not automatically trust the remote site’s client certificate

An address which overrides the remote site’s data address. When specified, this will be the effective data address used to communicate with the remote site

Clears the override-data-address

An address which overrides the remote site’s mgmt address. When specified, this will be the effective mgmt address used to communicate with the remote site

Clears the override-mgmt-address

Automatically trust the remote site’s client certificate

Create a schedule

Expression values follow cron syntax where:
',' Commas separate lists
'-' Hyphens define ranges
'*' Wildcard matches all cases
'/' Slashes define step values i.e. */5 = every 5 minutes

To create a schedule at 1:30 AM, 12:30 PM and 6:30 PM, Monday-Friday

The day of month for schedule. Allowed values are: 1-31,-*/ (default value: *)

The day of week for schedule. Allowed values are: 1-7,SUN-SAT-*/ (default value: *)

Display this help and exit

The hour for schedule. Allowed values are: 0-23,-*/ (default value: *)

The minute for schedule. Allowed values are: 0-59,-*/ (default value: *)

The month for schedule. Allowed values are: 1-12,-*/ (default value: *)

The name of the schedule (Required)

Delete a schedule

Display this help and exit

The ID of the schedule to delete. Required unless "--name" is specified

The name of the schedule to delete. Required unless "--id" is specified

List schedules

Print extra information for each element

Display this help and exit

The ID of the schedule to list

The name of the schedule to list

Update a schedule

Expression values follow cron syntax where:
',' Commas separate lists
'-' Hyphens define ranges
'*' Wildcard matches all cases
'/' Slashes define step values i.e. */5 = every 5 minutes

To update a schedule to 1:30 AM, 12:30 PM and 6:30 PM, Monday-Friday

The day of month for schedule. Allowed values are: 1-31,-*/ (default value: *)

The day of week for schedule. Allowed values are: 1-7,SUN-SAT-*/ (default value: *)

Display this help and exit

The hour for schedule. Allowed values are: 0-23,-*/ (default value: *)

ID to identify the schedule. Required unless "--name" is specified

The minute for schedule. Allowed values are: 0-59,-*/ (default value: *)

The month for schedule. Allowed values are: 1-12,-*/ (default value: *)

Name to identify the schedule. Required unless "--id" is specified

Configure SNMP service

The textual identification of the contact person for this managed node, together with information on how to contact this person

A textual description of the entity

SNMP trap destination configuration. A 3-tuple including <IP>,<version>,<community>. For example: 172.31.12.216,V2C,public

Disable SNMP service. Required unless any of the following is specified: --enable, --view

Enable SNMP service. Required unless any of the following is specified: --disable, --view

Display this help and exit

The physical location of this node

SNMP manager configuration. A 3-tuple including <subnet>,<version (V1|V2C)>,<community>. For example: 172.31.0.0/16,V2C,public

An administratively-assigned name for this managed node

View SNMP configuration. Required unless any of the following is specified: --enable, --disable

Apply software version

Update all nodes, mutually exclusive with "--node-name". Required unless "--node-name" is specified

Display this help and exit

Node name, mutually exclusive with "--all". Required unless "--all" is specified

Bypass software update ordering and versioning validation

Version (Required)

List software versions

Print extra information for each element

Display this help and exit

Delete software update packages

Display this help and exit

Package name to delete (Required)

Cancel software update task

Display this help and exit

Task ID (Required)

Monitor update status

Print extra information for each element

Display this help and exit

The number of last-started software updates to list

Update task id

Upload a software package with UPD format

Display this help and exit

The path to the UPD software package (Required)

Configure syslog servers

Disable syslog event forwarding, clear syslog configuration. Required unless any of the following is specified: --enable, --view

Enable syslog event forwarding. Required unless any of the following is specified: --disable, --view

Display this help and exit

Syslog server configuration. A 3 or 4-tuple including <server>,<port>,<transport>,[<message types delimited by |>].
Server may be an IP address or a hostname (requires DNS).
Transport values may be tcp, udp, or relp.
Message types may be event and/or filesystem. When the relp transport is specified, only filesystem is allowed.
'event' causes system events to be forwarded to the remote syslog server.
'filesystem' causes filesystem access audit records to be forwarded.
When both are present, they are separated by a |.
The message type defaults to event|filesystem for udp and tcp, and filesystem for relp.
The entire --server param can be used multiple times.

View syslog configuration. Required unless any of the following is specified: --enable, --disable

Configure product configuration and metadata backups. Optionally create a backup now

Causes the command to be executed asynchronously. A reference task identifier will be returned

Display this help and exit

IP address of the backup volume

When running a task-based command synchronously, monitor for task completion indefinitely

Create an immediate system backup of configuration and metadata (--ip and --path parameters are required if specified). Required unless any of the following is specified: --schedule-remove, --schedule-name, --view

The NFS export path to the backup volume

Name for the periodic backup schedule. Required unless any of the following is specified: --now, --schedule-remove, --view

Remove the scheduled backup configuration. Required unless any of the following is specified: --now, --schedule-name, --view

View the system backup configuration. Required unless any of the following is specified: --now, --schedule-remove, --schedule-name

List the names of the product configuration and metadata backups in the backup volume

Display this help and exit

IP address of the backup volume (Required)

The NFS export path to the backup volume (Required)

Restore product configuration and metadata backup

Causes the command to be executed asynchronously. A reference task identifier will be returned

The name of the backup. If not specified, the most recent backup is restored

The UUID of the cluster that created the backup from which you would like to restore

Display this help and exit

IP address of the backup volume (Required)

When running a task-based command synchronously, monitor for task completion indefinitely

The NFS export path to the backup volume (Required)

Use this command to cleanly shut down all product nodes.

Confirm shutdown execution (Required)

Display this help and exit

Shutdown reason

Show an overview of the system

Display this help and exit

A timeout in seconds to use when executing the command

Attempt to cancel a task. If the task is HALTED, it will be restarted and the new task will be cancelled.

Display this help and exit

The task ID

List all running tasks in the system. The command can also be used to list completed tasks using the status filter, showing both successful and failed tasks. When no time-based filter is specified, tasks created over the past 31 days are returned.

List tasks that were created at or after (>=) the specified time, in the format [yyyy-MM-dd|dd-MMM-yyyy] [HH:mm:ss] Examples: "2025-06-21 02:42", "25-FEB-2025 19:25:30"

List tasks that were created before (<) the specified time, in the format [yyyy-MM-dd|dd-MMM-yyyy] [HH:mm:ss] Examples: "2025-06-21 02:42", "25-FEB-2025 19:25:30"

List tasks that ended at or after (>=) the specified time, in the format [yyyy-MM-dd|dd-MMM-yyyy] [HH:mm:ss] Examples: "2025-06-21 02:42", "25-FEB-2025 19:25:30"

List tasks that ended before (<) the specified time, in the format [yyyy-MM-dd|dd-MMM-yyyy] [HH:mm:ss] Examples: "2025-06-21 02:42", "25-FEB-2025 19:25:30"

Print extra information for each element

Display this help and exit

The task ID

The number of last-created tasks to list

The task name

List tasks that started at or after (>=) the specified time, in the format [yyyy-MM-dd|dd-MMM-yyyy] [HH:mm:ss] Examples: "2025-06-21 02:42", "25-FEB-2025 19:25:30"

List tasks that started before (<) the specified time, in the format [yyyy-MM-dd|dd-MMM-yyyy] [HH:mm:ss] Examples: "2025-06-21 02:42", "25-FEB-2025 19:25:30"

Filter by the status of the task. Possible values: NONE | QUEUED | VALIDATING | VALIDATED | VALIDATION_FAILED | EXECUTING | CANCELLING | HALTED | RECOVERING | RESUMED | FAILED | CANCELLED | COMPLETED.

Resume a task that is HALTED, or retry a task that is FAILED

Display this help and exit

The task ID