NAME¶

dsconf

SYNOPSIS¶

dsconf [-h] [-v] [-D BINDDN] [-w BINDPW] [-W] [-y PWDFILE] [-b BASEDN] [-Z] [-j] instance {backend,backup,chaining,config,directory_manager,monitor,plugin,pwpolicy,localpwp,replication,repl-agmt,repl-winsync-agmt,repl-tasks,sasl,security,schema,repl-conflict} ...

OPTIONS¶

instance: The name of the instance or its LDAP URL, such as ldap://server.example.com:389

Sub-commands¶

dsconf backend: Manage database suffixes and backends
dsconf backup: Manage online backups
dsconf chaining: Manage database chaining and database links
dsconf config: Manage the server configuration
dsconf directory_manager: Manage the Directory Manager account
dsconf monitor: Monitor the state of the instance
dsconf plugin: Manage plug-ins available on the server
dsconf pwpolicy: Manage the global password policy settings
dsconf localpwp: Manage the local user and subtree password policies
dsconf replication: Manage replication for a suffix
dsconf repl-agmt: Manage replication agreements
dsconf repl-winsync-agmt: Manage Winsync agreements
dsconf repl-tasks: Manage replication tasks
dsconf sasl: Manage SASL mappings
dsconf security: Manage security settings
dsconf schema: Manage the directory schema
dsconf repl-conflict: Manage replication conflicts

OPTIONS 'dsconf backend'¶

usage: dsconf instance backend [-h]
{suffix,index,vlv-index,attr-encrypt,config,monitor,import,export,create,delete,get-tree,compact-db}
...

Sub-commands¶

dsconf backend suffix: Manage backend suffixes
dsconf backend index: Manage backend indexes
dsconf backend vlv-index: Manage VLV searches and indexes
dsconf backend attr-encrypt: Manage encrypted attribute settings
dsconf backend config: Manage the global database configuration settings
dsconf backend monitor: Displays global database or suffix monitoring information
dsconf backend import: Online import of a suffix
dsconf backend export: Online export of a suffix
dsconf backend create: Create a backend database
dsconf backend delete: Delete a backend database
dsconf backend get-tree: Display the suffix tree
dsconf backend compact-db: Compact the database and the replication changelog

OPTIONS 'dsconf backend suffix'¶

usage: dsconf instance backend suffix [-h]
{list,get,get-dn,get-sub-suffixes,set}
...

Sub-commands¶

dsconf backend suffix list: List active backends and suffixes
dsconf backend suffix get: Display the suffix entry
dsconf backend suffix get-dn: Display the DN of a backend
dsconf backend suffix get-sub-suffixes: Display sub-suffixes
dsconf backend suffix set: Set configuration settings for a specific backend

OPTIONS 'dsconf backend suffix list'¶

usage: dsconf instance backend suffix list [-h] [--suffix]
[--skip-subsuffixes]

--suffix: Displays the suffixes without backend name
--skip-subsuffixes: Displays the list of suffixes without sub-suffixes

OPTIONS 'dsconf backend suffix get'¶

usage: dsconf instance backend suffix get [-h] [selector]

selector

The backend database name to search for

OPTIONS 'dsconf backend suffix get-dn'¶

usage: dsconf instance backend suffix get-dn [-h] [dn]

dn

The DN to the database entry in cn=ldbm database,cn=plugins,cn=config

OPTIONS 'dsconf backend suffix get-sub-suffixes'¶

usage: dsconf instance backend suffix get-sub-suffixes [-h] [--suffix] be_name

be_name: The backend name or suffix
--suffix: Displays the list of suffixes without backend name

OPTIONS 'dsconf backend suffix set'¶

usage: dsconf instance backend suffix set [-h] [--enable-readonly]
[--disable-readonly]
[--enable-orphan] [--disable-orphan]
[--require-index] [--ignore-index]
[--add-referral ADD_REFERRAL]
[--del-referral DEL_REFERRAL]
[--enable] [--disable]
[--cache-size CACHE_SIZE]
[--cache-memsize CACHE_MEMSIZE]
[--dncache-memsize DNCACHE_MEMSIZE]
[--state STATE]
be_name

be_name

The backend name or suffix

--enable-readonly

Enables read-only mode for the backend database

--disable-readonly

Disables read-only mode for the backend database

--enable-orphan

Disconnect a subsuffix from its parent suffix.

--disable-orphan

Let the subsuffix be connected to its parent suffix.

--require-index

Allows only indexed searches

--ignore-index

Allows all searches even if they are unindexed

--add-referral ADD_REFERRAL

Adds an LDAP referral to the backend

--del-referral DEL_REFERRAL

Removes an LDAP referral from the backend

--enable

Enables the backend database

--disable

Disables the backend database

--cache-size CACHE_SIZE

Sets the maximum number of entries to keep in the entry cache

--cache-memsize CACHE_MEMSIZE

Sets the maximum size in bytes that the entry cache can grow to

--dncache-memsize DNCACHE_MEMSIZE

Sets the maximum size in bytes that the DN cache can grow to

--state STATE

Changes the backend state to: "database", "disabled", "referral", or "referral on update"

OPTIONS 'dsconf backend index'¶

usage: dsconf instance backend index [-h]
{add,set,get,list,delete,reindex} ...

Sub-commands¶

dsconf backend index add: Add an index
dsconf backend index set: Update an index
dsconf backend index get: Display an index entry
dsconf backend index list: Display the index
dsconf backend index delete: Delete an index
dsconf backend index reindex: Re-index the database for a single index or all indexes

OPTIONS 'dsconf backend index add'¶

usage: dsconf instance backend index add [-h] --index-type INDEX_TYPE
[--matching-rule MATCHING_RULE]
[--reindex] --attr ATTR
be_name

be_name: The backend name or suffix
--index-type INDEX_TYPE: Sets the indexing type (eq, sub, pres, or approx)
--matching-rule MATCHING_RULE: Sets the matching rule for the index
--reindex: Re-indexes the database after adding a new index
--attr ATTR: Sets the attribute name to index

OPTIONS 'dsconf backend index set'¶

usage: dsconf instance backend index set [-h] --attr ATTR
[--add-type ADD_TYPE]
[--del-type DEL_TYPE]
[--add-mr ADD_MR] [--del-mr DEL_MR]
[--reindex]
be_name

be_name: The backend name or suffix
--attr ATTR: Sets the indexed attribute to update
--add-type ADD_TYPE: Adds an index type to the index (eq, sub, pres, or approx)
--del-type DEL_TYPE: Removes an index type from the index: (eq, sub, pres, or approx)
--add-mr ADD_MR: Adds a matching-rule to the index
--del-mr DEL_MR: Removes a matching-rule from the index
--reindex: Re-indexes the database after editing the index

OPTIONS 'dsconf backend index get'¶

usage: dsconf instance backend index get [-h] --attr ATTR be_name

be_name: The backend name or suffix
--attr ATTR: Sets the index name to display

OPTIONS 'dsconf backend index list'¶

usage: dsconf instance backend index list [-h] [--just-names] be_name

be_name: The backend name or suffix
--just-names: Displays only the names of indexed attributes

OPTIONS 'dsconf backend index delete'¶

usage: dsconf instance backend index delete [-h] [--attr ATTR] be_name

be_name: The backend name or suffix
--attr ATTR: Sets the name of the attribute to delete from the index

OPTIONS 'dsconf backend index reindex'¶

usage: dsconf instance backend index reindex [-h] [--attr ATTR] [--wait]
be_name

be_name

The backend name or suffix

--attr ATTR

Sets the name of the attribute to re-index. Omit this argument to re-index all attributes

--wait

Waits for the index task to complete and reports the status

OPTIONS 'dsconf backend vlv-index'¶

usage: dsconf instance backend vlv-index [-h]
{list,get,add-search,edit-search,del-search,add-index,del-index,reindex}
...

Sub-commands¶

dsconf backend vlv-index list: List VLV search and index entries
dsconf backend vlv-index get: Display a VLV search and indexes
dsconf backend vlv-index add-search: Add a VLV search entry. The search entry is the parent entry of the VLV index entries, and it specifies the search parameters that are used to match entries for those indexes.
dsconf backend vlv-index edit-search: Update a VLV search and index
dsconf backend vlv-index del-search: Delete VLV search & index
dsconf backend vlv-index add-index: Create a VLV index under a VLV search entry (parent entry). The VLV index specifies the attributes to sort
dsconf backend vlv-index del-index: Delete a VLV index under a VLV search entry (parent entry)
dsconf backend vlv-index reindex: Index/re-index the VLV database index

OPTIONS 'dsconf backend vlv-index list'¶

usage: dsconf instance backend vlv-index list [-h] [--just-names] be_name

be_name: The backend name of the VLV index
--just-names: Displays only the names of VLV search entries

OPTIONS 'dsconf backend vlv-index get'¶

usage: dsconf instance backend vlv-index get [-h] [--name NAME] be_name

be_name: The backend name of the VLV index
--name NAME: Displays the VLV search entry and its index entries

OPTIONS 'dsconf backend vlv-index add-search'¶

usage: dsconf instance backend vlv-index add-search [-h] --name NAME
--search-base SEARCH_BASE
--search-scope
SEARCH_SCOPE
--search-filter
SEARCH_FILTER
be_name

be_name: The backend name of the VLV index
--name NAME: Sets the name of the VLV search entry
--search-base SEARCH_BASE: Sets the VLV search base
--search-scope SEARCH_SCOPE: Sets the VLV search scope: 0 (base search), 1 (one-level search), or 2 (subtree search)
--search-filter SEARCH_FILTER: Sets the VLV search filter

OPTIONS 'dsconf backend vlv-index edit-search'¶

usage: dsconf instance backend vlv-index edit-search [-h] --name NAME
[--search-base SEARCH_BASE]
[--search-scope SEARCH_SCOPE]
[--search-filter SEARCH_FILTER]
[--reindex]
be_name

be_name: The backend name of the VLV index to update
--name NAME: Sets the name of the VLV index
--search-base SEARCH_BASE: Sets the VLV search base
--search-scope SEARCH_SCOPE: Sets the VLV search scope: 0 (base search), 1 (one-level search), or 2 (subtree search)
--search-filter SEARCH_FILTER: Sets the VLV search filter
--reindex: Re-indexes all VLV database indexes

OPTIONS 'dsconf backend vlv-index del-search'¶

usage: dsconf instance backend vlv-index del-search [-h] --name NAME be_name

be_name: The backend name of the VLV index
--name NAME: Sets the name of the VLV search index

OPTIONS 'dsconf backend vlv-index add-index'¶

usage: dsconf instance backend vlv-index add-index [-h] --parent-name
PARENT_NAME --index-name
INDEX_NAME --sort SORT
[--index-it]
be_name

be_name: The backend name of the VLV index
--parent-name PARENT_NAME: Sets the name or "cn" attribute of the parent VLV search entry
--index-name INDEX_NAME: Sets the name of the new VLV index
--sort SORT: Sets a space-separated list of attributes to sort for this VLV index
--index-it: Creates the database index for this VLV index definition

OPTIONS 'dsconf backend vlv-index del-index'¶

usage: dsconf instance backend vlv-index del-index [-h] --parent-name
PARENT_NAME
[--index-name INDEX_NAME]
[--sort SORT]
be_name

be_name: The backend name of the VLV index
--parent-name PARENT_NAME: Sets the name or "cn" attribute value of the parent VLV search entry
--index-name INDEX_NAME: Sets the name of the VLV index to delete
--sort SORT: Delete a VLV index that has this vlvsort value

OPTIONS 'dsconf backend vlv-index reindex'¶

usage: dsconf instance backend vlv-index reindex [-h]
[--index-name INDEX_NAME]
--parent-name PARENT_NAME
be_name

be_name

The backend name of the VLV index

--index-name INDEX_NAME

Sets the name of the VLV index entry to re-index. If not set, all indexes are re-indexed

--parent-name PARENT_NAME

Sets the name or "cn" attribute value of the parent VLV search entry

OPTIONS 'dsconf backend attr-encrypt'¶

usage: dsconf instance backend attr-encrypt [-h] [--list] [--just-names]
[--add-attr ADD_ATTR]
[--del-attr DEL_ATTR]
be_name

be_name: The backend name or suffix
--list: Lists all encrypted attributes in the backend
--just-names: List only the names of the encrypted attributes when used with --list
--add-attr ADD_ATTR: Enables encryption for the specified attribute
--del-attr DEL_ATTR: Disables encryption for the specified attribute

OPTIONS 'dsconf backend config'¶

usage: dsconf instance backend config [-h] {get,set} ...

Sub-commands¶

dsconf backend config get: Display the global database configuration
dsconf backend config set: Set the global database configuration

OPTIONS 'dsconf backend config get'¶

usage: dsconf instance backend config get [-h]

OPTIONS 'dsconf backend config set'¶

usage: dsconf instance backend config set [-h]
[--lookthroughlimit LOOKTHROUGHLIMIT]
[--mode MODE]
[--idlistscanlimit IDLISTSCANLIMIT]
[--directory DIRECTORY]
[--dbcachesize DBCACHESIZE]
[--logdirectory LOGDIRECTORY]
[--durable-txn DURABLE_TXN]
[--txn-wait TXN_WAIT]
[--checkpoint-interval CHECKPOINT_INTERVAL]
[--compactdb-interval COMPACTDB_INTERVAL]
[--compactdb-time COMPACTDB_TIME]
[--txn-batch-val TXN_BATCH_VAL]
[--txn-batch-min TXN_BATCH_MIN]
[--txn-batch-max TXN_BATCH_MAX]
[--logbufsize LOGBUFSIZE]
[--locks LOCKS]
[--locks-monitoring-enabled LOCKS_MONITORING_ENABLED]
[--locks-monitoring-threshold LOCKS_MONITORING_THRESHOLD]
[--locks-monitoring-pause LOCKS_MONITORING_PAUSE]
[--import-cache-autosize IMPORT_CACHE_AUTOSIZE]
[--cache-autosize CACHE_AUTOSIZE]
[--cache-autosize-split CACHE_AUTOSIZE_SPLIT]
[--import-cachesize IMPORT_CACHESIZE]
[--exclude-from-export EXCLUDE_FROM_EXPORT]
[--pagedlookthroughlimit PAGEDLOOKTHROUGHLIMIT]
[--pagedidlistscanlimit PAGEDIDLISTSCANLIMIT]
[--rangelookthroughlimit RANGELOOKTHROUGHLIMIT]
[--backend-opt-level BACKEND_OPT_LEVEL]
[--deadlock-policy DEADLOCK_POLICY]
[--db-home-directory DB_HOME_DIRECTORY]
[--db_lib DB_LIB]

--lookthroughlimit LOOKTHROUGHLIMIT

Specifies the maximum number of entries that the server will check when examining candidate entries in response to a search request

--mode MODE

Specifies the permissions used for newly created index files

--idlistscanlimit IDLISTSCANLIMIT

Specifies the number of entry IDs that are searched during a search operation

--directory DIRECTORY

Specifies absolute path to database instance

--dbcachesize DBCACHESIZE

Specifies the database index cache size in bytes

--logdirectory LOGDIRECTORY

Specifies the path to the directory that contains the database transaction logs

--durable-txn DURABLE_TXN

Enables or disables whether database transaction log entries are immediately written to the disk

--txn-wait TXN_WAIT

Sets whether the server should should wait if there are no db locks available

--checkpoint-interval CHECKPOINT_INTERVAL

Sets the amount of time in seconds after which the server sends a checkpoint entry to the database transaction log

--compactdb-interval COMPACTDB_INTERVAL

Sets the interval in seconds when the database is compacted

--compactdb-time COMPACTDB_TIME

Sets the time (HH:MM format) of day when to compact the database after the "compactdb interval" has been reached

--txn-batch-val TXN_BATCH_VAL

Specifies how many transactions will be batched before being committed

--txn-batch-min TXN_BATCH_MIN

Controls when transactions should be flushed earliest, independently of the batch count. Requires that txn-batch-val is set

--txn-batch-max TXN_BATCH_MAX

Controls when transactions should be flushed latest, independently of the batch count. Requires that txn-batch-val is set)

--logbufsize LOGBUFSIZE

Specifies the transaction log information buffer size

--locks LOCKS

Sets the maximum number of database locks

--locks-monitoring-enabled LOCKS_MONITORING_ENABLED

Enables or disables monitoring of DB locks when the value crosses the percentage set with "--locks-monitoring-threshold"

--locks-monitoring-threshold LOCKS_MONITORING_THRESHOLD

Sets the DB lock exhaustion threshold in percentage (valid range is 70-90). When the threshold is reached, all searches are aborted until the number of active locks decreases below the configured threshold and/or the administrator increases the number of database locks (nsslapd-db-locks). This threshold is a safeguard against DB corruption which might be caused by locks exhaustion.

--locks-monitoring-pause LOCKS_MONITORING_PAUSE

Sets the DB lock monitoring value in milliseconds for the amount of time that the monitoring thread spends waiting between checks.

--import-cache-autosize IMPORT_CACHE_AUTOSIZE

Enables or disables to automatically set the size of the import cache to be used during the import process of LDIF files

--cache-autosize CACHE_AUTOSIZE

Sets the percentage of free memory that is used in total for the database and entry cache. "0" disables this feature.

--cache-autosize-split CACHE_AUTOSIZE_SPLIT

Sets the percentage of RAM that is used for the database cache. The remaining percentage is used for the entry cache

--import-cachesize IMPORT_CACHESIZE

Sets the size in bytes of the database cache used in the import process.

--exclude-from-export EXCLUDE_FROM_EXPORT

List of attributes to not include during database export operations

--pagedlookthroughlimit PAGEDLOOKTHROUGHLIMIT

Specifies the maximum number of entries that the server will check when examining candidate entries for a search which uses the simple paged results control

--pagedidlistscanlimit PAGEDIDLISTSCANLIMIT

Specifies the number of entry IDs that are searched, specifically, for a search operation using the simple paged results control.

--rangelookthroughlimit RANGELOOKTHROUGHLIMIT

Specifies the maximum number of entries that the server will check when examining candidate entries in response to a range search request.

--backend-opt-level BACKEND_OPT_LEVEL

Sets the backend optimization level for write performance (0, 1, 2, or 4). WARNING: This parameter can trigger experimental code.

--deadlock-policy DEADLOCK_POLICY

Adjusts the backend database deadlock policy (Advanced setting)

--db-home-directory DB_HOME_DIRECTORY

Sets the directory for the database mmapped files (Advanced setting)

--db_lib DB_LIB

Sets which db lib is used. Valid values are: bdb or mdb

OPTIONS 'dsconf backend monitor'¶

usage: dsconf instance backend monitor [-h] [--suffix SUFFIX]

--suffix SUFFIX: Displays monitoring information only for the specified suffix

OPTIONS 'dsconf backend import'¶

usage: dsconf instance backend import [-h] [-c CHUNKS_SIZE] [-E]
[-g GEN_UNIQ_ID] [-O]
[-s INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...]]
[-x EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...]]
[--timeout TIMEOUT]
[be_name] [ldifs [ldifs ...]]

be_name: The backend name or the root suffix
ldifs: Specifies the filename of the input LDIF files. Multiple files are imported in the specified order.
-c CHUNKS_SIZE, --chunks-size CHUNKS_SIZE: The number of chunks to have during the import operation
-E, --encrypted: Encrypt attributes configured in the database for encryption
-g GEN_UNIQ_ID, --gen-uniq-id GEN_UNIQ_ID: Generate a unique id. Set "none" for no unique ID to be generated and "deterministic" for the generated unique ID to be name-based. By default, a time-based unique ID is generated. When using the deterministic generation to have a name-based unique ID, it is also possible to specify the namespace for the server to use. namespaceId is a string of characters in the format 00-xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx.
-O, --only-core: Creates only the core database attribute indexes
-s INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...], --include-suffixes INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...]: Specifies the suffixes or the subtrees to be included
-x EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...], --exclude-suffixes EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...]: Specifies the suffixes to be excluded
--timeout TIMEOUT: Set a timeout to wait for the export task. Default is 0 (no timeout)

OPTIONS 'dsconf backend export'¶

usage: dsconf instance backend export [-h] [-l LDIF] [-C] [-E] [-m] [-N] [-r]
[-u] [-U]
[-s INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...]]
[-x EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...]]
[--timeout TIMEOUT]
be_names [be_names ...]

be_names: The backend names or the root suffixes
-l LDIF, --ldif LDIF: Sets the filename of the output LDIF file. Separate multiple file names with spaces.
-C, --use-id2entry: Uses only the main database file
-E, --encrypted: Decrypts encrypted data during export. This option is used only if database encryption is enabled.
-m, --min-base64: Sets minimal base-64 encoding
-N, --no-seq-num: Suppresses printing the sequence numbers
-r, --replication: Exports the data with information required to initialize a replica
-u, --no-dump-uniq-id: Omits exporting the unique ID
-U, --not-folded: Disables folding the output
-s INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...], --include-suffixes INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...]: Specifies the suffixes or the subtrees to be included
-x EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...], --exclude-suffixes EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...]: Specifies the suffixes to be excluded
--timeout TIMEOUT: Set a timeout to wait for the export task. Default is 0 (no timeout)

OPTIONS 'dsconf backend create'¶

usage: dsconf instance backend create [-h] [--parent-suffix PARENT_SUFFIX]
--suffix SUFFIX --be-name BE_NAME
[--create-entries] [--create-suffix]

--parent-suffix PARENT_SUFFIX: Sets the parent suffix only if this backend is a sub-suffix
--suffix SUFFIX: Sets the database suffix DN
--be-name BE_NAME: Sets the database backend name"
--create-entries: Adds sample entries to the database
--create-suffix: Creates the suffix object entry in the database. Only suffixes using the 'dc',

OPTIONS 'dsconf backend delete'¶

usage: dsconf instance backend delete [-h] be_name

be_name

The backend name or suffix

OPTIONS 'dsconf backend get-tree'¶

usage: dsconf instance backend get-tree [-h]

OPTIONS 'dsconf backend compact-db'¶

usage: dsconf instance backend compact-db [-h] [--only-changelog]
[--timeout TIMEOUT]

--only-changelog

Compacts only the replication change log

--timeout TIMEOUT

Set a timeout to wait for the compaction task. Default is 0 (no timeout)

OPTIONS 'dsconf backup'¶

usage: dsconf instance backup [-h] {create,restore} ...

Sub-commands¶

dsconf backup create: Creates a backup of the database
dsconf backup restore: Restores a database from a backup

OPTIONS 'dsconf backup create'¶

usage: dsconf instance backup create [-h] [-t DB_TYPE] [--timeout TIMEOUT]
[archive]

archive: Sets the directory where to store the backup files. Format: instance_name- year_month_date_hour_minutes_seconds. Default: /var/lib/dirsrv/slapd- instance/bak/
-t DB_TYPE, --db-type DB_TYPE: Sets the database type. Default: ldbm database
--timeout TIMEOUT: Sets the task timeout. Default is 120 seconds,

OPTIONS 'dsconf backup restore'¶

usage: dsconf instance backup restore [-h] [-t DB_TYPE] [--timeout TIMEOUT]
archive

archive

Set the directory that contains the backup files

-t DB_TYPE, --db-type DB_TYPE

Sets the database type. Default: ldbm database

--timeout TIMEOUT

Sets the task timeout. Default is 120 seconds.

OPTIONS 'dsconf chaining'¶

usage: dsconf instance chaining [-h]
{config-get,config-set,config-get-def,config-set-def,link-create,link-get,link-set,link-delete,monitor,link-list}
...

Sub-commands¶

dsconf chaining config-get: Display the chaining controls and server component lists
dsconf chaining config-set: Set the chaining controls and server component lists
dsconf chaining config-get-def: Display the default creation parameters for new database links
dsconf chaining config-set-def: Set the default creation parameters for new database links
dsconf chaining link-create: Create a database link to a remote server
dsconf chaining link-get: Displays chaining database links
dsconf chaining link-set: Edit a database link to a remote server
dsconf chaining link-delete: Delete a database link
dsconf chaining monitor: Display monitor information for a database chaining link
dsconf chaining link-list: List database links

OPTIONS 'dsconf chaining config-get'¶

usage: dsconf instance chaining config-get [-h] [--avail-controls]
[--avail-comps]

--avail-controls: Lists available chaining controls
--avail-comps: Lists available chaining plugin components

OPTIONS 'dsconf chaining config-set'¶

usage: dsconf instance chaining config-set [-h] [--add-control ADD_CONTROL]
[--del-control DEL_CONTROL]
[--add-comp ADD_COMP]
[--del-comp DEL_COMP]

--add-control ADD_CONTROL: Adds a transmitted control OID
--del-control DEL_CONTROL: Deletes a transmitted control OID
--add-comp ADD_COMP: Adds a chaining component
--del-comp DEL_COMP: Deletes a chaining component

OPTIONS 'dsconf chaining config-get-def'¶

usage: dsconf instance chaining config-get-def [-h]

OPTIONS 'dsconf chaining config-set-def'¶

usage: dsconf instance chaining config-set-def [-h]
[--conn-bind-limit CONN_BIND_LIMIT]
[--conn-op-limit CONN_OP_LIMIT]
[--abandon-check-interval ABANDON_CHECK_INTERVAL]
[--bind-limit BIND_LIMIT]
[--op-limit OP_LIMIT]
[--proxied-auth PROXIED_AUTH]
[--conn-lifetime CONN_LIFETIME]
[--bind-timeout BIND_TIMEOUT]
[--return-ref RETURN_REF]
[--check-aci CHECK_ACI]
[--bind-attempts BIND_ATTEMPTS]
[--size-limit SIZE_LIMIT]
[--time-limit TIME_LIMIT]
[--hop-limit HOP_LIMIT]
[--response-delay RESPONSE_DELAY]
[--test-response-delay TEST_RESPONSE_DELAY]
[--use-starttls USE_STARTTLS]

--conn-bind-limit CONN_BIND_LIMIT: Sets the maximum number of BIND connections the database link establishes with the remote server
--conn-op-limit CONN_OP_LIMIT: Sets the maximum number of LDAP connections the database link establishes with the remote server
--abandon-check-interval ABANDON_CHECK_INTERVAL: Sets the number of seconds that pass before the server checks for abandoned operations
--bind-limit BIND_LIMIT: Sets the maximum number of concurrent bind operations per TCP connection
--op-limit OP_LIMIT: Sets the maximum number of concurrent operations allowed
--proxied-auth PROXIED_AUTH: Enables or disables proxied authorization. If set to "off", the server executes bind for chained operations as the user set in the nsMultiplexorBindDn attribute.
--conn-lifetime CONN_LIFETIME: Specifies connection lifetime in seconds. "0" keeps the connection open forever.
--bind-timeout BIND_TIMEOUT: Sets the amount of time in seconds before a bind attempt times out
--return-ref RETURN_REF: Enables or disables whether referrals are returned by scoped searches
--check-aci CHECK_ACI: Enables or disables whether the server evaluates ACIs on the database link as well as the remote data server
--bind-attempts BIND_ATTEMPTS: Sets the number of times the server tries to bind to the remote server
--size-limit SIZE_LIMIT: Sets the maximum number of entries to return from a search operation
--time-limit TIME_LIMIT: Sets the maximum number of seconds allowed for an operation
--hop-limit HOP_LIMIT: Sets the maximum number of times a database is allowed to chain. That is the number of times a request can be forwarded from one database link to another.
--response-delay RESPONSE_DELAY: Sets the maximum amount of time it can take a remote server to respond to an LDAP operation request made by a database link before an error is suspected
--test-response-delay TEST_RESPONSE_DELAY: Sets the duration of the test issued by the database link to check whether the remote server is responding
--use-starttls USE_STARTTLS: Configured that database links use StartTLS if set to "on"

CHAIN_NAME: The name of the database link
--conn-bind-limit CONN_BIND_LIMIT: Sets the maximum number of BIND connections the database link establishes with the remote server
--conn-op-limit CONN_OP_LIMIT: Sets the maximum number of LDAP connections the database link establishes with the remote server
--abandon-check-interval ABANDON_CHECK_INTERVAL: Sets the number of seconds that pass before the server checks for abandoned operations
--bind-limit BIND_LIMIT: Sets the maximum number of concurrent bind operations per TCP connection
--op-limit OP_LIMIT: Sets the maximum number of concurrent operations allowed
--proxied-auth PROXIED_AUTH: Enables or disables proxied authorization. If set to "off", the server executes bind for chained operations as the user set in the nsMultiplexorBindDn attribute.
--conn-lifetime CONN_LIFETIME: Specifies connection lifetime in seconds. "0" keeps the connection open forever.
--bind-timeout BIND_TIMEOUT: Sets the amount of time in seconds before a bind attempt times out
--return-ref RETURN_REF: Enables or disables whether referrals are returned by scoped searches
--check-aci CHECK_ACI: Enables or disables whether the server evaluates ACIs on the database link as well as the remote data server
--bind-attempts BIND_ATTEMPTS: Sets the number of times the server tries to bind to the remote server
--size-limit SIZE_LIMIT: Sets the maximum number of entries to return from a search operation
--time-limit TIME_LIMIT: Sets the maximum number of seconds allowed for an operation
--hop-limit HOP_LIMIT: Sets the maximum number of times a database is allowed to chain. That is the number of times a request can be forwarded from one database link to another.
--response-delay RESPONSE_DELAY: Sets the maximum amount of time it can take a remote server to respond to an LDAP operation request made by a database link before an error is suspected
--test-response-delay TEST_RESPONSE_DELAY: Sets the duration of the test issued by the database link to check whether the remote server is responding
--use-starttls USE_STARTTLS: Configured that database links use StartTLS if set to "on"
--suffix SUFFIX: Sets the suffix managed by the database link
--server-url SERVER_URL: Sets the LDAP/LDAPS URL to the remote server
--bind-mech BIND_MECH: Sets the authentication method to use to authenticate to the remote server. Valid values: "SIMPLE" (default), "EXTERNAL", "DIGEST-MD5", or "GSSAPI"
--bind-dn BIND_DN: Sets the DN of the administrative entry used to communicate with the remote server
--bind-pw BIND_PW: Sets the password of the administrative user
--bind-pw-file BIND_PW_FILE: File containing the password
--bind-pw-prompt: Prompt for password

OPTIONS 'dsconf chaining link-get'¶

usage: dsconf instance chaining link-get [-h] CHAIN_NAME

CHAIN_NAME

The chaining link name or suffix to retrieve

CHAIN_NAME: The name of the database link
--conn-bind-limit CONN_BIND_LIMIT: Sets the maximum number of BIND connections the database link establishes with the remote server
--conn-op-limit CONN_OP_LIMIT: Sets the maximum number of LDAP connections the database link establishes with the remote server
--abandon-check-interval ABANDON_CHECK_INTERVAL: Sets the number of seconds that pass before the server checks for abandoned operations
--bind-limit BIND_LIMIT: Sets the maximum number of concurrent bind operations per TCP connection
--op-limit OP_LIMIT: Sets the maximum number of concurrent operations allowed
--proxied-auth PROXIED_AUTH: Enables or disables proxied authorization. If set to "off", the server executes bind for chained operations as the user set in the nsMultiplexorBindDn attribute.
--conn-lifetime CONN_LIFETIME: Specifies connection lifetime in seconds. "0" keeps the connection open forever.
--bind-timeout BIND_TIMEOUT: Sets the amount of time in seconds before a bind attempt times out
--return-ref RETURN_REF: Enables or disables whether referrals are returned by scoped searches
--check-aci CHECK_ACI: Enables or disables whether the server evaluates ACIs on the database link as well as the remote data server
--bind-attempts BIND_ATTEMPTS: Sets the number of times the server tries to bind to the remote server
--size-limit SIZE_LIMIT: Sets the maximum number of entries to return from a search operation
--time-limit TIME_LIMIT: Sets the maximum number of seconds allowed for an operation
--hop-limit HOP_LIMIT: Sets the maximum number of times a database is allowed to chain. That is the number of times a request can be forwarded from one database link to another.
--response-delay RESPONSE_DELAY: Sets the maximum amount of time it can take a remote server to respond to an LDAP operation request made by a database link before an error is suspected
--test-response-delay TEST_RESPONSE_DELAY: Sets the duration of the test issued by the database link to check whether the remote server is responding
--use-starttls USE_STARTTLS: Configured that database links use StartTLS if set to "on"
--suffix SUFFIX: Sets the suffix managed by the database link
--server-url SERVER_URL: Sets the LDAP/LDAPS URL to the remote server
--bind-mech BIND_MECH: Sets the authentication method to use to authenticate to the remote server: Valid values: "SIMPLE" (default), "EXTERNAL", "DIGEST-MD5", or "GSSAPI"
--bind-dn BIND_DN: Sets the DN of the administrative entry used to communicate with the remote server
--bind-pw BIND_PW: Sets the password of the administrative user
--bind-pw-file BIND_PW_FILE: File containing the password
--bind-pw-prompt: Prompt for password

OPTIONS 'dsconf chaining link-delete'¶

usage: dsconf instance chaining link-delete [-h] CHAIN_NAME

CHAIN_NAME

The name of the database link

OPTIONS 'dsconf chaining monitor'¶

usage: dsconf instance chaining monitor [-h] CHAIN_NAME

CHAIN_NAME

The name of the database link

OPTIONS 'dsconf chaining link-list'¶

usage: dsconf instance chaining link-list [-h]

OPTIONS 'dsconf config'¶

usage: dsconf instance config [-h] {get,add,replace,delete} ...

Sub-commands¶

dsconf config get: get
dsconf config add: Add attribute value to configuration
dsconf config replace: Replace attribute value in configuration
dsconf config delete: Delete attribute value in configuration

OPTIONS 'dsconf config get'¶

usage: dsconf instance config get [-h] [attrs [attrs ...]]

attrs

Configuration attribute(s) to get

OPTIONS 'dsconf config add'¶

usage: dsconf instance config add [-h] [attr [attr ...]]

attr

Configuration attribute to add

OPTIONS 'dsconf config replace'¶

usage: dsconf instance config replace [-h] [attr [attr ...]]

attr

Configuration attribute to replace

OPTIONS 'dsconf config delete'¶

usage: dsconf instance config delete [-h] [attr [attr ...]]

attr

Configuration attribute to delete

OPTIONS 'dsconf directory_manager'¶

usage: dsconf instance directory_manager [-h] {password_change} ...

Sub-commands¶

dsconf directory_manager password_change: Changes the password of the Directory Manager account

OPTIONS 'dsconf directory_manager password_change'¶

usage: dsconf instance directory_manager password_change [-h]

OPTIONS 'dsconf monitor'¶

usage: dsconf instance monitor [-h]
{server,dbmon,ldbm,backend,snmp,chaining,disk}
...

Sub-commands¶

dsconf monitor server: Displays the server statistics, connections, and operations
dsconf monitor dbmon: Monitor all database statistics in a single report
dsconf monitor ldbm: Monitor the LDBM statistics, such as dbcache
dsconf monitor backend: Monitor the behavior of a backend database
dsconf monitor snmp: Displays the SNMP statistics
dsconf monitor chaining: Monitor database chaining statistics
dsconf monitor disk: Displays the disk space statistics. All values are in bytes.

OPTIONS 'dsconf monitor server'¶

usage: dsconf instance monitor server [-h]

OPTIONS 'dsconf monitor dbmon'¶

usage: dsconf instance monitor dbmon [-h] [-b BACKENDS] [-x]

-b BACKENDS, --backends BACKENDS: Specifies a list of space-separated backends to monitor. Default is all backends.
-x, --indexes: Shows index stats for each backend

OPTIONS 'dsconf monitor ldbm'¶

usage: dsconf instance monitor ldbm [-h]

OPTIONS 'dsconf monitor backend'¶

usage: dsconf instance monitor backend [-h] [backend]

backend

The optional name of the backend to monitor

OPTIONS 'dsconf monitor snmp'¶

usage: dsconf instance monitor snmp [-h]

OPTIONS 'dsconf monitor chaining'¶

usage: dsconf instance monitor chaining [-h] [backend]

backend

The optional name of the chaining backend to monitor

OPTIONS 'dsconf monitor disk'¶

usage: dsconf instance monitor disk [-h]

OPTIONS 'dsconf plugin'¶

usage: dsconf instance plugin [-h]
{memberof,automember,referential-integrity,root-dn,usn,account-policy,attr-uniq,dna,ldap-pass-through-auth,linked-attr,managed-entries,pam-pass-through-auth,retro-changelog,posix-winsync,entryuuid,list,show,set}
...

Sub-commands¶

dsconf plugin memberof: Manage and configure MemberOf plugin
dsconf plugin automember: Manage and configure Automembership plugin
dsconf plugin referential-integrity: Manage and configure Referential Integrity Postoperation plugin
dsconf plugin root-dn: Manage and configure RootDN Access Control plugin
dsconf plugin usn: Manage and configure USN plugin
dsconf plugin account-policy: Manage and configure Account Policy plugin
dsconf plugin attr-uniq: Manage and configure Attribute Uniqueness plugin
dsconf plugin dna: Manage and configure DNA plugin
dsconf plugin ldap-pass-through-auth: Manage and configure LDAP Pass-Through Authentication Plugin
dsconf plugin linked-attr: Manage and configure Linked Attributes plugin
dsconf plugin managed-entries: Manage and configure Managed Entries Plugin
dsconf plugin pam-pass-through-auth: Manage and configure Pass-Through Authentication plugins (LDAP URLs and PAM)
dsconf plugin retro-changelog: Manage and configure Retro Changelog plugin
dsconf plugin posix-winsync: Manage and configure the Posix Winsync API plugin
dsconf plugin entryuuid: Manage and configure EntryUUID plugin
dsconf plugin list: List current configured (enabled and disabled) plugins
dsconf plugin show: Show the plugin data
dsconf plugin set: Edit the plugin settings

OPTIONS 'dsconf plugin memberof'¶

usage: dsconf instance plugin memberof [-h]
{show,enable,disable,status,set,config-entry,fixup,fixup-status}
...

Sub-commands¶

dsconf plugin memberof show: Displays the plugin configuration
dsconf plugin memberof enable: Enables the plugin
dsconf plugin memberof disable: Disables the plugin
dsconf plugin memberof status: Displays the plugin status
dsconf plugin memberof set: Edit the plugin settings
dsconf plugin memberof config-entry: Manage the config entry
dsconf plugin memberof fixup: Run the fix-up task for memberOf plugin
dsconf plugin memberof fixup-status: Check the status of a fix-up task

OPTIONS 'dsconf plugin memberof show'¶

usage: dsconf instance plugin memberof show [-h]

OPTIONS 'dsconf plugin memberof enable'¶

usage: dsconf instance plugin memberof enable [-h]

OPTIONS 'dsconf plugin memberof disable'¶

usage: dsconf instance plugin memberof disable [-h]

OPTIONS 'dsconf plugin memberof status'¶

usage: dsconf instance plugin memberof status [-h]

OPTIONS 'dsconf plugin memberof set'¶

usage: dsconf instance plugin memberof set [-h] [--attr ATTR]
[--groupattr GROUPATTR [GROUPATTR ...]]
[--allbackends {on,off}]
[--skipnested {on,off}]
[--scope SCOPE [SCOPE ...]]
[--exclude EXCLUDE [EXCLUDE ...]]
[--autoaddoc AUTOADDOC]
[--config-entry CONFIG_ENTRY]

--attr ATTR: Specifies the attribute in the user entry for the Directory Server to manage to reflect group membership (memberOfAttr)
--groupattr GROUPATTR [GROUPATTR ...]: Specifies the attribute in the group entry to use to identify the DNs of group members (memberOfGroupAttr)
--allbackends {on,off}: Specifies whether to search the local suffix for user entries on all available suffixes (memberOfAllBackends)
--skipnested {on,off}: Specifies whether to skip nested groups or not (memberOfSkipNested)
--scope SCOPE [SCOPE ...]: Specifies backends or multiple-nested suffixes for the MemberOf plug-in to work on (memberOfEntryScope)
--exclude EXCLUDE [EXCLUDE ...]: Specifies backends or multiple-nested suffixes for the MemberOf plug-in to exclude (memberOfEntryScopeExcludeSubtree)
--autoaddoc AUTOADDOC: If an entry does not have an object class that allows the memberOf attribute then the memberOf plugin will automatically add the object class listed in the memberOfAutoAddOC parameter
--config-entry CONFIG_ENTRY: The value to set as nsslapd-pluginConfigArea

OPTIONS 'dsconf plugin memberof config-entry'¶

usage: dsconf instance plugin memberof config-entry [-h]
{add,set,show,delete} ...

Sub-commands¶

dsconf plugin memberof config-entry add: Add the config entry
dsconf plugin memberof config-entry set: Edit the config entry
dsconf plugin memberof config-entry show: Display the config entry
dsconf plugin memberof config-entry delete: Delete the config entry

OPTIONS 'dsconf plugin memberof config-entry add'¶

usage: dsconf instance plugin memberof config-entry add [-h] [--attr ATTR]
[--groupattr GROUPATTR [GROUPATTR ...]]
[--allbackends {on,off}]
[--skipnested {on,off}]
[--scope SCOPE [SCOPE ...]]
[--exclude EXCLUDE [EXCLUDE ...]]
[--autoaddoc AUTOADDOC]
DN

DN: The config entry full DN
--attr ATTR: Specifies the attribute in the user entry for the Directory Server to manage to reflect group membership (memberOfAttr)
--groupattr GROUPATTR [GROUPATTR ...]: Specifies the attribute in the group entry to use to identify the DNs of group members (memberOfGroupAttr)
--allbackends {on,off}: Specifies whether to search the local suffix for user entries on all available suffixes (memberOfAllBackends)
--skipnested {on,off}: Specifies whether to skip nested groups or not (memberOfSkipNested)
--scope SCOPE [SCOPE ...]: Specifies backends or multiple-nested suffixes for the MemberOf plug-in to work on (memberOfEntryScope)
--exclude EXCLUDE [EXCLUDE ...]: Specifies backends or multiple-nested suffixes for the MemberOf plug-in to exclude (memberOfEntryScopeExcludeSubtree)
--autoaddoc AUTOADDOC: If an entry does not have an object class that allows the memberOf attribute then the memberOf plugin will automatically add the object class listed in the memberOfAutoAddOC parameter

OPTIONS 'dsconf plugin memberof config-entry set'¶

usage: dsconf instance plugin memberof config-entry set [-h] [--attr ATTR]
[--groupattr GROUPATTR [GROUPATTR ...]]
[--allbackends {on,off}]
[--skipnested {on,off}]
[--scope SCOPE [SCOPE ...]]
[--exclude EXCLUDE [EXCLUDE ...]]
[--autoaddoc AUTOADDOC]
DN

DN: The config entry full DN
--attr ATTR: Specifies the attribute in the user entry for the Directory Server to manage to reflect group membership (memberOfAttr)
--groupattr GROUPATTR [GROUPATTR ...]: Specifies the attribute in the group entry to use to identify the DNs of group members (memberOfGroupAttr)
--allbackends {on,off}: Specifies whether to search the local suffix for user entries on all available suffixes (memberOfAllBackends)
--skipnested {on,off}: Specifies whether to skip nested groups or not (memberOfSkipNested)
--scope SCOPE [SCOPE ...]: Specifies backends or multiple-nested suffixes for the MemberOf plug-in to work on (memberOfEntryScope)
--exclude EXCLUDE [EXCLUDE ...]: Specifies backends or multiple-nested suffixes for the MemberOf plug-in to exclude (memberOfEntryScopeExcludeSubtree)
--autoaddoc AUTOADDOC: If an entry does not have an object class that allows the memberOf attribute then the memberOf plugin will automatically add the object class listed in the memberOfAutoAddOC parameter

OPTIONS 'dsconf plugin memberof config-entry show'¶

usage: dsconf instance plugin memberof config-entry show [-h] DN

DN

The config entry full DN

OPTIONS 'dsconf plugin memberof config-entry delete'¶

usage: dsconf instance plugin memberof config-entry delete [-h] DN

DN

The config entry full DN

OPTIONS 'dsconf plugin memberof fixup'¶

usage: dsconf instance plugin memberof fixup [-h] [-f FILTER] [--wait]
[--timeout TIMEOUT]
DN

DN: Base DN that contains entries to fix up
-f FILTER, --filter FILTER: Filter for entries to fix up. If omitted, all entries with objectclass inetuser/inetadmin/nsmemberof under the specified base will have their memberOf attribute regenerated.
--wait: Wait for the task to finish, this could take a long time
--timeout TIMEOUT: Sets the task timeout. ,Default is 0 (no timeout)

OPTIONS 'dsconf plugin memberof fixup-status'¶

usage: dsconf instance plugin memberof fixup-status [-h] [--dn DN]
[--show-log] [--watch]

--dn DN

The task entry's DN

--show-log

Display the task log

--watch

Watch the task's status and wait for it to finish

OPTIONS 'dsconf plugin automember'¶

usage: dsconf instance plugin automember [-h]
{show,enable,disable,status,list,definition,fixup,fixup-status,abort-fixup}
...

Sub-commands¶

dsconf plugin automember show: Displays the plugin configuration
dsconf plugin automember enable: Enables the plugin
dsconf plugin automember disable: Disables the plugin
dsconf plugin automember status: Displays the plugin status
dsconf plugin automember list: List Automembership definitions or regex rules.
dsconf plugin automember definition: Manage Automembership definition.
dsconf plugin automember fixup: Run a rebuild membership task.
dsconf plugin automember fixup-status: Check the status of a fix-up task
dsconf plugin automember abort-fixup: Abort the rebuild membership task.

OPTIONS 'dsconf plugin automember show'¶

usage: dsconf instance plugin automember show [-h]

OPTIONS 'dsconf plugin automember enable'¶

usage: dsconf instance plugin automember enable [-h]

OPTIONS 'dsconf plugin automember disable'¶

usage: dsconf instance plugin automember disable [-h]

OPTIONS 'dsconf plugin automember status'¶

usage: dsconf instance plugin automember status [-h]

OPTIONS 'dsconf plugin automember list'¶

usage: dsconf instance plugin automember list [-h] {definitions,regexes} ...

Sub-commands¶

dsconf plugin automember list definitions: Lists Automembership definitions.
dsconf plugin automember list regexes: List Automembership regex rules.

OPTIONS 'dsconf plugin automember list definitions'¶

usage: dsconf instance plugin automember list definitions [-h]

OPTIONS 'dsconf plugin automember list regexes'¶

usage: dsconf instance plugin automember list regexes [-h] DEFNAME

DEFNAME

The definition entry CN

OPTIONS 'dsconf plugin automember definition'¶

usage: dsconf instance plugin automember definition [-h]
DEFNAME
{add,set,delete,show,regex}
...

DEFNAME: The definition entry CN.

Sub-commands¶

dsconf plugin automember definition add: Creates Automembership definition.
dsconf plugin automember definition set: Edits Automembership definition.
dsconf plugin automember definition delete: Removes Automembership definition.
dsconf plugin automember definition show: Displays Automembership definition.
dsconf plugin automember definition regex: Manage Automembership regex rules.

OPTIONS 'dsconf plugin automember definition add'¶

usage: dsconf instance plugin automember definition DEFNAME add
[-h] --grouping-attr GROUPING_ATTR [--default-group DEFAULT_GROUP]
--scope SCOPE --filter FILTER

--grouping-attr GROUPING_ATTR: Specifies the name of the member attribute in the group entry and the attribute in the object entry that supplies the member attribute value, in the format group_member_attr:entry_attr (autoMemberGroupingAttr)
--default-group DEFAULT_GROUP: Sets default or fallback group to add the entry to as a member attribute in group entry (autoMemberDefaultGroup)
--scope SCOPE: Sets the subtree DN to search for entries (autoMemberScope)
--filter FILTER: Sets a standard LDAP search filter to use to search for matching entries (autoMemberFilter)

OPTIONS 'dsconf plugin automember definition set'¶

usage: dsconf instance plugin automember definition DEFNAME set
[-h] --grouping-attr GROUPING_ATTR [--default-group DEFAULT_GROUP]
--scope SCOPE --filter FILTER

--grouping-attr GROUPING_ATTR: Specifies the name of the member attribute in the group entry and the attribute in the object entry that supplies the member attribute value, in the format group_member_attr:entry_attr (autoMemberGroupingAttr)
--default-group DEFAULT_GROUP: Sets default or fallback group to add the entry to as a member attribute in group entry (autoMemberDefaultGroup)
--scope SCOPE: Sets the subtree DN to search for entries (autoMemberScope)
--filter FILTER: Sets a standard LDAP search filter to use to search for matching entries (autoMemberFilter)

OPTIONS 'dsconf plugin automember definition delete'¶

usage: dsconf instance plugin automember definition DEFNAME delete [-h]

OPTIONS 'dsconf plugin automember definition show'¶

usage: dsconf instance plugin automember definition DEFNAME show [-h]

OPTIONS 'dsconf plugin automember definition regex'¶

usage: dsconf instance plugin automember definition DEFNAME regex
[-h] REGEXNAME {add,set,delete,show} ...

REGEXNAME: The regex entry CN

Sub-commands¶

dsconf plugin automember definition regex add: Creates Automembership regex.
dsconf plugin automember definition regex set: Edits Automembership regex.
dsconf plugin automember definition regex delete: Removes Automembership regex.
dsconf plugin automember definition regex show: Displays Automembership regex.

OPTIONS 'dsconf plugin automember definition regex add'¶

usage: dsconf instance plugin automember definition DEFNAME regex REGEXNAME add
[-h] [--exclusive EXCLUSIVE [EXCLUSIVE ...]]
[--inclusive INCLUSIVE [INCLUSIVE ...]] --target-group TARGET_GROUP

--exclusive EXCLUSIVE [EXCLUSIVE ...]: Sets a single regular expression to use to identify entries to exclude (autoMemberExclusiveRegex)
--inclusive INCLUSIVE [INCLUSIVE ...]: Sets a single regular expression to use to identify entries to include (autoMemberInclusiveRegex)
--target-group TARGET_GROUP: Sets which group to add the entry to as a member, if it meets the regular expression conditions (autoMemberTargetGroup)

OPTIONS 'dsconf plugin automember definition regex set'¶

usage: dsconf instance plugin automember definition DEFNAME regex REGEXNAME set
[-h] [--exclusive EXCLUSIVE [EXCLUSIVE ...]]
[--inclusive INCLUSIVE [INCLUSIVE ...]] --target-group TARGET_GROUP

--exclusive EXCLUSIVE [EXCLUSIVE ...]: Sets a single regular expression to use to identify entries to exclude (autoMemberExclusiveRegex)
--inclusive INCLUSIVE [INCLUSIVE ...]: Sets a single regular expression to use to identify entries to include (autoMemberInclusiveRegex)
--target-group TARGET_GROUP: Sets which group to add the entry to as a member, if it meets the regular expression conditions (autoMemberTargetGroup)

OPTIONS 'dsconf plugin automember definition regex delete'¶

usage: dsconf instance plugin automember definition DEFNAME regex REGEXNAME delete
[-h]

OPTIONS 'dsconf plugin automember definition regex show'¶

usage: dsconf instance plugin automember definition DEFNAME regex REGEXNAME show
[-h]

OPTIONS 'dsconf plugin automember fixup'¶

usage: dsconf instance plugin automember fixup [-h] -f FILTER -s
{sub,base,one} [--wait]
[--timeout TIMEOUT]
DN

DN: Base DN that contains entries to fix up
-f FILTER, --filter FILTER: Sets the LDAP filter for entries to fix up
-s {sub,base,one}, --scope {sub,base,one}: Sets the LDAP search scope for entries to fix up
--wait: Wait for the task to finish, this could take a long time
--timeout TIMEOUT: Set a timeout to wait for the fixup task. Default is 0 (no timeout)

OPTIONS 'dsconf plugin automember fixup-status'¶

usage: dsconf instance plugin automember fixup-status [-h] [--dn DN]
[--show-log] [--watch]

--dn DN: The task entry's DN
--show-log: Display the task log
--watch: Watch the task's status and wait for it to finish

OPTIONS 'dsconf plugin automember abort-fixup'¶

usage: dsconf instance plugin automember abort-fixup [-h] [--timeout TIMEOUT]

--timeout TIMEOUT

Set a timeout to wait for the abort task. Default is 0 (no timeout)

OPTIONS 'dsconf plugin referential-integrity'¶

usage: dsconf instance plugin referential-integrity [-h]
{show,enable,disable,status,set,config-entry}
...

Sub-commands¶

dsconf plugin referential-integrity show: Displays the plugin configuration
dsconf plugin referential-integrity enable: Enables the plugin
dsconf plugin referential-integrity disable: Disables the plugin
dsconf plugin referential-integrity status: Displays the plugin status
dsconf plugin referential-integrity set: Edit the plugin settings
dsconf plugin referential-integrity config-entry: Manage the config entry

OPTIONS 'dsconf plugin referential-integrity show'¶

usage: dsconf instance plugin referential-integrity show [-h]

OPTIONS 'dsconf plugin referential-integrity enable'¶

usage: dsconf instance plugin referential-integrity enable [-h]

OPTIONS 'dsconf plugin referential-integrity disable'¶

usage: dsconf instance plugin referential-integrity disable [-h]

OPTIONS 'dsconf plugin referential-integrity status'¶

usage: dsconf instance plugin referential-integrity status [-h]

OPTIONS 'dsconf plugin referential-integrity set'¶

usage: dsconf instance plugin referential-integrity set [-h]
[--update-delay UPDATE_DELAY]
[--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...]]
[--entry-scope ENTRY_SCOPE]
[--exclude-entry-scope EXCLUDE_ENTRY_SCOPE]
[--container-scope CONTAINER_SCOPE]
[--log-file LOG_FILE]
[--config-entry CONFIG_ENTRY]

--update-delay UPDATE_DELAY: Sets the update interval. Special values: 0 - The check is performed immediately, -1 - No check is performed (referint-update-delay)
--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...]: Specifies attributes to check for and update (referint-membership-attr)
--entry-scope ENTRY_SCOPE: Defines the subtree in which the plug-in looks for the delete or rename operations of a user entry (nsslapd-pluginEntryScope)
--exclude-entry-scope EXCLUDE_ENTRY_SCOPE: Defines the subtree in which the plug-in ignores any operations for deleting or renaming a user (nsslapd-pluginExcludeEntryScope)
--container-scope CONTAINER_SCOPE: Specifies which branch the plug-in searches for the groups to which the user belongs. It only updates groups that are under the specified container branch, and leaves all other groups not updated (nsslapd-pluginContainerScope)
--log-file LOG_FILE: Specifies a path to the Referential integrity logfile.For example: /var/log/dirsrv/slapd-YOUR_INSTANCE/referint
--config-entry CONFIG_ENTRY: The value to set as nsslapd-pluginConfigArea

OPTIONS 'dsconf plugin referential-integrity config-entry'¶

usage: dsconf instance plugin referential-integrity config-entry
[-h] {add,set,show,delete} ...

Sub-commands¶

dsconf plugin referential-integrity config-entry add: Add the config entry
dsconf plugin referential-integrity config-entry set: Edit the config entry
dsconf plugin referential-integrity config-entry show: Display the config entry
dsconf plugin referential-integrity config-entry delete: Delete the config entry

OPTIONS 'dsconf plugin referential-integrity config-entry add'¶

usage: dsconf instance plugin referential-integrity config-entry add
[-h] [--update-delay UPDATE_DELAY]
[--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...]]
[--entry-scope ENTRY_SCOPE] [--exclude-entry-scope EXCLUDE_ENTRY_SCOPE]
[--container-scope CONTAINER_SCOPE] [--log-file LOG_FILE]
DN

DN: The config entry full DN
--update-delay UPDATE_DELAY: Sets the update interval. Special values: 0 - The check is performed immediately, -1 - No check is performed (referint-update-delay)
--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...]: Specifies attributes to check for and update (referint-membership-attr)
--entry-scope ENTRY_SCOPE: Defines the subtree in which the plug-in looks for the delete or rename operations of a user entry (nsslapd-pluginEntryScope)
--exclude-entry-scope EXCLUDE_ENTRY_SCOPE: Defines the subtree in which the plug-in ignores any operations for deleting or renaming a user (nsslapd-pluginExcludeEntryScope)
--container-scope CONTAINER_SCOPE: Specifies which branch the plug-in searches for the groups to which the user belongs. It only updates groups that are under the specified container branch, and leaves all other groups not updated (nsslapd-pluginContainerScope)
--log-file LOG_FILE: Specifies a path to the Referential integrity logfile.For example: /var/log/dirsrv/slapd-YOUR_INSTANCE/referint

OPTIONS 'dsconf plugin referential-integrity config-entry set'¶

usage: dsconf instance plugin referential-integrity config-entry set
[-h] [--update-delay UPDATE_DELAY]
[--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...]]
[--entry-scope ENTRY_SCOPE] [--exclude-entry-scope EXCLUDE_ENTRY_SCOPE]
[--container-scope CONTAINER_SCOPE] [--log-file LOG_FILE]
DN

DN: The config entry full DN
--update-delay UPDATE_DELAY: Sets the update interval. Special values: 0 - The check is performed immediately, -1 - No check is performed (referint-update-delay)
--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...]: Specifies attributes to check for and update (referint-membership-attr)
--entry-scope ENTRY_SCOPE: Defines the subtree in which the plug-in looks for the delete or rename operations of a user entry (nsslapd-pluginEntryScope)
--exclude-entry-scope EXCLUDE_ENTRY_SCOPE: Defines the subtree in which the plug-in ignores any operations for deleting or renaming a user (nsslapd-pluginExcludeEntryScope)
--container-scope CONTAINER_SCOPE: Specifies which branch the plug-in searches for the groups to which the user belongs. It only updates groups that are under the specified container branch, and leaves all other groups not updated (nsslapd-pluginContainerScope)
--log-file LOG_FILE: Specifies a path to the Referential integrity logfile.For example: /var/log/dirsrv/slapd-YOUR_INSTANCE/referint

OPTIONS 'dsconf plugin referential-integrity config-entry show'¶

usage: dsconf instance plugin referential-integrity config-entry show [-h] DN

DN

The config entry full DN

OPTIONS 'dsconf plugin referential-integrity config-entry delete'¶

usage: dsconf instance plugin referential-integrity config-entry delete
[-h] DN

DN

The config entry full DN

OPTIONS 'dsconf plugin root-dn'¶

usage: dsconf instance plugin root-dn [-h]
{show,enable,disable,status,set} ...

Sub-commands¶

dsconf plugin root-dn show: Displays the plugin configuration
dsconf plugin root-dn enable: Enables the plugin
dsconf plugin root-dn disable: Disables the plugin
dsconf plugin root-dn status: Displays the plugin status
dsconf plugin root-dn set: Edit the plugin settings

OPTIONS 'dsconf plugin root-dn show'¶

usage: dsconf instance plugin root-dn show [-h]

OPTIONS 'dsconf plugin root-dn enable'¶

usage: dsconf instance plugin root-dn enable [-h]

OPTIONS 'dsconf plugin root-dn disable'¶

usage: dsconf instance plugin root-dn disable [-h]

OPTIONS 'dsconf plugin root-dn status'¶

usage: dsconf instance plugin root-dn status [-h]

OPTIONS 'dsconf plugin root-dn set'¶

usage: dsconf instance plugin root-dn set [-h]
[--allow-host ALLOW_HOST [ALLOW_HOST ...]]
[--deny-host DENY_HOST [DENY_HOST ...]]
[--allow-ip ALLOW_IP [ALLOW_IP ...]]
[--deny-ip DENY_IP [DENY_IP ...]]
[--open-time OPEN_TIME]
[--close-time CLOSE_TIME]
[--days-allowed DAYS_ALLOWED]

--allow-host ALLOW_HOST [ALLOW_HOST ...]

Sets what hosts, by fully-qualified domain name, the root user is allowed to use to access Directory Server. Any hosts not listed are implicitly denied (rootdn-allow-host)

--deny-host DENY_HOST [DENY_HOST ...]

Sets what hosts, by fully-qualified domain name, the root user is not allowed to use to access Directory Server. Any hosts not listed are implicitly allowed (rootdn-deny-host). If a host address is listed in both the rootdn-allow-host and rootdn-deny-host attributes, it is denied access.

--allow-ip ALLOW_IP [ALLOW_IP ...]

Sets what IP addresses, either IPv4 or IPv6, for machines the root user is allowed to use to access Directory Server. Any IP addresses not listed are implicitly denied (rootdn-allow-ip)

--deny-ip DENY_IP [DENY_IP ...]

Sets what IP addresses, either IPv4 or IPv6, for machines the root user is not allowed to use to access Directory Server. Any IP addresses not listed are implicitly allowed (rootdn-deny-ip). If an IP address is listed in both the rootdn-allow-ip and rootdn-deny-ip attributes, it is denied access.

--open-time OPEN_TIME

Sets part of a time period or range when the root user is allowed to access Directory Server. This sets when the time-based access begins (rootdn-open- time)

--close-time CLOSE_TIME

Sets part of a time period or range when the root user is allowed to access Directory Server. This sets when the time-based access ends (rootdn-close- time)

--days-allowed DAYS_ALLOWED

Sets a comma-separated list of what days the root user is allowed to use to access Directory Server. Any days listed are implicitly denied (rootdn-days- allowed)

OPTIONS 'dsconf plugin usn'¶

usage: dsconf instance plugin usn [-h]
{show,enable,disable,status,global,cleanup}
...

Sub-commands¶

dsconf plugin usn show: Displays the plugin configuration
dsconf plugin usn enable: Enables the plugin
dsconf plugin usn disable: Disables the plugin
dsconf plugin usn status: Displays the plugin status
dsconf plugin usn global: Get or manage global USN mode (nsslapd-entryusn-global)
dsconf plugin usn cleanup: Runs the USN tombstone cleanup task

OPTIONS 'dsconf plugin usn show'¶

usage: dsconf instance plugin usn show [-h]

OPTIONS 'dsconf plugin usn enable'¶

usage: dsconf instance plugin usn enable [-h]

OPTIONS 'dsconf plugin usn disable'¶

usage: dsconf instance plugin usn disable [-h]

OPTIONS 'dsconf plugin usn status'¶

usage: dsconf instance plugin usn status [-h]

OPTIONS 'dsconf plugin usn global'¶

usage: dsconf instance plugin usn global [-h] {on,off} ...

Sub-commands¶

dsconf plugin usn global on: Enables USN global mode
dsconf plugin usn global off: Disables USN global mode

OPTIONS 'dsconf plugin usn global on'¶

usage: dsconf instance plugin usn global on [-h]

OPTIONS 'dsconf plugin usn global off'¶

usage: dsconf instance plugin usn global off [-h]

OPTIONS 'dsconf plugin usn cleanup'¶

usage: dsconf instance plugin usn cleanup [-h] (-s SUFFIX | -n BACKEND)
[-m MAX_USN] [--timeout TIMEOUT]

-s SUFFIX, --suffix SUFFIX

Sets the suffix or subtree in Directory Server to run the cleanup operation against. If the suffix is not specified, then the back end must be specified (suffix).

-n BACKEND, --backend BACKEND

Sets the Directory Server instance back end, or database, to run the cleanup operation against. If the back end is not specified, then the suffix must be specified. Backend instance in which USN tombstone entries (backend)

-m MAX_USN, --max-usn MAX_USN

Sets the highest USN value to delete when removing tombstone entries (max_usn_to_delete)

--timeout TIMEOUT

Sets the cleanup task timeout. Default is 120 seconds,

OPTIONS 'dsconf plugin account-policy'¶

usage: dsconf instance plugin account-policy [-h]
{show,enable,disable,status,set,config-entry}
...

Sub-commands¶

dsconf plugin account-policy show: Displays the plugin configuration
dsconf plugin account-policy enable: Enables the plugin
dsconf plugin account-policy disable: Disables the plugin
dsconf plugin account-policy status: Displays the plugin status
dsconf plugin account-policy set: Edit the plugin settings
dsconf plugin account-policy config-entry: Manage the config entry

OPTIONS 'dsconf plugin account-policy show'¶

usage: dsconf instance plugin account-policy show [-h]

OPTIONS 'dsconf plugin account-policy enable'¶

usage: dsconf instance plugin account-policy enable [-h]

OPTIONS 'dsconf plugin account-policy disable'¶

usage: dsconf instance plugin account-policy disable [-h]

OPTIONS 'dsconf plugin account-policy status'¶

usage: dsconf instance plugin account-policy status [-h]

OPTIONS 'dsconf plugin account-policy set'¶

usage: dsconf instance plugin account-policy set [-h]
[--config-entry CONFIG_ENTRY]

--config-entry CONFIG_ENTRY: Sets the nsslapd-pluginConfigArea attribute

OPTIONS 'dsconf plugin account-policy config-entry'¶

usage: dsconf instance plugin account-policy config-entry [-h]
{add,set,show,delete}
...

Sub-commands¶

dsconf plugin account-policy config-entry add: Add the config entry
dsconf plugin account-policy config-entry set: Edit the config entry
dsconf plugin account-policy config-entry show: Display the config entry
dsconf plugin account-policy config-entry delete: Delete the config entry

OPTIONS 'dsconf plugin account-policy config-entry add'¶

usage: dsconf instance plugin account-policy config-entry add
[-h] [--always-record-login {yes,no}] [--alt-state-attr ALT_STATE_ATTR]
[--always-record-login-attr ALWAYS_RECORD_LOGIN_ATTR]
[--limit-attr LIMIT_ATTR] [--spec-attr SPEC_ATTR]
[--state-attr STATE_ATTR]
DN

DN: The full DN of the config entry
--always-record-login {yes,no}: Sets that every entry records its last login time (alwaysRecordLogin)
--alt-state-attr ALT_STATE_ATTR: Provides a backup attribute for the server to reference to evaluate the expiration time (altStateAttrName)
--always-record-login-attr ALWAYS_RECORD_LOGIN_ATTR: Specifies the attribute to store the time of the last successful login in this attribute in the users directory entry (alwaysRecordLoginAttr)
--limit-attr LIMIT_ATTR: Specifies the attribute within the policy to use for the account inactivation limit (limitAttrName)
--spec-attr SPEC_ATTR: Specifies the attribute to identify which entries are account policy configuration entries (specAttrName)
--state-attr STATE_ATTR: Specifies the primary time attribute used to evaluate an account policy (stateAttrName)

OPTIONS 'dsconf plugin account-policy config-entry set'¶

usage: dsconf instance plugin account-policy config-entry set
[-h] [--always-record-login {yes,no}] [--alt-state-attr ALT_STATE_ATTR]
[--always-record-login-attr ALWAYS_RECORD_LOGIN_ATTR]
[--limit-attr LIMIT_ATTR] [--spec-attr SPEC_ATTR]
[--state-attr STATE_ATTR]
DN

DN: The full DN of the config entry
--always-record-login {yes,no}: Sets that every entry records its last login time (alwaysRecordLogin)
--alt-state-attr ALT_STATE_ATTR: Provides a backup attribute for the server to reference to evaluate the expiration time (altStateAttrName)
--always-record-login-attr ALWAYS_RECORD_LOGIN_ATTR: Specifies the attribute to store the time of the last successful login in this attribute in the users directory entry (alwaysRecordLoginAttr)
--limit-attr LIMIT_ATTR: Specifies the attribute within the policy to use for the account inactivation limit (limitAttrName)
--spec-attr SPEC_ATTR: Specifies the attribute to identify which entries are account policy configuration entries (specAttrName)
--state-attr STATE_ATTR: Specifies the primary time attribute used to evaluate an account policy (stateAttrName)

OPTIONS 'dsconf plugin account-policy config-entry show'¶

usage: dsconf instance plugin account-policy config-entry show [-h] DN

DN

The full DN of the config entry

OPTIONS 'dsconf plugin account-policy config-entry delete'¶

usage: dsconf instance plugin account-policy config-entry delete [-h] DN

DN

The full DN of the config entry

OPTIONS 'dsconf plugin attr-uniq'¶

usage: dsconf instance plugin attr-uniq [-h]
{list,add,set,show,delete,enable,disable,status}
...

Sub-commands¶

dsconf plugin attr-uniq list: Lists available plugin configs
dsconf plugin attr-uniq add: Add the config entry
dsconf plugin attr-uniq set: Edit the config entry
dsconf plugin attr-uniq show: Display the config entry
dsconf plugin attr-uniq delete: Delete the config entry
dsconf plugin attr-uniq enable: enable plugin
dsconf plugin attr-uniq disable: disable plugin
dsconf plugin attr-uniq status: display plugin status

OPTIONS 'dsconf plugin attr-uniq list'¶

usage: dsconf instance plugin attr-uniq list [-h]

OPTIONS 'dsconf plugin attr-uniq add'¶

usage: dsconf instance plugin attr-uniq add [-h] [--enabled {on,off}]
[--attr-name ATTR_NAME [ATTR_NAME ...]]
[--subtree SUBTREE [SUBTREE ...]]
[--across-all-subtrees {on,off}]
[--top-entry-oc TOP_ENTRY_OC]
[--subtree-entries-oc SUBTREE_ENTRIES_OC]
NAME

NAME: The name of the plug-in configuration record. (cn) You can use any string, but "attribute_name Attribute Uniqueness" is recommended.
--enabled {on,off}: Identifies whether or not the config is enabled.
--attr-name ATTR_NAME [ATTR_NAME ...]: Sets the name of the attribute whose values must be unique. This attribute is multi-valued. (uniqueness-attribute-name)
--subtree SUBTREE [SUBTREE ...]: Sets the DN under which the plug-in checks for uniqueness of the attributes value. This attribute is multi-valued (uniqueness-subtrees)
--across-all-subtrees {on,off}: If enabled (on), the plug-in checks that the attribute is unique across all subtrees set. If you set the attribute to off, uniqueness is only enforced within the subtree of the updated entry (uniqueness-across-all-subtrees)
--top-entry-oc TOP_ENTRY_OC: Verifies that the value of the attribute set in uniqueness-attribute-name is unique in this subtree (uniqueness-top-entry-oc)
--subtree-entries-oc SUBTREE_ENTRIES_OC: Verifies if an attribute is unique, if the entry contains the object class set in this parameter (uniqueness-subtree-entries-oc)

OPTIONS 'dsconf plugin attr-uniq set'¶

usage: dsconf instance plugin attr-uniq set [-h] [--enabled {on,off}]
[--attr-name ATTR_NAME [ATTR_NAME ...]]
[--subtree SUBTREE [SUBTREE ...]]
[--across-all-subtrees {on,off}]
[--top-entry-oc TOP_ENTRY_OC]
[--subtree-entries-oc SUBTREE_ENTRIES_OC]
NAME

NAME: The name of the plug-in configuration record. (cn) You can use any string, but "attribute_name Attribute Uniqueness" is recommended.
--enabled {on,off}: Identifies whether or not the config is enabled.
--attr-name ATTR_NAME [ATTR_NAME ...]: Sets the name of the attribute whose values must be unique. This attribute is multi-valued. (uniqueness-attribute-name)
--subtree SUBTREE [SUBTREE ...]: Sets the DN under which the plug-in checks for uniqueness of the attributes value. This attribute is multi-valued (uniqueness-subtrees)
--across-all-subtrees {on,off}: If enabled (on), the plug-in checks that the attribute is unique across all subtrees set. If you set the attribute to off, uniqueness is only enforced within the subtree of the updated entry (uniqueness-across-all-subtrees)
--top-entry-oc TOP_ENTRY_OC: Verifies that the value of the attribute set in uniqueness-attribute-name is unique in this subtree (uniqueness-top-entry-oc)
--subtree-entries-oc SUBTREE_ENTRIES_OC: Verifies if an attribute is unique, if the entry contains the object class set in this parameter (uniqueness-subtree-entries-oc)

OPTIONS 'dsconf plugin attr-uniq show'¶

usage: dsconf instance plugin attr-uniq show [-h] NAME

NAME