Feedback
Table Of Contents
acsview merge-from-supportbundle
acsview replace-clean-activesessionsdb
reset-management-interface-certificate
ACS Command Reference
This chapter contains an alphabetical listing of the commands specific to the Cisco Secure ACS 5.3. The commands comprise these modes:
•
EXEC
–
–
•
Use the EXEC mode system-level acs-config command to access the ACS Configuration mode.
•
–
Use the EXEC mode system-level configure command to access the Configuration mode.
Each of the commands in this appendix is followed by a brief description of its use, command syntax, usage guidelines, and one or more examples. Throughout this appendix, the ACS server uses the name acs in place of the ACS server's hostname.
Note
Before proceeding to use the ACS CLI commands, familiarize yourself with disk space management in CSACS-1121. This section describes disk space management for the purpose of managing logs that you can view or download from the ACS CLI and includes:
•
•
•
Managing disk space on the CSACS-1121 is important to enable you to use ACS efficiently. Table 3-1 describes the disk space allocated for each set of log files.
Log files in ACS are managed using various utilities, such as logrotate, log4j, and log4cxx. The log files are numbered and rolled over based on a configured maximum file size. Once a log file touches the configured limit, the data is rolled over to another file. This file is renamed in the XXX.N.log format, where:
•
•
For instance, the default maximum file size for log files that logrotate manages is 5 MB. When a log file (for example, acsupgrade.log) reaches the 5-MB limit, it is renamed as acsupgrade.log.1. With every 5-MB increase in file size, the latest file is renamed as acsupgrade.log.2, acsupgrade.log.3, and so on.
Logrotate stores up to 10 log files at a given time. The latest log information, however, is always stored in acsupgrade.log. In ACS, logrotate runs as an hourly kron job and verifies the disk space allocated for the log files.
For detailed information on logging in ACS 5.3, refer to the User Guide for the Cisco Secure Access Control System 5.3.
This appendix describes:
EXEC Commands
Each EXEC command includes a brief description of its use, command syntax, usage guidelines, and sample output.
Table 3-3 lists the EXEC commands that this section describes.
Table 3-3 List of EXEC Commands1
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
1 Commands marked with an asterisk (*) represent those that are specific to ACS functionality.
acs (instance)
To start or stop an ACS instance, use the acs command in the EXEC mode.
acs {start | stop}
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
If you use the acs stop command to stop your ACS, the ACS instance automatically starts the next time the CSACS-1121 appliance boots up.
Examples
Example 1
acs/admin# acs startStarting ACS .............................To verify that ACS processes are running, use the'show application status acs' command.Example 2
acs/admin#acs/admin# acs stopStopping ACS ......................acs/admin#Related Commands
acs (process)
To start or stop an individual process of an ACS instance, use the acs command in the EXEC mode.
acs {start | stop} {adclient | database | management | runtime | view-logprocessor | view-alertmanager | view-collector | view-database | view-jobmanager}
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
If you use the acs stop command to stop any ACS process, it automatically starts the next time the CSACS-1121 appliance boots up.
When ACS cannot start or stop the ACS process that you want to start or stop, it prompts you with a relevant message.
The ACS processes may fail to start or stop in the following scenarios:
•
•
`adclient' is not configured, therefore will not be started.•
`adclient' is not configured. Attempting to stop it anyway.•
% Error: This is not a log collector node. Cannot start 'proc-name'.Where proc-name refers to the specific view process that you attempted to start.
•
This is not a log collector node. Attempting to stop 'proc-name' anyway.Where proc-name refers to the specific view process that you attempted to stop.
Caution
Examples
Example 1
acs/admin# acs start databaseStarting databaseacs/admin#Example 2
acs/admin# acs stop databaseStopping databaseacs/admin#Related Commands
Starts or stops an ACS instance.
Shows application status and version information.
acs backup
To back up an ACS configuration (not including the ADE OS data), use the acs backup command in the EXEC mode.
acs backup backup-filename repository repository-name
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Performs a backup of ACS data and places the backup in a repository.
Note
When you are using the acs backup command, the backup files include:
•
–
–
•
•
You can access the /opt/CSCOacs/logs/acsbackup_instance.log file for information about the last backup operation.
You can use the show backup history command to display the backup operations and determine whether they succeeded. If the backup fails, you may be able to use the show logging command (or the show acs-logs command if you are backing up ACS logs) to view troubleshooting information. Failures in the ACS aspect of the backup are clearly described on the terminal.
If you use this command on a secondary ACS, no backup occurs. You can use the ACS web interface to designate an ACS node to collect logs.
After you use this command, a time stamp is added to the end of the backup-name filename, to enable periodic backups. For more information, see acs restore.
Examples
acs/admin# acs backup mybackup repository myrepositoryACS backup file 'mybackup-081007-2055.tar.gpg' successfully copied to repository 'myrepository'acs/admin#Related Commands
acs-config
To enter the ACS Configuration mode, use the acs-config command in the EXEC mode.
acs-config
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
You must have privileges to enter the ACS Configuration mode, and must supply the username and the password that you use to log in to the ACS web interface. The default username and password to access the ACS web interface are acsadmin and default, and the first time you log in to the web interface, you will be prompted to change the default password.
We recommend that you do so for security reasons. You can change your password for the first time only by logging into the web interface. You will also be prompted to install the license.
Note
After resetting your password and installing a valid license, use the default username (acsadmin) and changed password, or the username and password for a newly created admin user, to access the ACS CLI in the ACS Configuration mode.
Up to six users can access the ACS Configuration mode at a time; six users equal six sessions. When one of the six sessions ends, you must wait up to five minutes for the session to be available to another user.
To leave the ACS Configuration mode, type exit or press Ctrl-d.
After you provide valid login credentials, ACS prompts you to change your password for any of the following reasons:
•
•
•
•
When ACS prompts you to change your password, enter your old password, then a new password (conforming to the password policy), and confirm your new password (repeat the new password that you specified).
If you fail to change your password when you are requested to, you cannot log in to ACS Configuration mode.
Examples
Example 1 - Success
acs/admin# acs-configEscape character is CNTL/D.Username: user1Password:acs/admin(config-acs)#Example 2 - Failure
acs/admin# acs-configEscape character is CNTL/D.This command requires ACS to be running.Issue 'acs start' command and try again.acs/adminExample 3 - Failure
acs/admin# acs-configEscape character is CNTL/D.Username: user1Password:Authentication failed.Username:Example 4 - Failure
acs/admin# acs-configEscape character is CNTL/D.Username: acsadminPassword:Failed to login with the default password.Use the web interface to modify the default passwordacs/admin#Example 5 - Success
acs/admin# acs-configEscape character is CNTL/D.Username: acsadminPassword:Administrator must change password.Old password:New password:Confirm new password:acs/admin(config-acs)#Example 6 - Failure
acs/admin# acs-configEscape character is CNTL/D.Username: acsadminPassword:Administrator must change password.Old password:Invalid value.acs/admin#Example 7 - Failure
acs/admin# acs-configEscape character is CNTL/D.Username: acsadminPassword:Administrator must change password.Old password:New password:Confirm new password:Cannot change password:Password and confirm password must be the sameacs/admin#Example 8 - Failure
acs/admin# acs-configEscape character is CNTL/D.Username: acsadminPassword:Administrator must change password.Old password:New password:Confirm new password:Cannot change password:Value is out of range (4 - 32)acs/admin#If the new password does not conform with the password policy, ACS displays the password policy details as shown in the previous example.
Related Commands
acs config-web-interface
To enable or disable an interface for ACS configuration web, use the acs config-web-interface command in the EXEC mode.
acs config-web-interface [migration | ucp | view | rest] {enable | disable}
Syntax Description
Defaults
Enabled.
Command Modes
EXEC
Usage Guidelines
Enables or disables an interface to migrate the ACS database, change the user password or use REST services through the CLI.
If you do not want to migrate your ACS database, change the user password or use REST services Cisco recommends that you disable these interfaces.
Examples
Example 1
acs/admin# acs config-web-interface migration enableacs/admin#Example 2
acs/admin# acs config-web-interface [migration | ucp | view | rest] disableacs/admin#Related Commands
acs delete core
To delete an ACS run-time core file or JVM core log, use the acs delete core command in the EXEC mode.
acs delete core {filename}
Syntax Description
filename
Name of the run-time core file or JVM core log. You can use up to 255 alphanumeric characters to specify the filename.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
To view the list of available run-time core files and JVM core logs, use show acs-cores command.
Examples
Example 1
acs/admin# acs delete core xyz.log% Error: Invalid core file 'xyz.log'Use 'show acs-cores' to list the core filesacs/admin(config-acs)#Example 2
acs/admin# acs delete core hs_err_pid12477.logCore file 'hs_err_pid12477.log' deleted successfullyacs/adminRelated Commands
Deletes an ACS run-time core file or JVM core log excluding the latest one.
Displays ACS server debug logs.
Displays ACS run-time core files and JVM core logs.
acs delete log
To delete an ACS run-time core file or JVM core log excluding the latest one, use the acs delete log command in the EXEC mode.
acs delete log {filename}
Syntax Description
filename
Name of the run-time core file or JVM core log. You can use up to 255 alphanumeric characters to specify the filename.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
To view the list of available run-time core files and JVM core logs, use the show acs-cores command. To delete the latest run-time core file or JVM core log, use the acs delete core command.
Examples
Example 1
acs/admin# acs delete log xyz.log% Error: Invalid log file 'xyz.log'Use 'show acs-logs' to list the log filesacs/adminExample 2
acs/admin# acs delete log catalina.out% Error: most recent log files cannot be deleted, only older logs.acs/adminExample 3
acs/admin# acs delete log catalina.2008-12-10.logLog file 'catalina.2008-12-10.log' deleted successfullyacs/adminRelated Commands
Deletes an ACS run-time core file or JVM core log.
Displays ACS server debug logs.
Displays ACS run-time core files and JVM core logs.
acs patch
To install and remove ACS patches, use the acs patch command in the EXEC mode.
acs patch {install | remove} patch-name.tar.gpg repository repository-name
Syntax Description
Defaults
Patch installations and removals are logged to /opt/CSCOacs/logs/acsupgrade.log.
Command Modes
EXEC
Usage Guidelines
ACS patches contain small fixes that include isolated files, not a full version of the ACS software. ACS patch installations and removals require that you restart ACS.
Examples
Example 1
acs/admin# acs patch install acspatch.tar.gpg repository myrepositoryInstalling an ACS patch requires a restart of ACS services.Would you like to continue? Y/NExample 2
acs/admin# acs patch remove acspatch.tar.gpgRemoving an ACS patch requires a restart of ACS services.Would you like to continue? Y/NRelated Commands
Shows application status and version information.
Displays information about the software version of the system.
acs reset-config
To reset the ACS configuration to factory defaults, use the acs reset-config command in the EXEC mode.
acs reset-config
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
If you use the acs reset-config command to reset your ACS to the factory default configuration, any configurations you have performed are lost; however, the appliance settings (such as network settings and backup repositories) are not affected.
ACS does not need to be running when you use this command.
Examples
acs/admin# acs reset-configThis command will reset the ACS configuration.Would you like to continue? Y/NRelated Commands
acs reset-password
To reset the `acsadmin' administrator password to the default setting, use the acs reset-password command in the EXEC mode.
acs reset-password
Syntax Description
No arguments or keywords.
Defaults
This command resets the ACS administrator `acsadmin' password to the default setting (default). Resetting this password does not affect other ACS administrators.
Command Modes
EXEC
Usage Guidelines
You cannot use this command on a secondary ACS node.
After you use this command, you must access your primary ACS node via the web interface and change the password. If you use the default password for the web interface (default) to access the ACS Configuration mode (which requires you to provide the web interface username and password), the login fails and the system prompts you to change the default password.
Examples
acs/admin# acs reset-passwordThis command resets the 'ACSAdmin' password to its original value.Are you sure you want to continue? (yes/no) yPassword was reset successfullyacs/admin#Related Commands
acs restore
To restore an ACS configuration (not including the ADE OS data) from one ACS node to another, use the acs restore command in the EXEC mode.
acs restore backup-file-name repository repository-name
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Restores an ACS configuration from one ACS node to another. The restoration is performed from a temporary directory (the repository).
If you are restoring an primary ACS node configuration to a secondary, you must configure the secondary to local mode before you use this command (deregister from the primary node).
Caution
If you are restoring the backup file on a node that was part of the ACS deployment when the backup was performed, ACS replaces the database. This includes:
•
•
•
The prikeypwd.key is not included because this file can be associated only with the private keys of the original ACS primary node.
Note
You need not restore the backup file on a node that was not part of the deployment when the backup was performed, as the new ACS node might not have any local certificates to associate with.
After a restoration is complete, you must use the ACS web interface to designate an ACS node as a log collector.
Examples
acs/admin# acs restore mybackup-080229-2335.tar.gpg repository myrepositoryRestore requires a restart of ACS services. Continue? (yes/no)Related Commands
acs support
To gather information for ACS troubleshooting, use the acs support command in the EXEC mode.
acs support filename repository repository-name encryption-passphrase <password> [description {"text"}] [include-cores {number-days}] [include-db {original | secure}] [include-debug-logs {number-logs}] [include-local-logs {number-logs}] [include-system-logs {number-logs}] [include-logs {number-days} {all-categories | log-categories [aaa-accounting | aaa-audit | aaa-diagnostics | administrative-audit | system-diagnostics]}]
Syntax Description
Defaults
The command generates a tar.gz file, which can contain the following components:
•
•
•
•
•
•
•
•
Command Modes
EXEC
Usage Guidelines
Note
You are prompted for a username and password that can access the remote location.
ACS 5.3 encrypt the support bundle if the encryption-passphrase command is used. You can decrypt the support bundle outside the ACS 5.3 machine using the password provided.
To decrypt the support bundle outside the ACS 5.3 machine, you should have a decrypter program that can decrypt the .gpg files, for example GnuPG program. If you do not want to encrypt the support bundle you can enter the password value as null.
Possible errors are standard FTP and SCP error messages.
Table 3-4 Protocol Prefix Keywords
ftp
Source or destination URL for FTP network server. The syntax for this alias:
ftp:[[[//username [:password]@]location]/directory]/filename
scp
Source or destination URL for SCP network server. The syntax for this alias:
scp:[[[//username [:password]@]location]/directory]/filename
sftp1
Source or destination URL for an SFTP network server. The syntax for this alias:
sftp:[[//location]/directory]/filename
tftp1
Source or destination URL for a TFTP network server. The syntax for this alias:
tftp:[[//location]/directory]/filename
1 Not available for ACS file transfers.
Examples
acs/admin# acs support file01 repository myrepository encryption-passphrase xyz description "files to bundle for assistance" include-cores 3 include-db secure include-debug-logs 10 include-local-logs 5 include-system-logs 1 include-logs 7 log-categories aaa-audit administrative-auditCollecting support information ...(file01.tar.gz)ACS support file 'file01.tar.gz' successfully copied to repository 'myrepository'acs/admin#Related Commands
acs zeroize-machine
Use the acs zeroize-machine command in the EXEC mode to trigger the zeorization, delete the key and sensitive files, the running memory and the swap files. This command securely deletes the partition on which ACS is installed.
It also securely deletes the swap partition and restarts the machine to clear all information in the RAM. After the execution of the command is complete, ACS will no longer function on the appliance. You have to re-install ACS on the appliance.
acs zeroize-machine
Syntax Description
No arguments or keywords.
Defaults
None.
Command Modes
EXEC mode
Usage Guidelines
When you enter this command, ACS will prompt you for confirmation for three times before running the command. The command performs the following steps:
1.
2.
–
–
–
–
–
–
–
The optvol is the partition on which ACS is installed and all the sensitive information in ACS is stored here. The swap is maintained in swapvol.
3.
4.
5.
6.
It is recommended not to use the ACS machine after you run this command.
Examples
cd-acs5-13-50/admin# acs zeroize-machineThis command performs key zeroization of the ACS machineWarning: This operation is irreversible - it completely deletes the ACS machine!Are you sure you want to perform key zeroization now? (yes/no)Please enter 'yes' or 'no'Are you sure you want to perform key zeroization now? (yes/no) yesAre you absolutely sure you want to perform key zeroization now? (yes/no) noapplication install
To install a specific application, use the application install command in the EXEC mode. To remove this function, use the application remove command.
application install application-bundle remote-repository-name
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Installs the specified application bundle on the appliance. The application bundle file is pulled from the specified repository.
If you run the application install or application remove command when another installation or removal operation of an application is in progress, you will see the following warning message:
An existing application install, remove, or upgrade is in progress. Try again shortly.The ACS machine will be rebooted automatically soon after the installation gets completed.
Examples
acs/admin# application install acs.tar.gz myremoterepositoryDo you want to save the current configuration ? (yes/no) [yes] ?Generating configuration...Saved the running configuration to startup successfullyacs/admin#Related Commands
application remove
To remove a specific application, use the application remove command in the EXEC mode. To remove this function, use the no form of this command.
application remove application-name
Syntax Description
remove
Removes or uninstalls an application.
application-name
Application name. This can be a maximum of 255 alphanumeric characters.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Removes or uninstalls an application.
Examples
acs/admin# application remove acsacs/admin#Related Commands
application reset-config
To reset an application configuration to factory defaults, use the application reset-config command in the EXEC mode.
application reset-config application-name
Syntax Description
application-name
Name of the application to reset its configuration to factory defaults. Up to 255 alphanumeric characters.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
You can use the application reset-config command to reset the ACS configuration to factory defaults without reimaging the ACS appliance or VM.
Examples
acs/admin# application reset-config acsApplication successfully reset configurationacs/admin#Related Commands
application start
To enable a specific application, use the application start command in the EXEC mode. To remove this function, use the no form of this command.
application start application-name
Syntax Description
start
Enables an application bundle.
application-name
Name of the predefined application that you want to enable. This can be a maximum of 255 alphanumeric characters.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Enables an application.
You cannot use this command to start ACS.
Examples
acs/admin# application start acsacs/admin#Related Commands
application stop
To disable a specific application, use the application stop command in the EXEC mode. To remove this function, use the no form of this command.
application stop application-name
Syntax Description
stop
Disables an application.
application-name
Name of the predefined application that you want to disable. This can be a maximum of 255 alphanumeric characters.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Disables an application.
You cannot use this command to stop ACS.
Examples
acs/admin# application stop acsacs/admin#Related Commands
application upgrade
To upgrade a specific application bundle, use the application upgrade command in the EXEC mode. To remove this function, use the application remove command.
application upgrade application-bundle remote-repository-name
Syntax Description
Command Default
No default behavior or values.
Command Modes
EXEC.
Usage Guidelines
Upgrades an application bundle, preserving any application configuration data.
If you issue the application upgrade command when another application upgrade operation is in progress, you will see the following warning message:
An existing application install, remove, or upgrade is in progress. Try again shortly.
Note
Note
backup
To perform a backup (including the ADE OS data like hostname, IP address) and place the backup in a repository, use the backup command in the EXEC mode.
backup backup-name repository repository-name
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Performs a backup of ACS data and places the backup in a repository.
When you are using this command for ACS, the backup files include:
•
•
•
•
You can use the show backup history command to display the backup operations and determine whether they succeeded.
If the backup fails, you may be able to use the show logging command (or the show acs-logs command if you are backing up ACS logs) to view troubleshooting information. Failures in the ACS aspect of the backup are clearly described in messages that are displayed on the terminal.
Examples
acs/admin# backup mybackup repository myrepository% Creating backup with timestamped filename: myback2-081007-2129.tar.gpgacs/admin#Related Commands
backup-logs
To back up system logs, use the backup-logs command in the EXEC mode. To remove this function, use the no form of this command.
backup-logs backup-name repository repository-name
Syntax Description
Defaults
This command backs up these log files, which are located in specific directories:
•
•
•
•
Command Modes
EXEC
Usage Guidelines
Backs up system logs.
Examples
acs/admin# backup-logs mysyslogs repository myrepository% Creating log backup with timestamped filename: mysyslogs-081007-2130.tar.gzacs/admin#Related Commands
clock
To set the system clock, use the clock command in the EXEC mode. To remove this function, use the no form of this command.
clock {set} [month day hh:min:ss yyyy]
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Sets the system clock. You must restart the ACS server to take effect of the changes after setting the clock.
Examples
acs/admin# clock set Jan 4 05:05:05 2007Clock was modified. You must restart ACS.Do you want to restart ACS now? (yes/no) yesStopping ACS .................Starting ACS ......................acs/admin#Related Commands
configure
To enter the Configuration mode, use the configure command in the EXEC mode. If using the replace option, this command copies a remote configuration to the system, overwriting the existing configuration.
configure {terminal}
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Use this command to enter the Configuration mode. Note that commands in this mode write to the running configuration file as soon as you enter them (press Enter).
To exit the Configuration mode and return to the EXEC mode, enter end, exit, or Ctrl-z.
To view the changes that you have made to the configuration, use the show running-config command in the EXEC mode.
Examples
acs/admin# configure terminalEnter configuration commands, one per line. End with CNTL/Z.acs/admin(config)#Related Commands
Displays the contents of the currently running configuration file or the configuration.
Displays the contents of the startup configuration file or the configuration.
copy
To copy any file from a source to a destination, use the copy command in the EXEC mode. The copy command in ACS copies a configuration (running or startup).
Running Configuration
The ACS active configuration stores itself in the ACS RAM. Every configuration command you enter resides in the running configuration. If you reboot your ACS server, you lose the configuration. If you make changes that you want to save, you must copy the running configuration to a safe location, such as a network server, or save it as the ACS server startup configuration.
Startup Configuration
You cannot edit a startup configuration directly. All commands that you enter store themselves in the running configuration, which you can copy into the startup configuration.
In other words, when you boot an ACS server, the startup configuration becomes the initial running configuration. As you modify the configuration, the two diverge:
•
•
If you want to make your changes permanent, you must copy the running configuration to the startup configuration.
The following command lines show some of the copy command scenarios available:
copy running-configuration startup-configuration
Copies the running configuration to the startup configuration. Replaces the startup-configuration with the running configuration.
Note
copy startup-configuration running-configuration
Copies the startup configuration to the running configuration. Merges the startup configuration on top of the running configuration.
copy [protocol://hostname/location] startup-configuration
Copies but does not merge a remote file to the startup configuration.
copy [protocol://hostname/location] running-configuration
Copies and merges a remote file to the running configuration.
copy startup-configuration [protocol://hostname/location]
Copies the startup configuration to a remote system.
copy running-configuration [protocol://hostname/location]
Copies the running configuration to a remote system.
copy logs [protocol://hostname/location]
Copies log files from the system to another location.
Note
Syntax Description
running-configuration
Represents the current running configuration file.
startup-configuration
Represents the configuration file used during initialization (startup).
protocol
See Table 3-4 for protocol keyword options.
hostname
Hostname of destination.
location
Location of destination.
logs
System log files.
acs-logs
ACS log files.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
The fundamental function of the copy command allows you to copy a file (such as a system image or configuration file) from one location to another location. The source and destination for the file specified uses the ACS file system, through which you can specify any supported local or remote file location. The file system being used (a local memory source or a remote system) dictates the syntax used in the command.
You can enter on the command line all necessary source and destination information and the username and password to use; or, you can enter the copy command and have the ACS server prompt you for any missing information.
Timesaver
The entire copying process might take several minutes and differs from protocol to protocol and from network to network.
Use the filename relative to the directory for file transfers.
Examples
Example 1
acs/admin# copy run startGenerating configuration...acs/admin#Example 2
acs/admin# copy logs ftp://host01/ldir01Related Commands
debug
To display errors or events for command situations, use the debug command in the EXEC mode.
debug {all | application | backup-restore | cdp | | config | icmp | copy | locks | logging | snmp | system | transfer | user | utils}
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Use the debug command to identify various failures within the ACS server; for example, setup failures or configuration failures.
Examples
acs/admin# debug allacs/admin# mkdir disk:/1acs/admin# 6 [7178]: utils: vsh_root_stubs.c[2301]: mkdir operation successacs/admin# rmdir disk:/1acs/admin# 6 [7180]: utils: vsh_root_stubs.c[2171]: Invoked Remove Directory disk:/1 command 6 [7180]: utils: vsh_root_stubs.c[2228]: Remove Directory operation successacs/admin# undebug allacsvw-test8/admin# 7 [2826]: cdp:infra: ether-write.c[87]: WriteEther(): wrote len: 1927 [2826]: cdp:infra: ether-write.c[112]: cdpd write succeed...7 [2826]: cdp:infra: main.c[128]:Writing with retransmissiontime 60...Related Commands
Disables the output (display of errors or events) of the debug command for various command situations.
delete
To delete a file from the ACS server, use the delete command in the EXEC mode. To remove this function, use the no form of this command.
delete filename
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
If you attempt to delete the configuration file or image, the system prompts you to confirm the deletion. Also, if you attempt to delete the last valid system image, the system prompts you to confirm the deletion.
Examples
acs/admin# delete myfileacs/admin#Related Commands
dir
To list a file from the ACS server, use the dir command in the EXEC mode. To remove this function, use the no form of this command.
dir [word] [recursive]
Syntax Description
word
Directory name. This can be a maximum of 80 alphanumeric characters. Requires disk:/ preceding the directory name.
recursive
Lists a local directory or filename recursively.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
Example 1
acs/admin# dirDirectory of disk:/16384 Jul 02 2008 08:34:49 lost+found/4096 Jul 16 2008 02:10:20 mytest/4096 Jul 11 2008 09:12:12 save-config/Usage for disk: filesystem49741824 bytes total used6815842304 bytes free7233003520 bytes availableacs/admin#Example 2
acs/admin# dir disk:/mytestDirectory of disk:/mytestUsage for disk: filesystem49741824 bytes total used6815842304 bytes free7233003520 bytes availableacs/admin#Example 3
acs/admin# dir recursiveDirectory of disk:/4096 Jul 16 2008 02:10:20 mytest/16384 Jul 02 2008 08:34:49 lost+found/4096 Jul 11 2008 09:12:12 save-config/Directory of disk:/mytestNo files in directoryDirectory of disk:/lost+foundNo files in directoryDirectory of disk:/save-config555 Jul 11 2008 09:12:12 running-configUsage for disk: filesystem49741824 bytes total used6815842304 bytes free7233003520 bytes availableRelated Commands
exit
To close an active terminal session by logging out of the ACS server or to move up one mode level from the Configuration mode, use the exit command in the EXEC mode.
exit
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Use the exit command in EXEC mode to exit an active session (log out of the ACS server) or to move up from the Configuration mode.
Examples
acs/admin# exitRelated Commands
Exits the Configuration mode.
Exits the Configuration mode or EXEC mode.
Ctrl-z
Exits the Configuration mode.
forceout
To force users out of an active terminal session by logging them out of the ACS server, use the forceout command in the EXEC mode.
forceout username
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Use the forceout command in EXEC mode to force a user from an active session.
Examples
acs/admin# forceout user1halt
To shut down and power off the system, use the halt command in EXEC mode.
halt
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Before you run the halt command, ensure that ACS is not performing any backup, restore, installation, upgrade, or remove operation. If you run the halt command while ACS is performing any of these operations, you will get one of the following warning messages:
WARNING: A backup or restore is currently in progress! Continue with halt?WARNING: An install/upgrade/remove is currently in progress! Continue with halt?If you get any of these warnings, enter YES to halt the operation, or enter NO to cancel the halt.
If no processes are running when you use the halt command or you enter YES in response to the warning message displayed, ACS asks you to respond to the following option:
Do you want to save the current configuration ?Enter YES to save the existing ACS configuration. ACS displays the following message:
Saved the running configuration to startup successfullyExamples
acs/admin# haltacs/admin#Related Commands
help
To describe the interactive help system for the ACS server, use the help command in the EXEC mode.
help
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
All configuration modes
Usage Guidelines
The help command provides a brief description of the context-sensitive help system. To:
•
•
•
Examples
acs/admin# helpHelp may be requested at any point in a command by entering a question mark '?'. If nothing matches, the help list will be empty and you must backup until entering a '?' shows the available options.Two styles of help are provided:1. Full help is available when you are ready to enter a command argument (e.g. 'show ?') and describes each possible argument.2. Partial help is provided when an abbreviated argument is entered and you want to know what arguments match the input (e.g. 'show pr?'.)acs/admin#mkdir
To create a new directory on the ACS server, use the mkdir command in the EXEC mode.
mkdir directory-name [disk:/path]
Syntax Description
directory-name
Name of the directory to create. Use disk:/path with the directory name. This can be a maximum of 80 alphanumeric characters.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Use disk:/path with the directory name; otherwise, an error indicating that the disk:/path must be included appears.
Examples
acs/admin# mkdir disk:/test/acs/admin# dirDirectory of disk:/16384 Jun 28 2007 00:09:50 lost+found/4096 Jun 28 2007 14:34:27 test/Usage for disk: filesystem88150016 bytes total used44585803776 bytes free47064707072 bytes availableacs/admin#Related Commands
nslookup
To look up the hostname of a remote system on the ACS server, use the nslookup command in the EXEC mode.
nslookup word
Syntax Description
word
IPv4 address or hostname of a remote system. This can be a maximum of 64 alphanumeric characters.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
Example 1
acs/admin# nslookup 1.2.3.4Trying "4.3.2.1.in-addr.arpa"Host 4.3.2.1.in-addr.arpa not found: 3(NXDOMAIN) Received 105 bytes from 209.165.200.225#53 in 5 msExample 2
acs/admin# nslookup 209.165.200.225Trying "225.200.165.209.in-addr.arpa";; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15007 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2;; QUESTION SECTION:;225.200.165.209.in-addr.arpa. IN PTR;; ANSWER SECTION:225.200.165.209.in-addr.arpa. 86400 IN PTR ACS.cisco.com.;; AUTHORITY SECTION:165.209.in-addr.arpa. 86400 IN NS ns2.cisco.com.165.209.in-addr.arpa. 86400 IN NS ns1.cisco.com.;; ADDITIONAL SECTION:ns1.cisco.com. 86400 IN A 209.165.200.225ns2.cisco.com. 86400 IN A 209.165.200.225Received 146 bytes from 172.69.2.133#53 in 5 msacs/admin#ping
To diagnose basic network connectivity to a remote system, use the ping command in the EXEC mode.
ping {ip-address | hostname}[df df] [packetsize packetsize] [pingcount pingcount]
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
The ping command sends an echo request packet to an address, then awaits a reply. The ping output can help you evaluate path-to-host reliability, delays over the path, and whether you can reach a host.
Examples
acs/admin# ping 172.16.0.1 df 2 packetsize 10 pingcount 2PING 172.16.0.1 (172.16.0.1) 10(38) bytes of data.18 bytes from 172.16.0.1: icmp_seq=0 ttl=40 time=306 ms18 bytes from 172.16.0.1: icmp_seq=1 ttl=40 time=300 ms--- 172.16.0.1 ping statistics ---2 packets transmitted, 2 received, 0% packet loss, time 1001msrtt min/avg/max/mdev = 300.302/303.557/306.812/3.255 ms, pipe 2acs/admin#reload
To reload the ACS operating system, use the reload command in the EXEC mode.
reload
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
The reload command halts the system. Use the command after you enter configuration information into a file and save it to the startup configuration.
Before you run the reload command, ensure that ACS is not performing any backup, restore, installation, upgrade, or remove operation. If ACS performs any of these operations and you try to run the reload command, you will see any of the following warning messages:
WARNING: A backup or restore is currently in progress! Continue with reload?WARNING: An install/upgrade/remove is currently in progress! Continue with reload?If you get any of these warnings, enter YES to halt the operation, or enter NO to cancel the halt.
If no processes are running when you use the reload command or you enter YES in response to the warning message displayed, ACS asks you to respond to the following option:
Do you want to save the current configuration ?Enter YES to save the existing ACS configuration. ACS displays the following message:
Saved the running configuration to startup successfullyExamples
acs/admin# reloadContinue with reboot? [y/n] yBroadcast message from root (pts/0) (Tue Oct 7 23:01:46 2008):The system is going down for reboot NOW!acs/admin#Related Commands
restore
To perform a restore of a previous backup, use the restore command in the EXEC mode. A restore operation restores data related to ACS as well as the ADE OS. To remove this function, use the no form of this command.
restore filename repository repository-name
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
When you use this command for ACS, the ACS server reboots automatically.
Examples
acs/admin# restore backup1.tar.gpg repository repository1acs/admin#Related Commands
rmdir
To remove an existing directory, use the rmdir command in the EXEC mode.
rmdir word
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# mkdir disk:/test/acs/admin# dirDirectory of disk:/16384 Jun 28 2007 00:09:50 lost+found/4096 Jun 28 2007 14:34:27 test/Usage for disk: filesystem88150016 bytes total used44585803776 bytes free47064707072 bytes available CAM/admin#acs/admin# rmdir disk:/testacs/admin# dirDirectory of disk:/16384 Jun 28 2007 00:09:50 lost+found/Usage for disk: filesystem88145920 bytes total used44585807872 bytes free47064707072 bytes available CAM/admin#Related Commands
show
To show the running system information, use the show command in the EXEC mode. For detailed information on all the ACS show commands, see Show Commands.
show keyword
Syntax Description
Table 3-5 provides a summary of the show commands.
Table 3-5 Summary of Show Commands
(requires keyword)2
Displays information about the installed application; for example, status or version.
(requires keyword)
Displays information about the backup.
(requires keyword)
Displays information about the enabled Cisco Discovery Protocol (CDP) interfaces.
Displays the day, date, time, time zone, and year of the system clock.
Displays CPU information.
Displays file-system information of the disks.
Displays statistics for all the interfaces configured on the ADE OS 1.0.2 system.
(requires keyword)
Displays system logging information.
(requires keyword)
Displays login history.
Displays memory usage by all running processes.
Displays the status of the Network Time Protocol (NTP).
Displays all the processes listening on the active ports.
Displays information about the active processes of the ACS server.
(requires keyword)
Displays the file contents of a specific repository.
(requires keyword)
Displays restore history on the ACS server.
Displays the contents of the currently running configuration file on the ACS server.
Displays the contents of the startup configuration on the ACS server.
Displays system and configuration information that you can provide to the Cisco Technical Assistance Center (TAC) when reporting a problem.
Displays information about the terminal configuration parameter settings for the current terminal line.
Displays the time zone of the ACS server.
Displays all the time zones available for use on the ACS server.
Displays information about the system's Unique Device Identifier (UDI).
Displays how long the system you are logged in to has been up and running.
Displays information for currently logged in users.
Displays information for specific IP addresses, network masks or protocols.
1 The commands in this table require that the show command precedes a keyword; for example, show application.
2 Some show commands require an argument or variable after the keyword to function; for example, show application version. This show command displays the version of the application installed on the system (see show application).
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
All show commands require at least one keyword to function.
Examples
acs/admin# show application<name> <Description>acs Cisco ACS 5.3acs/admin#shutdown
To shut down an interface, use the shutdown command in the interface configuration mode. To disable this function, use the no form of this command.
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
Interface Configuration
Usage Guidelines
When you shut down an interface using this command, you lose connectivity to the CSACS-1121 appliance through that interface (even though the appliance is still powered on). However, if you have configured the second interface on the appliance with a different IP and have not shut down that interface, you can access the appliance through that second interface.
To shut down an interface, you can also modify the ifcfg-eth[0,1] file, located at /etc/sysconfig/network-scripts, using the ONBOOT parameter:
•
•
You can also use the no shutdown command to enable an interface.
Examples
acs/admin(config)# interface GigabitEthernet 0acs/admin(config-GigabitEthernet)# shutdownRelated Commands
Configures an interface type and enters the interface mode.
ip address (interface configuration mode)
Sets the IP address and netmask for the Ethernet interface.
Displays information about the system IP interfaces.
Sets the IP address of the default gateway of an interface.
ssh
To start an encrypted session with a remote system, use the ssh command in the EXEC mode.
Note
ssh <host ip-address | hostname> <username> port <port number> version <version number>
or
ssh delete host <host ip-address | hostname>
Syntax Description
Defaults
Disabled.
Command Modes
EXEC (Admin or Operator)
Usage Guidelines
The ssh command enables a system to make a secure, encrypted connection to another remote system or server. This connection provides functionality similar to that of an outbound Telnet connection except that the connection is encrypted. With authentication and encryption, the SSH client allows for secure communication over an insecure network.
Examples
Example 1
acs/admin# ssh delete host <ipaddress or hostname>acs/admin#Example 2
acs/admin# ssh acs2 adminadmin@acs2's password:Last login: Wed Jul 11 05:53:20 2008 from ACS.cisco.comacs2/admin#tech
To dump a Transmission Control Protocol (TCP) package to the console, use the tech command in the EXEC mode.
tech {dumptcp} gigabit-ethernet
Syntax Description
Defaults
Disabled.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# tech dumptcp 0140816:141088(272) ack 1921 win 1414408:26:12.034630 IP ACS.cisco.com.ssh > dhcp-64-102-82-153.cisco.com.2221: P 141088:141248(160) ack 1921 win 1414408:26:12.034635 IP dhcp-64-102-82-153.cisco.com.2221 > ACS.cisco.com.ssh: . ack 139632 win 6465608:26:12.034677 IP ACS.cisco.com.ssh > dhcp-64-102-82-153.cisco.com.2221: P 141248:141520(272) ack 1921 win 1414408:26:12.034713 IP ACS.cisco.com.ssh > dhcp-64-102-82-153.cisco.com.2221: P 141520:141680(160) ack 1921 win 1414408:26:12.034754 IP ACS.cisco.com.ssh > dhcp-64-102-82-153.cisco.com.2221: P 141680:141952(272) ack 1921 win 1414408:26:12.034756 IP dhcp-64-102-82-153.cisco.com.2221 > ACS.cisco.com.ssh: . ack 140064 win 6552008:26:12.034796 IP ACS.cisco.com.ssh > dhcp-64-102-82-153.cisco.com.2221: P 141952:142112(160) ack 1921 win 141441000 packets captured1000 packets received by filter0 packets dropped by kernelacs/admin#telnet
To log in to a host that supports Telnet, use the telnet command in Operator (user) or EXEC mode.
telnet [ip-address | hostname] port number
Syntax Description
Defaults
No default behavior or values.
Command Modes
Operator
EXEC
Usage Guidelines
None.
Examples
acs/admin# telnet 172.16.0.11 port 23ACS.cisco.com login: adminpassword:Last login: Mon Jul 2 08:45:24 on ttyS0acs/admin#terminal length
To set the number of lines on the current terminal screen for the current session, use the terminal length command in the EXEC mode.
terminal length integer
Syntax Description
integer
Number of lines on the screen. Contains between 0 to 511 lines, inclusive. A value of zero (0) disables pausing between screens of output.
Defaults
24 lines
Command Modes
EXEC
Usage Guidelines
The system uses the length value to determine when to pause during multiple-screen output.
Examples
acs/admin# terminal length 0acs/admin#terminal session-timeout
To set the inactivity timeout for all sessions, use the terminal session-timeout command in the EXEC mode.
terminal session-timeout minutes
Syntax Description
minutes
Sets the number of minutes for the inactivity timeout. From 0 to 525,600. Zero (0) disables the timeout.
Defaults
30 minutes
Command Modes
EXEC
Usage Guidelines
Setting the terminal session-timeout command to zero (0) results in no timeout being set.
Examples
acs/admin# terminal session-timeout 40acs/admin#Related Commands
terminal session-welcome
To set a welcome message on the system for all users who log in to the system, use the terminal session-welcome command in EXEC mode.
terminal session-welcome string
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Specify a message using up to 2,048 characters.
Examples
acs/admin# terminal session-welcome Welcomeacs/admin#Related Commands
terminal terminal-type
To specify the type of terminal connected to the current line for the current session, use the terminal terminal-type command in EXEC mode.
terminal terminal-type type
Syntax Description
type
Defines the terminal name and type, and permits terminal negotiation by hosts that provide that type of service. This can be a maximum of 80 alphanumeric characters.
Defaults
VT100
Command Modes
EXEC
Usage Guidelines
Indicate the terminal type if it is different from the default of VT100.
Examples
acs/admin# terminal terminal-type vt220acs/admin#traceroute
To discover the routes that packets take when traveling to their destination address, use the traceroute command in EXEC mode.
traceroute [ip-address | hostname]
Syntax Description
ip-address
IP address of the remote system. This can be a maximum of 32 alphanumeric characters.
hostname
Hostname of the remote system. This can be a maximum of 32 alphanumeric characters.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# traceroute 172.16.0.1traceroute to 172.16.0.1 (172.16.0.1), 30 hops max, 38 byte packets1 172.16.0.1 0.067 ms 0.036 ms 0.032 msacs/admin#undebug
To disable debugging functions, use the undebug command in EXEC mode.
undebug {all | application | backup-restore | cdp | config | copy | locks | logging | snmp | system | transfer | user | utils} level
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# undebug allacs/admin#Related Commands
write
To copy, display, or erase ACS server configurations, use the write command with the appropriate argument in the EXEC mode.
write {erase | memory | terminal}
Syntax Description
erase
Erases the startup-configuration.
memory
Copies running-configuration to startup-configuration.
terminal
Copies the running-configuration to console.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
Example 1
acs/admin# write memoryGenerating configuration...acs/admin#Example 2
acs/admin# write terminalGenerating configuration...!hostname ACS!ip domain-name cisco.com!interface GigabitEthernet 0ip address 209.165.200.225 255.255.255.224!interface GigabitEthernet 1shutdown!ip name-server 209.165.201.1!ip default-gateway 209.165.202.129!clock timezone UTC!username admin password hash $1$UMCQIJy1$8Z.9tkpO1QzCo4zyc1jso0 role admin!service sshd!password-policylower-case-requiredupper-case-requireddigit-requiredno-usernamedisable-cisco-passwordsmin-password-length 6!logging localhostlogging loglevel 6!acs/admin#Show Commands
Each show command includes a brief description of its use, command syntax, usage guidelines, and sample output.
Table 3-6 lists the Show commands in the EXEC mode that this section describes.
Table 3-6 List of EXEC Show Commands1
•
•
1 Commands marked with an asterisk (*) represent those that are specific to ACS functionality.
2 The show application status acs and show application version acs commands are specific to ACS.
show acs-config-web-interface
To see whether an interface is disabled or enabled for ACS configuration web, use the show acs-config-web-interface command in the EXEC mode.
show acs-config-web-interface
Syntax Description
No arguments or keywords.
Defaults
The interface for ACS configuration web is enabled by default.
Command Modes
EXEC
Usage Guidelines
None.
Examples
Example 1
acs/admin# show acs-config-web-interfacemigration interface is enableducp interface is disabledview interface is disabledRelated Commands
show acs-cores
To display the list of ACS run-time core files and Java Virtual Machine (JVM) core logs, use the show acs-cores command in the EXEC mode.
show acs-cores [details]
Syntax Description
Defaults
The ACS core files are located at /opt/CSCOacs/runtime/core and the JVM core logs are located at /hs_err_pid.
Command Modes
EXEC
Usage Guidelines
None.
Examples
Example 1
acs/admin# show acs-corescore.2464core.3535hs_err_pid12477.logacs/admin#Example 2
acs/admin# show acs-cores detailsFilesize (kb) Date Time Filename~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~4562 Nov 18 13:45 core.24646788 Nov 10 12:33 core.35351193 Apr 29 11:59 hs_err_pid12477.logacs/admin#Example 3
acs/admin# show acs-coresNo ACS core files existacs/admin#Related Commands
Deletes an ACS run-time core file or JVM core log.
Deletes an ACS run-time core file or JVM core log excluding the latest log.
Displays ACS server debug logs.
show acs-logs
To display ACS server debug logs, use the show acs-logs command in the EXEC mode.
show acs-logs {details | filename [filename]}
Syntax Description
details
Displays the modification time and size (in KB) for each log file. Also lists the available logfiles.
filename
Specifies a file whose contents you want to view.
filename
Name of the logfile (up to 255 characters) whose contents you want to view.
|
Output modifier variables:
•
•
|—Output modifier variables (see Table 3-8).
•
•
•
•
Defaults
The ACS logs are located at /opt/CSCOacs/logs, and include the logs displayed in Table 3-7:
The log files that are marked with an asterisk (*) are numbered and rolled over based on a configured maximum file size. Once a log file touches the configured limit, the data is rolled over to another file. The new files are named by suffixing the time stamp or sequential numbers to the log filename.
Using the show acs-logs and show acs-logs details commands, you can view the list of available logfiles. To view the contents of a specific logfile, use the show acs-logs filename filename command.
Command Modes
EXEC
Usage Guidelines
You can use this command when ACS is not running.
Examples
Example 1
acs/admin# show acs-logsACSADAgent.logACSManagementAudit.logACSManagement.logacsRuntime.logmonit.logMonitoringAndReportingAlert.logMonitoringAndReportingCollector.logMonitoringAndReportingDatabase.logMonitoringAndReportingProcess.logMonitoringAndReportingScheduler.logMonitoringAndReportingUI.logreportService.0.acs.2008Oct08_20_02_37_Pacific_Daylight_Time.0.logacsLocalStore.logcatalina.outacs/admin#Example 2
acs/admin# show acs-logs detailsFilesize (kb) Date Time Filename~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~26 Oct 7 19:32 ACSManagementAudit.log65 Oct 7 19:32 ACSManagement.log12 Oct 7 19:32 acsRuntime.log6 Oct 7 19:33 monit.log0 Oct 7 19:17 MonitoringAndReportingAlert.log2 Oct 7 19:34 MonitoringAndReportingCollector.log6 Oct 7 19:32 MonitoringAndReportingDatabase.log3 Oct 7 19:33 MonitoringAndReportingProcess.log0 Oct 7 19:17 MonitoringAndReportingScheduler.log0 Oct 7 19:18 MonitoringAndReportingUI.log0 Oct 8 20:02 reportService.0.acs.2008Oct08_20_02_37_Pacific_Daylight_Time.0.log8 Oct 7 19:32 acsLocalStore.log19 Oct 7 19:32 catalina.outacs/admin#Example 3
acs/admin# show acs-logs filename acsRuntime.logMessageBus,07/10/2008,19:16:40:569,ERROR,66497456,MessageBusSender::connect: unable to connect to the management;exception=Connection refused,MessageBusSender.cpp:131Handler,07/10/2008,19:17:35:273,WARN ,67550128,NIL-CONTEXT,Posture Server did not have any ca cert configured,PostureServerHandler.cpp:63Handler,07/10/2008,19:17:35:274,WARN ,67550128,NIL-CONTEXT,AcsNode does *not* have an Https Certificate,PostureServerHandler.cpp:100--More-- (press Spacebar to continue)Related Commands
Exports configuration data from an ACS local store to a remote repository.
Synchronizes the secondary ACS database to the primary ACS database.
show application
To show application information of the installed application packages on the system, use the show application command in the EXEC mode.
show application [status | version [app_name]]
Syntax Description
status
Displays the status of the installed application.
For ACS usage, the display includes whether the ACS is the primary or secondary, and the status of the services.
version
Displays the application version for an installed application—the ACS.
app_name
Name of installed application.
|
Output modifier variables:
•
•
|—Output modifier variables (see Table 3-8).
•
•
•
•
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Here is a list of various application status displayed and their interpretation.
Examples
Example 1
acs/admin# show application<name> <Description>acs ACS 5.3acs/admin#Example 2
acs/admin# show application version acsCisco ACS VERSION INFORMATION-----------------------------Version : 5.3.0Release : 100acs/admin#Example 3
acs/admin# show application status acsACS role: PRIMARYProcess 'database' runningProcess 'management' runningProcess 'runtime' runningProcess 'view-database' runningProcess 'view-jobmanager' runningProcess 'view-alertmanager' runningProcess 'view-collector' runningProcess 'view-logprocessor' runningacs/admin#Example 4
acs/admin# show application status acsACS role: PRIMARY"ACS is busy applying a recent configuration changerequiring enabling/disabling of processes.Status is unavailable.Please check again in a minute."acs/admin#This message appears when a set of processes change because of a view node selection or Active Directory configuration.
Example 5
acs/admin# show application status acsACS is not running.Issue 'application start acs' command to start ACS.acs/admin#Related Commands
Installs an application bundle.
Removes or uninstalls an application.
Starts or enables an application.
Stops or disables an application.
Upgrades an application bundle.
show backup history
To display the backup history of the system, use the show backup command in the EXEC mode.
show backup history
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
Example 1
acs/admin# show backup historyWed Jul 18 12:55:21 UTC 2007: backup logs logs-0718.tar.gz to repository fileserver007: successWed Jul 18 12:55:53 UTC 2007: backup full-0718.tar.gpg to repository fileserver007: successacs/admin#Example 2
acs/admin# show backup historybackup history is emptyRelated Commands
show cdp
To display information about the enabled CDP interfaces, use the show cdp command in the EXEC mode.
show cdp {all | neighbors}
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
Example 1
acs/admin# show cdp allCDP protocol is enabled ...broadcasting interval is every 60 seconds.time-to-live of cdp packets is 180 seconds.CDP is enabled on port GigabitEthernet0.acs/admin#Example 2
acs/admin# show cdp neighborsCDP Neighbor : acs-test2Local Interface : GigabitEthernet0Device Type : cisco WS-C3560G-48PSPort : GigabitEthernet0/36Address : 209.165.200.225acs/admin#Related Commands
show clock
To display the day, month, date, time, time zone, and year of the system software clock, use the show clock command in the EXEC mode.
show clock
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# show clockTue Oct 7 20:13:22 UTC 2008acs/admin#
Note
Related Commands
show cpu
To display CPU information, use the show cpu command in the EXEC mode.
show cpu [statistics] [|] [|]
Syntax Description
statistics
Displays CPU statistics.
|
Output modifier variables:
•
•
|—Output modifier variables (see Table 3-9).
•
•
•
•
|—Output modifier variables (see Table 3-9).
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
Example 1
acs/admin# show cpuprocessor : 0model : Intel(R) Core(TM)2 CPU 6400 @ 2.13GHzspeed(MHz): 2133.737cache size: 2048 KBprocessor : 1model : Intel(R) Core(TM)2 CPU 6400 @ 2.13GHzspeed(MHz): 2133.737cache size: 2048 KBacs/admin#Example 2
acs/admin# show cpu statisticsuser time: 8312kernel time: 3200idle time: 15510748i/o wait time: 5295irq time: 972acs/admin#Related Commands
Displays the system information of all disks.
Displays the amount of system memory that each system process uses.
show disks
To display file-system information about the disks, use the show disks command in the EXEC mode.
show disks [|] [|]
Syntax Description
|
Output modifier variables:
•
•
|—Output modifier variables (see Table 3-10).
•
•
•
•
|—Output modifier variables (see Table 3-10).
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Only platforms that have a disk file system support the show disks command.
Examples
acs/admin# show disksdisk: 1% used (48564 of 7063480)temp. space 2% used (35844 of 2031952)Internal filesystems:all internal filesystems have sufficient free spaceacs/admin#Related Commands
Displays CPU information.
Displays the amount of system memory that each system process uses.
show icmp-status
To display file-system information about the disks, use the show icmp_status command in EXEC mode.
show icmp_status {> file | |}
Syntax Description
>
Output direction.
file
Name of file to redirect standard output (stdout).
|
Output modifier commands:
•
•
–
•
•
•
•
–
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
Example 1
acs/admin# show icmp_statusicmp echo response is turned onacs/admin#Example 2
acs/admin# show icmp_statusicmp echo response is turned offacs/admin#Related Commands
show interface
To display the usability status of interfaces configured for IP, use the show interface command in the EXEC mode.
show interface [GigabitEthernet] |
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# show interfaceeth0 Link encap:Ethernet HWaddr 00:16:36:56:61:D2inet addr:209.165.200.225 Bcast:209.165.200.255 Mask:255.255.255.224inet6 addr: fe80::216:36ff:fe56:61d2/64 Scope:LinkUP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1RX packets:8783423 errors:0 dropped:0 overruns:0 frame:0TX packets:4178157 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:1000RX bytes:574274908 (547.6 MiB) TX bytes:268869567 (256.4 MiB)Interrupt:169eth1 Link encap:Ethernet HWaddr 00:16:36:56:61:D1inet6 addr: fe80::216:36ff:fe56:61d1/64 Scope:LinkUP BROADCAST MULTICAST MTU:1500 Metric:1RX packets:0 errors:0 dropped:0 overruns:0 frame:0TX packets:0 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:1000RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)Interrupt:177lo Link encap:Local Loopbackinet addr:209.165.201.1 Mask:255.255.255.224inet6 addr: ::1/128 Scope:HostUP LOOPBACK RUNNING MTU:16436 Metric:1RX packets:21617 errors:0 dropped:0 overruns:0 frame:0TX packets:21617 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:0RX bytes:3587148 (3.4 MiB) TX bytes:3587148 (3.4 MiB)sit0 Link encap:IPv6-in-IPv4NOARP MTU:1480 Metric:1RX packets:0 errors:0 dropped:0 overruns:0 frame:0TX packets:0 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:0RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)acs/admin#Related Commands
show inventory
To display information about the hardware inventory, including the ACS appliance model and serial number, use the show inventory command in the EXEC mode.
show inventory |
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# show inventoryNAME: "CSACS1120-K9 chassis", DESCR: "CSACS1120-K9 chassis"PID: CSACS1120-K9 , VID: V01 , SN: CAM12345678Total RAM Memory: 4149500 kBCPU Core Count: 2CPU 0: Model Info: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHzCPU 1: Model Info: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHzHard Disk Count(*): 2Disk 0: Device Name: /dev/sdaDisk 0: Capacity: 250.00 GBDisk 0: Geometry: 255 heads 63 sectors/track 30401 cylindersDisk 1: Device Name: /dev/sdbDisk 1: Capacity: 250.00 GBDisk 1: Geometry: 255 heads 63 sectors/track 30401 cylindersNIC Count: 2NIC 0: Device Name: eth0NIC 0: HW Address: 00:15:17:59:73:81NIC 0: Driver Descr: e1000: eth0: e1000_probe: Intel(R) PRO/1000 Network ConnectionNIC 1: Device Name: eth1NIC 1: HW Address: 00:15:17:59:73:82NIC 1: Driver Descr: e1000: eth1: e1000_probe: Intel(R) PRO/1000 Network Connection(*) Hard Disk Count may be Logical.acs/admin#show ip route
To display the route information for specific IP addresses, network masks or protocols, use the show ip route command in the EXEC mode.
show ip route |
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC.
Usage Guidelines
None.
Examples
acs/admin# show ip routeKernel IP routing tableDestination Gateway Genmask Flags Metric Ref Use Iface10.77.247.64 0.0.0.0 255.255.255.224 U 0 0 0 eth00.0.0.0 10.77.247.65 0.0.0.0 UG 0 0 0 eth0Related Commands
Sets the IP address and netmask for the Ethernet interface.
Configures the static routes.
show logging
To display the state of system logging (syslog) and the contents of the standard system logging buffer, use the show logging command in the EXEC mode.
show logging {application [application-name]} {internal} {system} |
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
This command displays the state of syslog error and event logging, including host addresses, and for which, logging destinations (console, monitor, buffer, or host) logging is enabled.
Examples
Example 1
acs/admin# show logging systemADEOS Platform log:-----------------Oct 7 13:24:41 localhost debugd[2050]: [2915]: config:network: main.c[238]: Setup is completeOct 7 13:24:51 localhost debugd[2050]: hangup signal caught, configuration readOct 7 13:24:51 localhost debugd[2050]: successfully loaded debug configOct 7 13:24:51 localhost debugd[2050]: [3482]: icmp: icmputils_cli.c[139]: Generating icmp echo response configOct 7 13:24:51 localhost debugd[2050]: [3482]: icmp: cars_icmpcfg.c[118]: Got the current ICMP Echo response config as : enabledOct 7 13:24:51 localhost debugd[2050]: [3482]: icmp: icmputils_cli.c[160]: Got ICMP echo config: onOct 7 13:24:51 localhost debugd[2050]: [3482]: icmp: icmputils_cli.c[167]: Finished icmp echo response config generationOct 7 13:24:51 localhost debugd[2050]: [3482]: logging: logutils_cli.c[233]: Generating logging configOct 7 13:24:51 localhost debugd[2050]: [3482]: logging: logutils_cli.c[253]: Got Logserver: localhostOct 7 13:24:51 localhost debugd[2050]: [3482]: logging: logutils_cli.c[261]: Got loglevel: 6--More-- (press Spacebar to continue)Example 2
acs/admin# show logging internallog server: localhostGlobal loglevel: 6Status: Enabledacs/admin#show logins
To display the state of system logins, use the show logins command in the EXEC mode.
show logins cli
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
Requires the cli keyword; otherwise, an error occurs.
Examples
acs/admin# show logins cliadmin pts/0 dhcp-64-102-82-1 Thu May 3 05:23 still logged inadmin pts/0 dhcp-64-102-82-1 Thu May 3 04:31 - 05:11 (00:39)admin pts/0 dhcp-64-102-82-1 Thu May 3 04:16 - 04:17 (00:00)admin pts/0 dhcp-64-102-82-1 Thu May 3 03:53 - 04:16 (00:22)wtmp begins Tue Oct 7 13:21:14 2008acs/admin#show memory
To display the memory usage of all the running processes, use the show memory command in the EXEC mode.
show memory
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# show memorytotal memory: 2074924 kBfree memory: 1687324 kBcached: 162984 kBswap-cached: 0 kBacs/admin#show ntp
To show the status of the Network Time Protocol (NTP) associations, use the show ntp command in the EXEC mode.
show ntp
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# show ntpPrimary NTP : 1.ntp.esl.cisco.comSecondary NTP : 2.ntp.esl.cisco.comsynchronised to NTP server (209.165.202.129) at stratum 2time correct to within 37 mspolling server every 128 sacs/admin#Related Commands
show ports
To display information about all the processes listening on active ports, use the show ports command in the EXEC mode.
show ports [|] [|]
Syntax Description
|
Output modifier variables:
•
•
|—Output modifier variables (see Table 3-12).
•
•
•
•
|—Output modifier variables (see Table 3-12).
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
When you run the show ports command, the port must have an associated active session.
Examples
acs/admin# show portsProcess : dbsrv10 (9253)tcp: 0.0.0.0:2638, :::2638Process : portmap (2615)tcp: 0.0.0.0:111udp: 0.0.0.0:111Process : dbsrv10 (10019)tcp: 0.0.0.0:43216, :::43216Process : rt_daemon (9450)tcp: 172.23.245.28:49udp: 0.0.0.0:32771, 0.0.0.0:1812, 0.0.0.0:1813, 0.0.0.0:1645, 0.0.0.0:1646Process : monit (6933)tcp: 127.0.0.1:2812Process : java (9756)tcp: :::2020, ::ffff:127.0.0.1:8005, :::6666, :::2030, :::61616, :::80, ::ffff:127.0.0.1:51515, :::443Process : sshd (2776)tcp: :::22Process : java (10023)udp: :::20514acs/admin#show process
To display information about active processes, use the show process command in the EXEC mode.
show process |
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
See Table 3-13 for process field descriptions.
acs/admin# show processUSER PID TIME TT COMMANDroot 1 00:00:00 ? initroot 2 00:00:00 ? migration/0root 3 00:00:00 ? ksoftirqd/0root 4 00:00:00 ? migration/1root 5 00:00:00 ? ksoftirqd/1root 6 00:00:00 ? events/0root 7 00:00:00 ? events/1root 8 00:00:00 ? khelperroot 9 00:00:00 ? kacpidroot 36 00:00:00 ? kblockd/0root 37 00:00:00 ? kblockd/1root 55 00:00:00 ? pdflushroot 58 00:00:00 ? aio/0root 59 00:00:00 ? aio/1root 38 00:00:00 ? khubdroot 57 00:00:00 ? kswapd0root 203 00:00:00 ? kseriodroot 320 00:00:00 ? ata/0root 321 00:00:00 ? ata/1root 325 00:00:00 ? scsi_eh_0root 326 00:00:00 ? scsi_eh_1--More-- (press Spacebar to continue)
show repository
To display the file contents of the repository, use the show repository command in the EXEC mode.
show repository repository-name
Syntax Description
repository-name
Name of the repository whose contents you want to view. This can be a maximum of 30 alphanumeric characters.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# show repository myrepositoryback1.tar.gpgback2.tar.gpgacs/admin#Related Commands
show restore
To display the restore history, use the show restore command in the EXEC mode.
show restore {history}
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
Example 1
acs/admin# show restore historyTue Sep 4 03:42:48 PDT 2008: restore 11backup_Local.File2.tar.gpg from repository executeBackupRepo: success Tue Sep 4 03:46:15 PDT 2008: restore 11backup_Local.File2.tar.gpg from repository executeBackupRepo: success Tue Sep 4 03:51:07 PDT 2008: restore 11backup_Local.File2.tar.gpg from repository executeBackupRepo: success Tue Sep 4 03:54:35 PDT 2008: restore 11backup_Local.File2.tar.gpg from repository executeBackupRepo: success Wed Sep 5 12:31:21 UTC 2008: restore cdromRestore.tar.gpg from repository cdrom1: success admin#acs/admin#Example 2
acs/admin# show restore historyrestore history is emptyacs/admin#Related Commands
show running-configuration
To display the contents of the currently running configuration file or the configuration, use the show running-configuration command in the EXEC mode.
show running-configuration
Syntax Description
No arguments or keywords.
Defaults
The show running-configuration command displays all of the configuration information.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# show running-configurationGenerating configuration...!hostname acs!ip domain-name cisco.com!interface GigabitEthernet 0ip address 209.165.200.225 255.255.255.224!interface GigabitEthernet 1shutdown!!clock timezone UTC!!username admin password groove role admin!service sshd!repository myrepositoryurl ftp://209.165.200.234/backupuser bubba password gump!password-policylower-case-requiredupper-case-requireddigit-requiredno-usernamedisable-cisco-passwordsmin-password-length 6!logging localhostlogging loglevel 6!cdp timer 60cdp holdtime 180cdp run GigabitEthernet 0!icmp echo on!acs/admin#Related Commands
Enters the Configuration mode.
Displays the contents of the startup configuration file or the configuration.
show startup-configuration
To display the contents of the startup configuration file or the configuration, use the show startup-configuration command in the EXEC mode.
show startup-configuration
Syntax Description
No arguments or keywords.
Defaults
The show startup-configuration command displays all of the startup configuration information.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# show startup-configurationGenerating configuration...!hostname acs!ip domain-name cisco.com!interface GigabitEthernet 0ip address 209.165.200.225 255.255.255.224!interface GigabitEthernet 1shutdown!!clock timezone UTC!!username admin password groove role admin!service sshd!repository myrepositoryurl ftp://209.165.200.234/backupuser bubba password gump!--More-- (press Spacebar to continue)Related Commands
Enters the Configuration mode.
Displays the contents of the currently running configuration file or the configuration.
show tech-support
To display technical support information, including e-mail, use the show tech-support command in the EXEC mode.
show tech-support file [word]
Syntax Description
file
Save any technical support data as a file in the local disk.
word
Filename to save. This can be a maximum of 80 alphanumeric characters.
Defaults
Passwords and other security information do not appear in the output.
Command Modes
EXEC
Usage Guidelines
The show tech-support command is useful for collecting a large amount of information about your ACS server for troubleshooting purposes. You can then provide output to technical support representatives when reporting a problem.
Examples
acs/admin# show tech-support###################################################Application Deployment Engine(ADE) - Release 1.0Technical Support Debug Info follows...###################################################*****************************************Checking dmidecode Serial Number(s)*****************************************0x0736C7F60x0736C8030x0736C8080x0736C81FAZAX74601334*****************************************Displaying System Uptime...*****************************************20:41:46 up 6:42, 1 user, load average: 0.45, 0.20, 0.12*****************************************Display Memory Usage(KB)*****************************************total used free shared buffers cachedMem: 4148032 2951612 1196420 0 59440 1873920-/+ buffers/cache: 1018252 3129780Swap: 8191992 0 8191992*****************************************Displaying Processes(ax --forest)...*****************************************PID TTY STAT TIME COMMAND1 ? S 0:00 init [3]2 ? S 0:00 [migration/0]3 ? SN 0:00 [ksoftirqd/0]4 ? S 0:00 [migration/1]5 ? SN 0:00 [ksoftirqd/1]--More--(Press Enter or Spacebar.)Related Commands
Displays the usability status of the interfaces.
Displays information about active processes.
Displays the contents of the current running configuration.
show terminal
To obtain information about the terminal configuration parameter settings, use the show terminal command in the EXEC mode.
show terminal
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# show terminalTTY: /dev/pts/0 Type: "vt100"Length: 25 lines, Width: 80 columnsSession Timeout: 30 minutesacs/admin#Table 3-14 describes the fields of the show terminal output.
show timezone
To display the time zone as set on the system, use the show timezone command in the EXEC mode.
show timezone
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# show timezoneUTCacs/admin#Related Commands
Sets the time zone on the system.
Displays the time zones available on the system.
show timezones
To obtain a list of time zones from which you can select, use the show timezones command in the EXEC mode.
show timezones
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
See clock timezone, for examples of the time zones available for the ACS server.
Examples
acs/admin# show timezonesPST8PDTHongkongEtc/GMT-7Etc/GMT-12Etc/GMT-4Etc/GMT-13Etc/GMT-11Etc/GMT-1Etc/GMT+5Etc/GMT-14Etc/GMT+11Etc/GMT+6Etc/ZuluEtc/GMT+7Etc/UniversalEtc/GMT-2Etc/GMT+10Etc/GMT-8Etc/GMT+8Etc/GMT+1Etc/GMT0Etc/GMT+9Etc/GMT+3Etc/GMT-3Etc/GMTEtc/GMT-5Etc/GMT-0Etc/GMT-6Etc/GMT+4Etc/GMT-9Etc/GMT+12Etc/GMT+2Etc/UCTEtc/GMT-10Etc/GMT+0Etc/GreenwichEtc/UTCPacific/Norfolk--More-- (Press Enter or Spacebar)Related Commands
show udi
To display information about the CSACS-1121's UDI, use the show udi command in the EXEC mode.
show udi
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
Example 1
acs/admin# show udiSPID: ADE-1010VPID: VO1Serial: 123455acs/admin#Example 2
acs/admin# sh udiSPID:: Cisco-VM-SPIDVPID: V01Serial: Cisco-VM-SNThis output appears when you run the show udi command on VMWare servers running VMWare ESXi 4.1.0.
show uptime
To display the length of time that you have been logged in to the ACS server, use the show uptime command in the EXEC mode.
show uptime |
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# show uptime4 day(s), 16:36:58acs/admin#show users
To display the list of users logged in to the ACS server, use the show users command in the EXEC mode.
show users
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
None.
Examples
acs/admin# show usersUSERNAME ROLE HOST TTY LOGIN DATETIMEadmin Admin 209.165.200.225 pts/0 Tue Oct 7 19:21:00 2008acs/admin#show version
To display information about the software version of the system, use the show version command in the EXEC mode.
show version
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Usage Guidelines
This command displays information about the ADE-OS 1.2 software version running on the ACS server, and the ACS version.
Examples
acs/admin# sh verCisco Application Deployment Engine OS Release: 1.2ADE-OS Build Version: 1.2.0.222ADE-OS System Architecture: i386Copyright (c) 2005-2008 by Cisco Systems, Inc.All rights reserved.Hostname: acsVersion information of installed applications---------------------------------------------Cisco ACS VERSION INFORMATION-----------------------------Version : 5.3.0.26Internal Build ID: B.570acs/admin#ACS Configuration Commands
Each ACS Configuration command includes a brief description of its use, command syntax, usage guidelines, and sample output.
To access the ACS Configuration mode, you must use the acs-config command in the EXEC mode.
This section describes the following Configuration commands.
•
•
•
access-setting accept-all
To reset the IP address filtering to allow any IP address to access the management pages of an ACS server, use the access-setting accept-all command in the ACS Configuration mode. Only the super admin has the privilege to use this command on a primary ACS node.
access-setting accept-all
Syntax Description
No arguments or keywords.
Defaults
None.
Command Modes
ACS Configuration
Usage Guidelines
Use the access-setting accept-all command when all system administrators' access to an ACS node through the GUI is blocked. This problem occurs when an administrator defines an access list that includes all IP addresses and blocks access to the GUI.
When you run this command, IP address filtering is set to allow all IP addresses to connect the management pages, but the IP addresses defined in the IP Ranges table to allow or reject the IP addresses to access the management pages are not reset; therefore, you can reuse this table to set IP address filtering.
Examples
acs/admin(config-acs)# access-setting accept-allaccess setting allows all IP addresses to connectacs/admin(config-acs)#acsview-db-compress
Use the acsview-db-compress command to compress the view database file size. This command compresses the ACS View database by rebuilding each table in the database and release the unused space. As a result, the physical size of the database is reduced.
acsview-db-compress
Syntax Description
No arguments or keywords.
Defaults
None.
Command Modes
ACS configuration
Usage Guidelines
ACS is stopped during database compression process. ACS restarts automatically after the database compression. Database compression takes time based on the database size. If the database size is large, then the compress happens in hours. This CLI command needs to executed only in Log Collector Server.
It is strongly recommended to execute this CLI only on maintenance hours as it requires restarting ACS services. The option to compress the view database is also mentioned in the description of one of the alerts that is sent when the view databasae reaches certain limit.
Examples
acs242-197/acsadmin(config-acs)# acsview-db-compressYou can chose to compress ACS View database. This operation will take more time if the size of the database is big. During this operation, ACS services will be stopped. Services will be started automatically when the compression is over. Do you want to continue (y/n)? Please wait till ACS services come back after the view db is compressed. Refer ADE.log for more details about the view db compress.acsview merge-from-supportbundle
Use the acsview merge-from-supportbundle command to merge the existing ACS view database with the information given in the specified support bundle.
acsview merge-from-supportbundle support-file-name
Syntax Description
support-file-name
Holds the support bundle file name which is to be merged with the existing ACS view database. This support bundle file should be present in the local disk.
Defaults
None.
Command Modes
ACS configuration
Usage Guidelines
ACS view services are stopped during the support bundle merge operation. ACS view services restart automatically after merge operation is successful.
You should copy the decrypted support bundle of the same version which we have specified in the support file name of the merge command including the patch version. You should copy this file using the copy command in CLI.
Examples
acs242-197/acsadmin(config-acs)# acsview merge-from-supportbundle clisupport.tar.gzDo you want to clean the data first?[y/n]Please wait till database merge operation is completed. Refer ADE.log for more details about the status.Related Commands
acsview rebuild-database
Use the acsview rebuild-database command to rebuild the database with the log information up to the specified number of days. If you specify to rebuild the database for 10 days, then ACS view database keeps only the last 10 days data and erases the remaining data.
acsview rebuild-database noofdays
Syntax Description
Defaults
None.
Command Modes
ACS configuration
Usage Guidelines
ACS view services are stopped during the database rebuild operation. ACS view services restart automatically after rebuild operation is successful.
You need to clean up the unwanted files and have enough disk space before executing the rebuild-database command in ACS view.
Examples
acs242-197/acsadmin(config-acs)# acsview rebuild-database 10This operation will take more time if the number of records are more in the database.During this operation,ACSview unloads the data for given number of days to localdisk or opt which one is having more space,Stops view services ,replaces with clean db,restart view services and reload the data.Do you want to continue (y/n)?Please wait till database reload operation is completed.Refer ADE.log for more details.Related Commands
acsview replace-clean-activesessionsdb
Use the acsview replace-clean-activesessionsdb command to clean up the active session information in the ACS view database. This command removes the active session information in the ACS view database.
acsview replace-clean-activesessionsdb
Syntax Description
No arguments or keywords.
Defaults
None.
Command Modes
ACS configuration
Usage Guidelines
ACS view services are stopped during database active sessions clean up process. ACS view services restart automatically after the active sessions clean up operation is successful.
Examples
acs242-197/acsadmin(config-acs)# acsview replace-clean-activesessionsdbacs242-197/acsadmin(config-acs)#Related Commands
acsview replace-cleandb
Use the acsview replace-cleandb command to clean up the information in the ACS view database. This command removes all data from the ACS view database. That is, this command replaces the current database with a fresh view database.
acsview replace-cleandb
Syntax Description
No arguments or keywords.
Defaults
None.
Command Modes
ACS configuration
Usage Guidelines
ACS view services are stopped during database clean up process. ACS view services restart automatically after the database clean up operation is successful.
Examples
acs242-197/acsadmin(config-acs)# acsview replace-cleandbacs242-197/acsadmin(config-acs)#Related Commands
acsview show-dbsize
Use the acsview show-dbsize command to display the physical and active size of the ACS view database. It also displays the physical size of the ACS view transaction log files.
acsview show-dbsize
Syntax Description
No arguments or keywords.
Defaults
None.
Command Modes
ACS configuration
Usage Guidelines
None.
Examples
acs242-197/acsadmin(config-acs)# acsview show-dbsizeActual DB Size (bytes) : 63692800Actual DB Size (GBs) :0.06Physical DB Size (bytes):64667648Physical DB Size (GBs) :0.06Physical ACSviewlog file Size (GBs) :0acs242-197/acsadmin(config-acs)#Related Commands
acsview truncate-log
Use the acsview truncate-log command to truncate the ACS view database transaction log messages.
acsview truncate-log
Syntax Description
No arguments or keywords.
Defaults
None.
Command Modes
ACS configuration
Usage Guidelines
None.
Examples
acs242-197/acsadmin(config-acs)# acsview truncate-logacs242-197/acsadmin(config-acs)#Related Commands
ad-agent-configuration
This command adds the parameter to the end of the file if the given parameter is not found in the Centrify Configuration File. There is no validity check on the parameters values
ad-agent-configuration parameter-name value
Syntax Description
parameter-name
Holds the parameter name which has to be added to the Centrify Configuration file.
value
Holds the value of the parameter to be added/modified.
Defaults
None.
Command Modes
ACS configuration
Usage Guidelines
You can use this command to add a new parameter or modify the value of the existing parameter value in the Centrify Configuration file. When you try to modify the value of the parameter, it will be uncommented if it is commented by default.
Examples
cd-acs5-13-74/acsadmin(config-acs)# ad-agent-configuration adclient.get.builtin.membership truePerforming AD agent internal setting modification is only allowed with ACS support approval. continue (y/n)?cd-acs5-13-74/acsadmin(config-acs)#output from file - adclient.get.builtin.membership: truead-agent-reset-configuration
To reset the ad agent configurations in the Centrify Configuration file to its default value, use the ad-agent-reset-configuration command.
ad-agent-reset-configuration
Syntax Description
No arguments or keywords
Defaults
None.
Command Modes
ACS configuration
Usage Guidelines
Use this command when you want to rest the configuration of an ad agent in the Centrify Configuration file to its default value.
Examples
cd-acs5-13-74/acsadmin(config-acs)# ad-agent-reset-configurationPerforming reset of AD agent configuration , AD agent will be restarted. continue (y/n)?cd-acs5-13-74/acsadmin(config-acs)#You have to open the file manually to check the configuration chagnes.
debug-adclient
To enable debug logging for an Active Directory client, use the debug-adclient command in the ACS Configuration mode. To disable debug logging for an Active Directory client, use the no form of this command. Only the network-device admin can enable or disable debug logging for an Active Directory client.
debug-adclient enable
Syntax Description
No arguments or keywords.
Defaults
Disabled.
Command Modes
ACS Configuration
Usage Guidelines
When you set the log level of debug logs to DEBUG for the following components, the active directory client logs are automatically enabled. Similarly, when you disable the DEBUG log level on one of these components, the active directory logs are disabled:
•
•
•
•
Examples
acs/admin(config-acs)# debug-adclient enableacs/admin(config-acs)#Related Commands
debug-log
To set the local debug logging level for all or specific ACS components, use the debug-log command in the ACS Configuration mode. Any user, irrespective of role, can run this command.
debug-log {component | all} level {debug | info | warn | error | fatal | none}
Syntax Description
Defaults
All ACS debug logging is set to warn.
Command Modes
ACS Configuration
Usage Guidelines
You can select any of the following options (including suboptions) as a component:
•
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
•
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
The debug logging configuration remains in effect even after a reboot. To reconfigure, use the debug-log command again or the no debug-log command.
When you set the log level of debug logs to DEBUG for the following components, the active directory client logs are automatically enabled. Similarly, when you disable the DEBUG log level on one of these components, the active directory logs are disabled:
•
•
•
•
Examples
acs/admin(config-acs)# debug-log mgmt level warnacs/admin(config-acs)#Related Commands
export-data
To export the configuration data from an ACS local store to a remote repository, use the command export-data in the ACS Configuration mode. Only users who have Read permission to a specific configuration object in the GUI can export that specific configuration data to a remote repository.
export-data {user | host | device | idgroup | ndg | dacl | cmdset} repository file-name result-file-name {full secret-phrase | none | only-sec-repo | only-sec-files secret-phrase}
Syntax Description
Defaults
None.
Command Modes
ACS Configuration
Usage Guidelines
When you run this command, the ACS server starts a process to export the configuration data from the local ACS node to the specified remote repository and provides you a unique process ID to track the progress of the export operation. Use the import-export-status command to learn the status of export operations.
If the export process violates the security constraints defined in the security type parameters (full, none, only-sec-repo, and only-sec-files), the ACS server returns a validation error similar to the following:
Repository 'ftp01' has low security levelThe export-data command is asynchronous, which allows you to execute other CLI commands when the export operation is in progress.
Examples
acs/admin(config-acs)# export-data user repostiory01 file01 resultfile01 full passwordExport process Id is: 1acs/admin(config-acs)#Related Commands
import-data
To update, delete, or add an ACS configuration data to the ACS local store from the import file of the remote repository, use the command import-data in the ACS Configuration mode. Only users who have CRUD permissions to a specific configuration object in the GUI can import that particular configuration data to an ACS local store.
import-data {update | delete | add} {user | host | device | idgroup | ndg | dacl | cmdset} repository file-name result-file-name {abort-on-error | cont-on-error} {full secret-phrase | none | only-sec-repo | only-sec-files secret-phrase}
Syntax Description
Defaults
None.
Command Modes
ACS Configuration
Usage Guidelines
When you run this command, the ACS server starts a process to import the ACS configuration data to the local ACS node from the specified remote repository and provides you a unique process ID to track the progress of the import operation. Use the import-export-status command to learn the status of import operations.
If the import process violates the security constraints defined in the security type parameters (full, none, only-sec-repo, and only-sec-files), the ACS server returns a validation error similar to the following:
Repository 'ftp01' has low security levelExamples of a few failure error messages:---2010-12-02 21:48:16: Import StartedDate,Line,Failure2010-12-02 21:48:17,1,Object name: 000E8F5C0193 already exists2010-12-02 21:48:17: Import: Completed with errors------2010-12-02 21:01:08: Import StartedDate,Line,Failure2010-12-02 21:01:08,0,object 000E8F5C0191 not found.2010-12-02 21:01:08: Import: Completed with errors---The import-data command is asynchronous, which allows you to execute other CLI commands when the import operation is in progress.
Examples
acs/admin(config-acs)# import-data add user repository01 file01 resultfile01 abort-on-error full passwordImport process Id is: 2acs/admin(config-acs)#Related Commands
import-export-abort
To abort currently running, queued, or all import and export processes, use the import-export-abort command in the ACS Configuration mode. Only the super admin can simultaneously abort a running process and all pending import and export processes.
However, a user who owns a particular import or export process can abort that particular process by using the process ID, or by stopping the process when it is in progress.
import-export-abort {running | all | id id}
Syntax Description
Defaults
None.
Command Modes
ACS Configuration
Usage Guidelines
None.
Examples
Example 1
acs/admin(config-acs)# import-export-abort runningAborted process ID #5acs/admin(config-acs)#Example 2
acs/admin(config-acs)# import-export-abort runningNo running processes.acs/admin(config-acs)#Example 3
acs/admin(config-acs)# import-export-abort allAborted process ID #20, 50 pending processes are removed.acs/admin(config-acs)#Example 4
acs/admin(config-acs)# import-export-abort id 3Removed pending process ID #3 from queue.acs/admin(config-acs)#Example 5
acs/admin(config-acs)# import-export-abort id 201No such process ID #201.acs/admin(config-acs)#Related Commands
import-export-status
To view the status of running import and export processes and to verify whether there are any pending processes, use the import-export-status command in the ACS Configuration mode. Any user, irrespective of role, can run this command.
import-export-status {current | all | id id}
Syntax Description
Defaults
None.
Command Modes
ACS Configuration
Usage Guidelines
None.
Examples
Example 1
acs/admin(config-acs)# import-export-status current20 out of 30 records are processed, 0 failed.[]acs/admin(config-acs)#Example 2
acs/admin(config-acs)# import-export-status id 3Process id# 3 completed; 10 out of 10 records are processed, 0 failed.[]acs/admin(config-acs)#Example 3
acs/admin(config-acs)# import-export-status id 4Process id# 3 is pending; its number in the pending queue is 8.acs/admin(config-acs)#Example 4
acs/admin(config-acs)# import-export-status allProcess id# is running; 10 out of 10 records are processed, 0 failed; 0 are pending.acs/admin(config-acs)#Example 5
acs/admin(config-acs)# import-export-status allNo process is running.acs/admin(config-acs)#Related Commands
no ad-agent-configuration
This command comment out the lines which contains the parameter name.
no ad-agent-configuration parameter name
Syntax Description
.
Defaults
None.
Command Modes
ACS Configuration
Usage Guidelines
You can use this command to comment out the lines which contains the given parameter name.
Examples
Example 1 - Using a specific parameter name1) cd-acs5-13-74/acsadmin(config-acs)# no ad-agent-configuration adclient.get.builtin.membershipPerforming AD agent internal setting modification is only allowed with ACS support approval. continue (y/n)?cd-acs5-13-74/acsadmin(config-acs)#output from Centrify.conf file - # adclient.get.builtin.membership: trueExample 2- Using Wildcard charactercd-acs5-13-74/acsadmin(config-acs)# no ad-agent-configuration adclient.get.builtin.membership ?value value.<cr>cd-acs5-13-74/acsadmin(config-acs)#no debug-adclient
To disable debug logging for an Active Directory client, use the no debug-adclient command in the ACS Configuration mode. Only the network-device admin can enable or disable debug logging for an Active Directory client.
no debug-adclient enable
Syntax Description
No arguments or keywords.
Defaults
Disabled.
Command Modes
ACS Configuration
Usage Guidelines
None.
Examples
acs/admin(config-acs)# no debug-adclient enableacs/admin(config-acs)#Related Commands
no debug-log
To return debug logging to the default configuration for all components or specific ACS components, use the no debug-log command in the ACS Configuration mode. Any user, irrespective of role, can run this command.
no debug-log {component | all} [level [debug | info | warn | error | fatal | none]]
Syntax Description
component
Selects local debug logging on the components you want, where component can be any of the components described in the Usage Guidelines.
all
Selects local debug logging on all components.
Defaults
All debug logging is disabled.
Command Modes
ACS Configuration
Usage Guidelines
You can select any of the following as a component:
•
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
•
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
Examples
acs/admin(config-acs)# no debug-log allRelated Commands
replication force-sync
To synchronize the ACS database (configuration information) of a secondary ACS with the database of the primary ACS, use the replication force-sync command in the ACS Configuration mode. Only the super admin or system admin can run this command on a secondary ACS node.
replication force-sync
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
ACS Configuration
Usage Guidelines
You can use this command only on a secondary ACS. If you use this command on the primary ACS, this message appears:
Replication synchronization must be done on a SECONDARY instance.This command stops the ACS application, which remains unavailable for the duration of the synchronization process. The duration of the synchronization process depends on the size of the ACS database—it could take a significant amount of time to complete. Ensure that you use this command when you do not need to access your ACS.
ACS restarts after the primary-to-secondary synchronization is complete.
Examples
acs/admin(config-acs)# replication force-syncSuccess.Related Commands
replication status
To check the replication status ACS database (configuration information), use the command replication status.
replication staus
Syntax Description
No arguments or keywords.
Defaults
None
Command Modes
ACS Configuration
Usage Guidelines
You can use this command to check the replication status of the ACS database.
Examples
acs205/acsadmin(config-acs)# replication_statusRelated Commands
reset-management-interface-certificate
To reset the management interface certificate to a default self-signed certificate, use the reset-management-interface-certificate command in the ACS Configuration mode. Only the super admin and system admin can run this command.
reset-management-interface-certificate
Syntax Description
No arguments or keywords.
Defaults
None.
Command Modes
ACS Configuration
Usage Guidelines
run this command when you assign an invalid GUI certificate for the management interface and your login to ACS GUI is denied, or when you want to reset the existing management interface certificate to the default self-signed certificate.
When you run this command, the ACS server performs the following process:
1.
a.
The disconnected invalid certificate remains in the database.
b.
c.
2.
a.
b.
c.
In the subject name of the certificate host--reset, host refers to the ACS server name. If the hostname is lnx-01, then the certificate's subject name would be lnx-01--reset.
Examples
Example 1 - Success
acs/admin(config-acs)# reset-management-interface-certificateResetting ACS Management Interface Certificate...Management Interface Certificate Reset Completed.acs/admin(config-acs)#Example 2 - Failure
acs/admin(config-acs)# reset-management-interface-certificateResetting ACS Management Interface Certificate...Failed to Reset Management Interface Certificate.See the logs for more detailsacs/admin(config-acs)#show ad-agent-configuration
This command print the lines of the Centrify Configuration file which contain the given parameter name in it.
show-ad-agent-configuration parameter-name
Syntax Description
Defaults
None.
Command Modes
ACS configuration
Usage Guidelines
You can use this command to query for the lines which contain the given parameter name in it.
when you query for a specific parameter, all the instances which contains the given parameter name in the file will be displayed in the output.
Examples
cd-acs5-13-74/acsadmin(config-acs)# show ad-agent-configuration adclient.get.builtin.membership#adclient.get.builtin.membership: false# adclient.get.builtin.membership: falseshow debug-adclient
To display the debug logging status for an Active Directory client, use the show debug-adclient command in the ACS Configuration mode. Any user, irrespective of role, can run this command.
show debug-adclient
Syntax Description
No arguments or keywords.
Defaults
Disabled.
Command Modes
ACS Configuration
Usage Guidelines
None.
Examples
acs/admin(config-acs)# show debug-adclientActive Directory client debug is disabledRelated Commands
show debug-log
To display the local debug logging status for all components or for specific ACS components, use the show debug-log command in the ACS Configuration mode. Any user, irrespective of role, can run this command.
show debug-log [component | all]
Syntax Description
Defaults
All ACS debug logging is set to warn.
Command Modes
ACS Configuration
Usage Guidelines
You can select any of the following (including the suboptions) as a component:
•
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
•
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
Examples
ACS/admin(config-acs)# sh debug-log mgmtmgmt warnmgmt-acsview warnACS/admin(config-acs)# sh debug-log runtimeruntime warnACS/admin(config-acs)# sh debug-log mgmt-acsviewmgmt-acsview warnRelated Commands
database-compress
To reduce the ACS database size by removing unused disk space from within ACS database file use the database-compress command in the ACS Configuration mode. This command has the option to truncate ACS transaction history.
This command does not erase or modify any information during the database compression except for the transaction history if the truncate flag is used.
When you run this command, ACS is stopped and the process of compressing ACS database is executed and ACS starts automatically after the process is over.
The progress of the command execution is logged in the ADE.log file.
database-compress [truncate_log]
Syntax Description
Defaults
None
Command Modes
ACS Configuration
Usage Guidelines
None
Examples
acs/admin(config-acs)# database-compressRelated Commands
Configuration Commands
Each Configuration command includes a brief description of its use, command syntax, usage guidelines, and sample output.
Configuration commands include interface and repository.
Note
To access the Configuration mode, you must use the configure command in the EXEC mode.
Table 3-15 lists the Configuration commands that this section describes.
backup-staging-url
To allow you to configure a Network File System (NFS) location that backup and restore operations will use as a staging area to package and unpackage backup files, use the backup-staging-url command in Configuration mode.
backup-staging-url word
Syntax Description
word
NFS URL for staging area. This can be a maximum of 2048 alphanumeric characters. Use nfs://server:path1 .
1 Server is the server name and path refers to /subdir/subsubdir. Remember that a colon (:) is required after the server.
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
The URL is NFS only. The format of the command is backup-staging-url nfs://server:path.
WarningExamples
acs/admin(config)# backup-staging-url nfs://loc-filer02a:/vol/local1/private1/jdoeacs/admin(config)#cdp holdtime
To specify the amount of time for which the receiving device should hold a CDP packet from the ACS server before discarding it, use the cdp holdtime command in the Configuration mode. To revert to the default setting, use the no form of this command.
cdp holdtime seconds
Syntax Description
Defaults
180 seconds
Command Modes
Configuration
Usage Guidelines
CDP packets transmit with a time to live, or hold time, value. The receiving device will discard the CDP information in the CDP packet after the hold time has elapsed.
The cdp holdtime command takes only one argument; otherwise, an error occurs.
Examples
acs/admin(config)# cdp holdtime 60acs/admin(config)#Related Commands
cdp run
To enable the CDP, use the cdp run command in Configuration mode. To disable the CDP, use the no form of this command.
cdp run [GigabitEthernet]
Syntax Description
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
The command has one optional argument, an interface name. Without an optional interface name, the command enables CDP on all interfaces.
Note
Examples
acs/admin(config)# cdp run GigabitEthernet 0acs/admin(config)#Related Commands
Specifies the length of time that the receiving device should hold a CDP packet from the ACS server before discarding it.
Specifies how often the ACS server sends CDP updates.
cdp timer
To specify how often the ACS server sends Cisco Discovery Protocol (CDP) updates, use the cdp timer command in Configuration mode. To revert to the default setting, use the no form of this command.
cdp timer seconds
Syntax Description
seconds
Specifies how often, in seconds, the ACS server sends CDP updates. Value from 5 to 254 seconds.
Defaults
60 seconds
Command Modes
Configuration
Usage Guidelines
CDP packets transmit with a time to live, or hold time, value. The receiving device will discard the CDP information in the CDP packet after the hold time has elapsed.
The cdp timer command takes only one argument; otherwise, an error occurs.
Examples
acs/admin(config)# cdp timer 60acs/admin(config)#Related Commands
Specifies the amount of time that the receiving device should hold a CDP packet from the ACS server before discarding it.
Enables CDP.
clock timezone
To set the time zone, use the clock timezone command in Configuration mode. To disable this function, use the no form of this command.
clock timezone timezone
Syntax Description
timezone
Name of the time zone visible when in standard time. This can be a maximum of 64 alphanumeric characters.
Defaults
UTC
Command Modes
Configuration
Usage Guidelines
The system internally keeps time in UTC. If you do not know your specific time zone, you can enter the region, country, and city (see Tables 3-16, 3-17, and 3-18 for sample time zones to enter on your system).
Table 3-17 Australia Time Zones
ACT2
Adelaide
Brisbane
Broken_Hill
Canberra
Currie
Darwin
Hobart
Lord_Howe
Lindeman
LHI3
Melbourne
North
NSW4
Perth
Queensland
South
Sydney
Tasmania
Victoria
West
Yancowinna
1 Enter the country and city together with a forward slash (/) between them; for example, Australia/Currie.
2 ACT = Australian Capital Territory.
3 LHI = Lord Howe Island
4 NSW = New South Wales
Table 3-18 Asia Time Zones
Aden2
Almaty
Amman
Anadyr
Aqtau
Aqtobe
Ashgabat
Ashkhabad
Baghdad
Bahrain
Baku
Bangkok
Beirut
Bishkek
Brunei
Calcutta
Choibalsan
Chongqing
Columbo
Damascus
Dhakar
Dili
Dubai
Dushanbe
Gaza
Harbin
Hong_Kong
Hovd
Irkutsk
Istanbul
Jakarta
Jayapura
Jerusalem
Kabul
Kamchatka
Karachi
Kashgar
Katmandu
Kuala_Lumpur
Kuching
Kuwait
Krasnoyarsk
1 The Asia time zone includes cities from East Asia, Southern Southeast Asia, West Asia, and Central Asia.
2 Enter the region and city or country together separated by a forward slash (/); for example, Asia/Aden.
Note
Examples
acs/admin(config)# clock timezone ESTTime zone was modified. You must restart ACS.Do you want to restart ACS now? (yes/no)Stopping ACS .................Starting ACS ......................acs/admin(config)# exitacs/admin# show timezoneESTacs/admin#Related Commands
Displays a list of available time zones on the system.
Displays the current time zone set on the system.
do
To execute an EXEC-level command from Configuration mode or any configuration submode, use the do command in any configuration mode.
do arguments
Syntax Description
arguments
The EXEC command to execute (see Table 3-19).
Command Default
No default behavior or values.
Command Modes
Configuration or any configuration submode
Usage Guidelines
Use this command to execute EXEC commands (such as show, clear, and debug commands) while configuring your server. After the EXEC command executes, the system will return to the configuration mode you were using.
Examples
acs/admin(config)# do show runGenerating configuration...!hostname ems-lnx106ip domain-name cisco.cominterface ethernet 0ip address 209.165.200.225 255.255.255.224interface ethernet 1shutdownip name-server 209.165.201.1ip default-gateway 209.165.202.129clock timezone Cuba!!username admin password hash $1$hB$MxIZHvecMiey/P9mM9PvN0 role admin!!logging localhostlogging loglevel 6!acs/admin(config)#end
To end the current configuration session and return to the EXEC mode, use the end command in Configuration mode.
end
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
This command brings you back to EXEC mode regardless of what configuration mode or submode you are in.
Use this command when you finish configuring the system and you want to return to EXEC mode to perform verification steps.
Examples
acs/admin(config)# endacs/admin#Related Commands
Exits Configuration mode.
exit (EXEC)
Closes the active terminal session by logging out of the ACS server.
exit
To exit any configuration mode to the next-highest mode in the CLI mode hierarchy, use the exit command in Configuration mode.
exit
Syntax Description
No arguments or keywords.
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
The exit command is used in the ACS server to exit the current command mode to the next highest command mode in the CLI mode hierarchy.
For example, use the exit command in Configuration mode to return to the EXEC mode. Use the exit command in the configuration submodes to return to Configuration mode. At the highest level, EXEC mode, the exit command exits the EXEC mode and disconnects from the ACS server (see exit, for a description of the exit (EXEC) command).
Examples
acs/admin(config)# exitacs/admin#Related Commands
Exits Configuration mode.
exit (EXEC)
Closes the active terminal session by logging out of the ACS server.
host-key sync
To sync the SSH keys for an SFTP repository between ACS and an SFTP server, use the host-key sync command.
host-key sync
Syntax Description
No arguments or keywords.
Defaults
None.
Command Modes
Configuration
Usage Guidelines
None.
Examples
acs/admin(config)# repository newacs/admin(config-Repository)# url sftp://starwars.test.com/repository/system1acs/admin(config-Repository)# user luke password skywalkeracs/admin(config-Repository)# host-key syncacs/admin(config)#Related Commands
hostname
To set the hostname of the system, use the hostname command in Configuration mode. To delete the hostname from the system, use the no form of this command. This resets the system to localhost.
hostname word
Syntax Description
word
Name of the host. Contains at least 2 to 64 alphanumeric characters and an underscore ( _ ). The hostname must begin with a character that is not a space.
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
A single instance type of command, hostname only occurs once in the configuration of the system. The hostname must contain one argument; otherwise, an error occurs.
Examples
acs/admin(config)# hostname myserver-1Hostname was modified.ACS is restarting and a new HTTP certificate will be generated.Stopping ACS ......................Starting ACS ....To verify that ACS processes are running, use the'show application status acs' command.myserver-1/admin(config)#icmp echo
To configure the Internet Control Message Protocol (ICMP) echo responses, use the icmp echo command in Configuration mode.
icmp echo {off | on}
Syntax Description
Defaults
The system will behave as if the ICMP echo response is on (enabled).
Command Modes
Configuration
Usage Guidelines
None.
Examples
acs/admin(config)# icmp echo offacs/admin(config)#Related Commands
interface
To configure an interface type and enter the interface configuration mode, use the interface command in Configuration mode. This command does not have a no form.
interface GigabitEthernet [0 | 1]
Syntax Description
GigabitEthernet
Configures the Gigabit Ethernet interface.
0 | 1
Number of the Gigabit Ethernet port to configure.
Note
do
EXEC command. Allows you to perform any EXEC commands in this mode (see do).
end
Exits the config-GigabitEthernet submode and returns you to the EXEC mode.
exit
Exits the config-GigabitEthernet configuration submode.
ip
Sets the IP address and netmask for the Ethernet interface (see ip address).
no
Negates the command in this mode. Two keywords available:
•
•
shutdown
Shuts down the interface (see shutdown).
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
You can use this command to configure subinterfaces to support various requirements.
Examples
acs/admin(config)# interface GigabitEthernet 0acs/admin(config-GigabitEthernet)#Related Commands
Displays information about the system interfaces.
ip address (interface configuration mode)
Sets the IP address and netmask for the interface.
shutdown (interface configuration mode)
Shuts down the interface (see shutdown).
ip address
To set the IP address and netmask for the Ethernet interface, use the ip address command in interface Configuration mode. To remove an IP address or disable IP processing, use the no form of this command.
ip address ip-address netmask
Note
Syntax Description
Defaults
Enabled.
Command Modes
Interface configuration
Usage Guidelines
Requires exactly one address and one netmask; otherwise, an error occurs.
Examples
acs/admin(config)# interface GigabitEthernet 1acs/admin(config-GigabitEthernet)# ip address 209.165.200.227 255.255.255.224IP Address was modified.ACS is restarting and a new HTTP certificate will be generated.Stopping ACS ......................Starting ACS ....To verify that ACS processes are running, use the'show application status acs' command.acs/admin(config-GigabitEthernet)#Related Commands
shutdown (interface configuration mode)
Disables an interface (see shutdown).
Sets the IP address of the default gateway of an interface.
Displays information about the system IP interfaces.
Configures an interface type and enters the interface mode.
ip default-gateway
To define or set a default gateway with an IP address, use the ip default-gateway command in Configuration mode. To disable this function, use the no form of this command.
ip default-gateway ip-address
Syntax Description
Defaults
Disabled.
Command Modes
Configuration
Usage Guidelines
If you enter more than one argument or no arguments at all, an error occurs.
Examples
acs/admin(config)# ip default-gateway 209.165.202.129acs/admin(config)#Related Commands
ip address(interface configuration mode)
Sets the IP address and netmask for the Ethernet interface.
ip domain-name
To define a default domain name that the ACS server uses to complete hostnames, use the ip domain-name command in Configuration mode. To disable this function, use the no form of this command.
ip domain-name word
Syntax Description
word
Default domain name used to complete the hostnames. Contains at least 2 to 64 alphanumeric characters.
Defaults
Enabled.
Command Modes
Configuration
Usage Guidelines
If you enter more or fewer arguments, an error occurs.
Examples
acs/admin(config)# ip domain-name cisco.comacs/admin(config)#Related Commands
ip name-server
To set the Domain Name Server (DNS) servers for use during a DNS query, use the ip name-server command in Configuration mode. You can configure one to three DNS servers. To disable this function, use the no form of this command.
Note
ip name-server ip-address [ip-address*]
Syntax Description
ip-address
Address of a name server.
ip-address*
(Optional) IP addresses of additional name servers.
Note
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
The first name server added with the ip name-server command will occupy the first position and the system will first use that server in resolving the IP addresses.
You can add name servers to the system one at a time or all at once, until you reach the maximum (3). If you already configured the system with three name servers, you must remove at least one server to add additional name servers.
To place a name server in the first position so that the subsystem uses it first, you must remove all name servers with the no form of this command before you proceed.
Examples
acs/admin(config)# ip name-server 209.165.201.1Name Server was modified. You must restart ACS.Do you want to restart ACS now? (yes/no) yesStopping ACS ......................Starting ACS ....To verify that ACS processes are running, use the'show application status acs' command.acs/admin(config)#You can choose not to restart the ACS server; nevertheless, the changes will take effect.
Related Commands
ip route
To configure the static routes, use the ip route command in Configuration mode. To remove static routes, use the no form of this command.
Static routes are manually configured. This makes them inflexible (they cannot dynamically adapt to network topology changes) but extremely stable. Static routes optimize bandwidth utilization, because no routing updates need to be sent to maintain them. They also make it easy to enforce routing policy.
ip route prefix mask gateway ip-address
no ip route prefix mask
Syntax Description
prefix
IP route prefix for the destination.
mask
Prefix mask for the destination.
ip-address
IP address of the next hop that can be used to reach that network.
Defaults
No default behavior or values.
Command Modes
Configuration.
Examples
acs/admin(config)# ip route 192.168.0.0 255.255.0.0 gateway 172.23.90.2kron occurrence
To schedule one or more Command Scheduler commands to run at a specific date and time or a recurring level, use the kron occurrence command in Configuration mode. To delete this, use the no form of this command.
kron {occurrence} occurrence-name
Syntax Description
occurrence
Schedules Command Scheduler commands.
occurrence-name
Name of the occurrence. This can be a maximum of 80 alphanumeric characters. (See following note and Syntax Description.)
Note
at
Identifies that the occurrence is to run at a specified calendar date and time. Usage: at [hh:mm] [day-of-week | day-of-month | month day-of-month].
do
EXEC command. Allows you to perform any EXEC commands in this mode (see do).
end
Exits the kron-occurrence configuration submode and returns you to the EXEC mode.
exit
Exits the kron-occurrence configuration mode.
no
Negates the command in this mode.
Three keywords available:
•
•
•
policy-list
Specifies a Command Scheduler policy list to be run by the occurrence.
recurring
Identifies that the occurrences run on a recurring basis.
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
Use the kron occurrence and policy-list commands to schedule one or more policy lists to run at the same time or interval.
Use the kron policy-list command in conjunction with the cli command to create a Command Scheduler policy containing EXEC CLI commands to be scheduled to run on the ACS server at a specified time. See kron policy-list.
Examples
Note
Example 1: Weekly Backup
acs/admin(config)# kron occurrence WeeklyBackupacs/admin(config-Occurrence)# at 14:35 Mondayacs/admin(config-Occurrence)# policy-list SchedBackupPolicyacs/admin(config-Occurrence)# recurringacs/admin(config-Occurrence)# exitacs/admin(config)#Example 2: Daily Backup
acs/admin(config)# kron occurrence DailyBackupacs/admin(config-Occurrence)# at 02:00acs/admin(config-Occurrence)# exitacs/admin(config)#Related Commands
kron policy-list
To specify a name for a Command Scheduler policy and enter the kron-Policy List configuration submode, use the kron policy-list command in Configuration mode. To delete this, use the no form of this command.
kron {policy-list} list-name
Syntax Description
policy-list
Specifies a name for Command Scheduler policies.
list-name
Name of the policy list. This can be a maximum of 80 alphanumeric characters.
Note
cli
Command to be executed by the scheduler. This can be a maximum of 80 alphanumeric characters.
do
EXEC command. Allows you to perform any EXEC commands in this mode (see do).
end
Exits from the config-Policy List configuration submode and returns you to the EXEC mode.
exit
Exits this submode.
no
Negates the command in this mode. One keyword available:
•
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
Use the kron policy-list command in conjunction with the cli command to create a Command Scheduler policy containing EXEC CLI commands to be scheduled to run on the ACS server at a specified time. Use the kron occurrence and policy list commands to schedule one or more policy lists to run at the same time or interval. See kron occurrence.
Examples
acs/admin(config)# kron policy-list SchedBackupMondayacs/admin(config-Policy List)# cli backup SchedBackupMonday repository SchedBackupRepoacs/admin(config-Policy List)# exitacs/admin(config)#Related Commands
Specifies schedule parameters for a Command Scheduler occurrence and enters the config-Occurrence configuration mode.
logging
To enable the system to forward logs to a remote system or to configure the log level, use the logging command in Configuration mode. To disable this function, use the no form of this command.
logging {ip-address | hostname} {loglevel level}
Syntax Description
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
This command requires an IP address or hostname or the loglevel keyword; an error occurs if you enter two or more of these arguments.
Examples
Example 1
acs/admin(config)# logging 209.165.200.225acs/admin(config)#Example 2
acs/admin(config)# logging loglevel 0acs/admin(config)#Related Commands
ntp server
To allow for software clock synchronization by the Network Time Protocol (NTP) server for the system, use the ntp server command in Configuration mode. Allows up to two servers. To disable this capability, use the no form of this command.
ntp server {ip-address | hostname} [ip-address | hostname]
Syntax Description
ip-address | hostname
IP address or hostname of the server providing the clock synchronization. Arguments are limited to 255 alphanumeric characters.
Defaults
No servers are configured by default.
Command Modes
Configuration
Usage Guidelines
Use this command if you want to allow the system to synchronize with a specified server.
To terminate NTP service on a device, you must enter the no ntp command without keywords or arguments.
For example, if you previously ran the ntp server command and you now want to remove not only the server synchronization capability, but all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions disable and that the NTP service also terminates.
Note
Examples
acs/admin(config)# ntp server 209.165.201.31NTP Server was modified. You must restart ACS.Do you want to restart ACS now? (yes/no) yesStopping ACS ......................Starting ACS ......................To verify that ACS processes are running, use the'show application status acs' command.acs/admin(config)#Related Commands
password-policy
To enable or configure the passwords on the system, use the password-policy command in Configuration mode. To disable this function, use the no form of this command.
password-policy option
Note
You must enter the password-expiration-enabled command before the other password-expiration commands.
Syntax Description
Note
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
None.
Examples
acs/admin(config)# password-policyacs/admin(config-password-policy)# password-expiration-days 30acs/admin(config-password-policy)# exitacs/admin(config)#repository
To enter the repository submode for configuration of backups, use the repository command in Configuration mode.
repository repository-name
Syntax Description
Note
do
EXEC command. Allows you to perform any of the EXEC commands in this mode (see do).
end
Exits the config-Repository mode and returns you to the EXEC mode.
exit
Exits this mode.
no
Negates the command in this mode.
Two keywords available:
•
•
url
URL of the repository. This can be a maximum of 80 alphanumeric characters (see Table 3-20).
user
Configure username and password for access. This can be a maximum of 30 alphanumeric characters.
Table 3-20 URL Keywords
word
Enter repository URL, including server and path info. This can be a maximum of 80 alphanumeric characters.
cdrom:
Local CD-ROM drive (read only).
disk:
Local storage.
All local repositories are created on the /localdisk partition. When you specify disk:// in the repository URL, the system creates directories in a path that is relative to /localdisk.
For example, if you entered disk://backup, the directory is created at /localdisk/backup.
You can run the show repository repository_name to view all the files in the local repository.
ftp:
Source or destination URL for an FTP network server. Use url ftp://server/path1 .
nfs:
Source or destination URL for an NFS network server. Use url nfs://server:path1.
sftp:
Source or destination URL for an SFTP network server. Use url sftp://server/path1.
tftp:
Source or destination URL for a TFTP network server. Use url tftp://server/path1.
Note
1 Server is the server name and path refers to /subdir/subsubdir. Remember that a colon (:) is required after the server for an NFS network server.
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
In ACS 5.1/5.2, when you create an SFTP repository using the url sftp://server/path and use the "root" username, the backup that you take gets stored in the root/path directory of this repository.
ACS 5.3 uses absolute path and for the same commands, the backup is stored in the /path directory. You should have permission to access this directory.
Note
You must use the absolute path to fetch the backup file. For windows SFTP server, the virtual path "/" should be mapped to any of the folders in the windows drive.
Examples
acs/admin(config)# repository myrepositoryacs/admin(config-Repository)# url sftp://starwars.test.com/repository/system1acs/admin(config-Repository)# user luke password plain skywalkeracs/admin(config-Repository)# exitacs/admin(config)#Related Commands
service
To specify a service to manage, use the service command in Configuration mode. To disable this function, use the no form of this command.
service sshd
Syntax Description
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
None.
Examples
acs/admin(config)# service sshdacs/admin(config)#snmp-server community
To set up the community access string to permit access to the Simple Network Management Protocol (SNMP), use the snmp-server community command in Configuration mode. To disable this function, use the no form of this command.
snmp-server community word ro
Syntax Description
word
Accessing string that functions much like a password, allowing access to SNMP. No blank spaces allowed. This can be a maximum of 255 alphanumeric characters.
ro
Specifies read-only access.
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
The snmp-server community command requires a community string and the ro argument; otherwise, an error occurs.
Examples
acs/admin(config)# snmp-server community new roacs/admin(config)#Related Commands
Sends traps to a remote system.
Configures the SNMP location MIB value on the system.
Configures the SNMP contact MIB value on the system.
snmp-server contact
To configure the SNMP contact MIB value on the system, use the snmp-server contact command in Configuration mode. To remove the system contact information, use the no form of this command.
snmp-server contact word
Syntax Description
word
String that describes the system contact information of the node. This can be a maximum of 255 alphanumeric characters.
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
None.
Examples
acs/admin(config)# snmp-server contact Lukeacs/admin(config)#Related Commands
Sends traps to a remote system.
Sets up the community access string to permit access to the SNMP.
Configures the SNMP location MIB value on the system.
snmp-server host
To send SNMP traps to a remote user, use the snmp-server host command in Configuration mode. To remove trap forwarding, use the no form of this command. This command does not display any output on the CLI.
snmp-server host {ip-address | hostname} version {1 | 2c} community
Syntax Description
Defaults
Disabled.
Command Modes
Configuration
Usage Guidelines
The command takes arguments as listed; otherwise, an error occurs.
Examples
acs/admin(config)# snmp-server community new ro 10acs/admin(config)# snmp-server host 209.165.202.129 version 1 passwordacs/admin(config)#Related Commands
Sets up the community access string to permit access to SNMP.
Configures the SNMP location MIB value on the system.
Configures the SNMP contact MIB value on the system.
snmp-server location
To configure the SNMP location MIB value on the system, use the snmp-server location command in Configuration mode. To remove the system location information, use the no form of this command.
snmp-server location word
Syntax Description
word
String that describes the system's physical location information. This can be a maximum of 255 alphanumeric characters.
Defaults
No default behavior or values.
Command Modes
Configuration
Usage Guidelines
Cisco recommends that you use underscores (_) or hyphens (-) between the terms within the word string. If you use spaces between terms within the word string, you must enclose the string in quotation marks (").
Examples
Example 1
acs/admin(config)# snmp-server location Building_3/Room_214acs/admin(config)#Example 2
acs/admin(config)# snmp-server location "Building 3/Room 214"acs/admin(config)#Related Commands
Sends traps to a remote system.
Sets up the community access string to permit access to SNMP.
Configures the SNMP location MIB value on the system.
username
To add a user who can access the CSACS-1121 using SSH, use the username command in Configuration mode. If the user already exists, the password, the privilege level, or both change with this command. To delete the user from the system, use the no form of this command.
username username password {hash | plain} password role {admin | user] [disabled [email email-address]] [email email-address]
For an existing user, use the following option:
username username password role {admin | user} password
Syntax Description
Defaults
The initial user during setup.
Command Modes
Configuration
Usage Guidelines
The username command requires that the username and password keywords precede the hash | plain and the admin | user options.
Examples
Example 1
acs/admin(config)# username admin password hash ###### role adminacs/admin(config)#Example 2
acs/admin(config)# username admin password plain Secr3tp@swd role adminacs/admin(config)#Example 3
acs/admin(config)# username admin password plain Secr3tp@swd role admin email admin123@mydomain.comacs/admin(config)#Related Commands
Enables and configures the password policy.
Displays a list of users and their privilege level. It also displays a list of logged-in users.
