1 # Icinga 2 CLI Commands <a id="cli-commands"></a>
3 Icinga 2 comes with a number of CLI commands which support bash autocompletion.
5 These CLI commands will allow you to use certain functionality
6 provided by and around Icinga 2.
8 Each CLI command provides its own help and usage information, so please
9 make sure to always run them with the `--help` parameter.
11 Run `icinga2` without any arguments to get a list of all available global
16 icinga2 - The Icinga 2 network monitoring daemon (version: v2.11.0)
19 icinga2 <command> [<arguments>]
22 * api setup (setup for API)
23 * ca list (lists all certificate signing requests)
24 * ca sign (signs an outstanding certificate request)
25 * console (Icinga debug console)
26 * daemon (starts Icinga 2)
27 * feature disable (disables specified feature)
28 * feature enable (enables specified feature)
29 * feature list (lists all available features)
30 * node setup (set up node)
31 * node wizard (wizard for node setup)
32 * object list (lists all objects)
33 * pki new-ca (sets up a new CA)
34 * pki new-cert (creates a new CSR)
35 * pki request (requests a certificate)
36 * pki save-cert (saves another Icinga 2 instance's certificate)
37 * pki sign-csr (signs a CSR)
38 * pki ticket (generates a ticket)
39 * troubleshoot (collect information for troubleshooting)
40 * variable get (gets a variable)
41 * variable list (lists all variables)
44 -h [ --help ] show this help message
45 -V [ --version ] show version information
46 --color use VT100 color codes even when stdout is not a
48 -D [ --define ] arg define a constant
49 -a [ --app ] arg application library name (default: icinga)
50 -l [ --library ] arg load a library
51 -I [ --include ] arg add include search directory
52 -x [ --log-level ] arg specify the log level for the console log.
53 The valid value is either debug, notice,
54 information (default), warning, or critical
55 -X [ --script-debugger ] whether to enable the script debugger
57 Report bugs at <https://github.com/Icinga/icinga2>
58 Icinga home page: <https://icinga.com/>
62 ## Icinga 2 CLI Bash Autocompletion <a id="cli-commands-autocompletion"></a>
64 Bash Auto-Completion (pressing `<TAB>`) is provided only for the corresponding context.
66 While `--config` suggests and auto-completes files and directories on disk,
67 `feature enable` only suggests disabled features.
69 RPM and Debian packages install the bash completion files into
70 `/etc/bash_completion.d/icinga2`.
72 You need to install the `bash-completion` package if not already installed.
77 # yum install bash-completion
83 # zypper install bash-completion
89 # apt-get install bash-completion
92 Ensure that the `bash-completion.d` directory is added to your shell
93 environment. You can manually source the icinga2 bash-completion file
94 into your current session and test it:
97 # source /etc/bash-completion.d/icinga2
101 ## Icinga 2 CLI Global Options <a id="cli-commands-global-options"></a>
105 By default the `icinga2` binary loads the `icinga` library. A different application type
106 can be specified with the `--app` command-line option.
107 Note: This is not needed by the average Icinga user, only developers.
111 Instead of loading libraries using the [`library` config directive](17-language-reference.md#library)
112 you can also use the `--library` command-line option.
113 Note: This is not needed by the average Icinga user, only developers.
117 [Global constants](17-language-reference.md#constants) can be set using the `--define` command-line option.
119 ### Config Include Path <a id="config-include-path"></a>
121 When including files you can specify that the include search path should be
122 checked. You can do this by putting your configuration file name in angle
129 This causes Icinga 2 to search its include path for the configuration file
130 `test.conf`. By default the installation path for the [Icinga Template Library](10-icinga-template-library.md#icinga-template-library)
131 is the only search directory.
133 Using the `--include` command-line option additional search directories can be
136 ## CLI command: Api <a id="cli-command-api"></a>
138 Provides helper functions to enable and setup the
139 [Icinga 2 API](12-icinga2-api.md#icinga2-api-setup).
141 ### CLI command: Api Setup <a id="cli-command-api-setup "></a>
144 # icinga2 api setup --help
145 icinga2 - The Icinga 2 network monitoring daemon (version: v2.11.0)
148 icinga2 api setup [<arguments>]
150 Setup for Icinga 2 API.
153 -h [ --help ] show this help message
154 -V [ --version ] show version information
155 --color use VT100 color codes even when stdout is not a
157 -D [ --define ] arg define a constant
158 -I [ --include ] arg add include search directory
159 -x [ --log-level ] arg specify the log level for the console log.
160 The valid value is either debug, notice,
161 information (default), warning, or critical
162 -X [ --script-debugger ] whether to enable the script debugger
165 --cn arg The certificate's common name
167 Report bugs at <https://github.com/Icinga/icinga2>
168 Get support: <https://icinga.com/support/>
169 Documentation: <https://icinga.com/docs/>
170 Icinga home page: <https://icinga.com/>
173 ## CLI command: Ca <a id="cli-command-ca"></a>
175 List and manage incoming certificate signing requests. More details
176 can be found in the [signing methods](06-distributed-monitoring.md#distributed-monitoring-setup-sign-certificates-master)
177 chapter. This CLI command is available since v2.8.
181 icinga2 - The Icinga 2 network monitoring daemon (version: v2.11.0)
184 icinga2 <command> [<arguments>]
187 * ca list (lists all certificate signing requests)
188 * ca sign (signs an outstanding certificate request)
191 -h [ --help ] show this help message
192 -V [ --version ] show version information
193 --color use VT100 color codes even when stdout is not a
195 -D [ --define ] arg define a constant
196 -a [ --app ] arg application library name (default: icinga)
197 -l [ --library ] arg load a library
198 -I [ --include ] arg add include search directory
199 -x [ --log-level ] arg specify the log level for the console log.
200 The valid value is either debug, notice,
201 information (default), warning, or critical
202 -X [ --script-debugger ] whether to enable the script debugger
204 Report bugs at <https://github.com/Icinga/icinga2>
205 Icinga home page: <https://icinga.com/>
209 ### CLI command: Ca List <a id="cli-command-ca-list"></a>
212 icinga2 ca list --help
213 icinga2 - The Icinga 2 network monitoring daemon (version: v2.11.0)
216 icinga2 ca list [<arguments>]
218 Lists pending certificate signing requests.
221 -h [ --help ] show this help message
222 -V [ --version ] show version information
223 --color use VT100 color codes even when stdout is not a
225 -D [ --define ] arg define a constant
226 -I [ --include ] arg add include search directory
227 -x [ --log-level ] arg specify the log level for the console log.
228 The valid value is either debug, notice,
229 information (default), warning, or critical
230 -X [ --script-debugger ] whether to enable the script debugger
233 --all List all certificate signing requests, including
234 signed. Note: Old requests are automatically
235 cleaned by Icinga after 1 week.
236 --json encode output as JSON
238 Report bugs at <https://github.com/Icinga/icinga2>
239 Get support: <https://icinga.com/support/>
240 Documentation: <https://icinga.com/docs/>
241 Icinga home page: <https://icinga.com/>
244 ## CLI command: Console <a id="cli-command-console"></a>
246 The CLI command `console` can be used to debug and evaluate Icinga 2 config expressions,
247 e.g. to test [functions](17-language-reference.md#functions) in your local sandbox.
251 Icinga 2 (version: v2.11.0)
252 <1> => function test(name) {
253 <1> .. log("Hello " + name)
257 information/config: Hello World
262 Further usage examples can be found in the [library reference](18-library-reference.md#library-reference) chapter.
265 # icinga2 console --help
266 icinga2 - The Icinga 2 network monitoring daemon (version: v2.11.0)
269 icinga2 console [<arguments>]
271 Interprets Icinga script expressions.
274 -h [ --help ] show this help message
275 -V [ --version ] show version information
276 --color use VT100 color codes even when stdout is not a
278 -D [ --define ] arg define a constant
279 -a [ --app ] arg application library name (default: icinga)
280 -l [ --library ] arg load a library
281 -I [ --include ] arg add include search directory
282 -x [ --log-level ] arg specify the log level for the console log.
283 The valid value is either debug, notice,
284 information (default), warning, or critical
285 -X [ --script-debugger ] whether to enable the script debugger
288 -c [ --connect ] arg connect to an Icinga 2 instance
289 -e [ --eval ] arg evaluate expression and terminate
290 -r [ --file ] arg evaluate a file and terminate
291 --syntax-only only validate syntax (requires --eval or --file)
292 --sandbox enable sandbox mode
294 Report bugs at <https://github.com/Icinga/icinga2>
295 Icinga home page: <https://icinga.com/>
299 On operating systems without the `libedit` library installed there is no
300 support for line-editing or a command history. However you can
301 use the `rlwrap` program if you require those features:
304 $ rlwrap icinga2 console
307 The debug console can be used to connect to a running Icinga 2 instance using
308 the [REST API](12-icinga2-api.md#icinga2-api). [API permissions](12-icinga2-api.md#icinga2-api-permissions)
309 are required for executing config expressions and auto-completion.
313 > The debug console does not currently support TLS certificate verification.
315 > Runtime modifications are not validated and might cause the Icinga 2
316 > daemon to crash or behave in an unexpected way. Use these runtime changes
317 > at your own risk and rather *inspect and debug objects read-only*.
319 You can specify the API URL using the `--connect` parameter.
321 Although the password can be specified there process arguments on UNIX platforms are
322 usually visible to other users (e.g. through `ps`). In order to securely specify the
323 user credentials the debug console supports two environment variables:
325 Environment variable | Description
326 ---------------------|-------------
327 ICINGA2_API_USERNAME | The API username.
328 ICINGA2_API_PASSWORD | The API password.
333 $ ICINGA2_API_PASSWORD=icinga icinga2 console --connect 'https://root@localhost:5665/'
334 Icinga 2 (version: v2.11.0)
338 Once connected you can inspect variables and execute other expressions by entering them at the prompt:
341 <1> => var h = get_host("icinga2-client1.localdomain")
343 <2> => h.last_check_result
346 check_source = "icinga2-client1.localdomain"
347 command = [ "/usr/local/sbin/check_ping", "-H", "127.0.0.1", "-c", "5000,100%", "-w", "3000,80%" ]
348 execution_end = 1446653527.174983
349 execution_start = 1446653523.152673
350 exit_status = 0.000000
351 output = "PING OK - Packet loss = 0%, RTA = 0.11 ms"
352 performance_data = [ "rta=0.114000ms;3000.000000;5000.000000;0.000000", "pl=0%;80;100;0" ]
353 schedule_end = 1446653527.175133
354 schedule_start = 1446653583.150000
361 state_type = 1.000000
367 state_type = 1.000000
373 You can use the `--eval` parameter to evaluate a single expression in batch mode.
374 Using the `--file` option you can specify a file which should be evaluated.
375 The output format for batch mode is JSON.
377 The `--syntax-only` option can be used in combination with `--eval` or `--file`
378 to check a script for syntax errors. In this mode the script is parsed to identify
379 syntax errors but not evaluated.
381 Here's an example that retrieves the command that was used by Icinga to check the `icinga2-client1.localdomain` host:
384 $ ICINGA2_API_PASSWORD=icinga icinga2 console --connect 'https://root@localhost:5665/' --eval 'get_host("icinga2-client1.localdomain").last_check_result.command' | python -m json.tool
386 "/usr/local/sbin/check_ping",
396 ## CLI command: Daemon <a id="cli-command-daemon"></a>
398 The CLI command `daemon` provides the functionality to start/stop Icinga 2.
399 Furthermore it allows to run the [configuration validation](11-cli-commands.md#config-validation).
402 # icinga2 daemon --help
403 icinga2 - The Icinga 2 network monitoring daemon (version: v2.11.0)
406 icinga2 daemon [<arguments>]
411 -h [ --help ] show this help message
412 -V [ --version ] show version information
413 --color use VT100 color codes even when stdout is not a
415 -D [ --define ] arg define a constant
416 -a [ --app ] arg application library name (default: icinga)
417 -l [ --library ] arg load a library
418 -I [ --include ] arg add include search directory
419 -x [ --log-level ] arg specify the log level for the console log.
420 The valid value is either debug, notice,
421 information (default), warning, or critical
422 -X [ --script-debugger ] whether to enable the script debugger
425 -c [ --config ] arg parse a configuration file
426 -z [ --no-config ] start without a configuration file
427 -C [ --validate ] exit after validating the configuration
428 -e [ --errorlog ] arg log fatal errors to the specified log file (only
429 works in combination with --daemonize or
431 -d [ --daemonize ] detach from the controlling terminal
432 --close-stdio do not log to stdout (or stderr) after startup
434 Report bugs at <https://github.com/Icinga/icinga2>
435 Icinga home page: <https://icinga.com/>
438 ### Config Files <a id="cli-command-daemon-config-files"></a>
440 You can specify one or more configuration files with the `--config` option.
441 Configuration files are processed in the order they're specified on the command-line.
443 When no configuration file is specified and the `--no-config` is not used
444 Icinga 2 automatically falls back to using the configuration file
445 `ConfigDir + "/icinga2.conf"` (where ConfigDir is usually `/etc/icinga2`).
447 ### Validation <a id="cli-command-daemon-validation"></a>
449 The `--validate` option can be used to check if configuration files
450 contain errors. If any errors are found, the exit status is 1, otherwise 0
451 is returned. More details in the [configuration validation](11-cli-commands.md#config-validation) chapter.
453 ## CLI command: Feature <a id="cli-command-feature"></a>
455 The `feature enable` and `feature disable` commands can be used to enable and disable features:
458 # icinga2 feature disable <tab>
459 --app --define --include --log-level --version checker graphite mainlog
460 --color --help --library --script-debugger api command ido-mysql notification
464 # icinga2 feature enable <tab>
465 --app --define --include --log-level --version debuglog ido-pgsql livestatus perfdata syslog
466 --color --help --library --script-debugger compatlog gelf influxdb opentsdb statusdata
469 The `feature list` command shows which features are currently enabled:
472 # icinga2 feature list
473 Disabled features: compatlog debuglog gelf ido-pgsql influxdb livestatus opentsdb perfdata statusdata syslog
474 Enabled features: api checker command graphite ido-mysql mainlog notification
477 ## CLI command: Node <a id="cli-command-node"></a>
479 Provides the functionality to setup master and client
480 nodes in a [distributed monitoring](06-distributed-monitoring.md#distributed-monitoring) scenario.
483 # icinga2 node --help
484 icinga2 - The Icinga 2 network monitoring daemon (version: v2.11.0)
487 icinga2 <command> [<arguments>]
490 * node setup (set up node)
491 * node wizard (wizard for node setup)
494 -h [ --help ] show this help message
495 -V [ --version ] show version information
496 --color use VT100 color codes even when stdout is not a
498 -D [ --define ] arg define a constant
499 -a [ --app ] arg application library name (default: icinga)
500 -l [ --library ] arg load a library
501 -I [ --include ] arg add include search directory
502 -x [ --log-level ] arg specify the log level for the console log.
503 The valid value is either debug, notice,
504 information (default), warning, or critical
505 -X [ --script-debugger ] whether to enable the script debugger
507 Report bugs at <https://github.com/Icinga/icinga2>
508 Icinga home page: <https://icinga.com/>
511 ## CLI command: Object <a id="cli-command-object"></a>
513 The `object` CLI command can be used to list all configuration objects and their
514 attributes. The command also shows where each of the attributes was modified and as such
515 provides debug information for further configuration problem analysis.
516 That way you can also identify which objects have been created from your [apply rules](17-language-reference.md#apply).
518 Runtime modifications via the [REST API](12-icinga2-api.md#icinga2-api-config-objects)
519 are not immediately updated. Furthermore there is a known issue with
520 [group assign expressions](17-language-reference.md#group-assign) which are not reflected in the host object output.
521 You need to restart Icinga 2 in order to update the `icinga2.debug` cache file.
523 More information can be found in the [troubleshooting](15-troubleshooting.md#troubleshooting-list-configuration-objects) section.
526 # icinga2 object --help
527 icinga2 - The Icinga 2 network monitoring daemon (version: v2.11.0)
530 icinga2 <command> [<arguments>]
533 * object list (lists all objects)
536 -h [ --help ] show this help message
537 -V [ --version ] show version information
538 --color use VT100 color codes even when stdout is not a
540 -D [ --define ] arg define a constant
541 -a [ --app ] arg application library name (default: icinga)
542 -l [ --library ] arg load a library
543 -I [ --include ] arg add include search directory
544 -x [ --log-level ] arg specify the log level for the console log.
545 The valid value is either debug, notice,
546 information (default), warning, or critical
547 -X [ --script-debugger ] whether to enable the script debugger
549 Report bugs at <https://github.com/Icinga/icinga2>
550 Icinga home page: <https://icinga.com/>
553 ## CLI command: Pki <a id="cli-command-pki"></a>
555 Provides the CLI commands to
557 * generate a new certificate authority (CA)
558 * generate a new CSR or self-signed certificate
559 * sign a CSR and return a certificate
560 * save a master certificate manually
561 * request a signed certificate from the master
562 * generate a new ticket for the client setup
564 This functionality is used by the [node setup/wizard](11-cli-commands.md#cli-command-node) CLI commands.
565 You will need them in the [distributed monitoring chapter](06-distributed-monitoring.md#distributed-monitoring).
569 icinga2 - The Icinga 2 network monitoring daemon (version: v2.11.0)
572 icinga2 <command> [<arguments>]
575 * pki new-ca (sets up a new CA)
576 * pki new-cert (creates a new CSR)
577 * pki request (requests a certificate)
578 * pki save-cert (saves another Icinga 2 instance's certificate)
579 * pki sign-csr (signs a CSR)
580 * pki ticket (generates a ticket)
583 -h [ --help ] show this help message
584 -V [ --version ] show version information
585 --color use VT100 color codes even when stdout is not a
587 -D [ --define ] arg define a constant
588 -a [ --app ] arg application library name (default: icinga)
589 -l [ --library ] arg load a library
590 -I [ --include ] arg add include search directory
591 -x [ --log-level ] arg specify the log level for the console log.
592 The valid value is either debug, notice,
593 information (default), warning, or critical
594 -X [ --script-debugger ] whether to enable the script debugger
596 Report bugs at <https://github.com/Icinga/icinga2>
597 Icinga home page: <https://icinga.com/>
600 ## CLI command: Troubleshoot <a id="cli-command-troubleshoot"></a>
602 Collects basic information like version, paths, log files and crash reports for troubleshooting
603 purposes and prints them to a file or the console. See [troubleshooting](15-troubleshooting.md#troubleshooting-information-required).
605 Its output defaults to a file named `troubleshooting-[TIMESTAMP].log` so it won't overwrite older troubleshooting files.
607 Keep in mind that this tool can not collect information from other icinga2 nodes, you will have to run it on
608 each of one of you instances.
609 This is only a tool to collect information to help others help you, it will not attempt to fix anything.
612 # icinga2 troubleshoot --help
613 icinga2 - The Icinga 2 network monitoring daemon (version: v2.11.0)
616 icinga2 troubleshoot [<arguments>]
618 Collect logs and other relevant information for troubleshooting purposes.
621 -h [ --help ] show this help message
622 -V [ --version ] show version information
623 --color use VT100 color codes even when stdout is not a
625 -D [ --define ] arg define a constant
626 -a [ --app ] arg application library name (default: icinga)
627 -l [ --library ] arg load a library
628 -I [ --include ] arg add include search directory
629 -x [ --log-level ] arg specify the log level for the console log.
630 The valid value is either debug, notice,
631 information (default), warning, or critical
632 -X [ --script-debugger ] whether to enable the script debugger
635 -c [ --console ] print to console instead of file
636 -o [ --output ] arg path to output file
637 --include-objects Print the whole objectfile (like `object list`)
638 --include-vars Print all Variables (like `variable list`)
640 Report bugs at <https://github.com/Icinga/icinga2>
641 Icinga home page: <https://icinga.com/>
644 ## CLI command: Variable <a id="cli-command-variable"></a>
646 Lists all configured variables (constants) in a similar fashion like [object list](11-cli-commands.md#cli-command-object).
649 # icinga2 variable --help
650 icinga2 - The Icinga 2 network monitoring daemon (version: v2.11.0)
653 icinga2 <command> [<arguments>]
656 * variable get (gets a variable)
657 * variable list (lists all variables)
660 -h [ --help ] show this help message
661 -V [ --version ] show version information
662 --color use VT100 color codes even when stdout is not a
664 -D [ --define ] arg define a constant
665 -a [ --app ] arg application library name (default: icinga)
666 -l [ --library ] arg load a library
667 -I [ --include ] arg add include search directory
668 -x [ --log-level ] arg specify the log level for the console log.
669 The valid value is either debug, notice,
670 information (default), warning, or critical
671 -X [ --script-debugger ] whether to enable the script debugger
673 Report bugs at <https://github.com/Icinga/icinga2>
674 Icinga home page: <https://icinga.com/>
677 ## Enabling/Disabling Features <a id="enable-features"></a>
679 Icinga 2 provides configuration files for some commonly used features. These
680 are installed in the `/etc/icinga2/features-available` directory and can be
681 enabled and disabled using the `icinga2 feature enable` and `icinga2 feature disable`
682 [CLI commands](11-cli-commands.md#cli-command-feature), respectively.
684 The `icinga2 feature enable` CLI command creates symlinks in the
685 `/etc/icinga2/features-enabled` directory which is included by default
686 in the example configuration file.
688 You can view a list of enabled and disabled features:
691 # icinga2 feature list
692 Disabled features: api command compatlog debuglog graphite icingastatus ido-mysql ido-pgsql livestatus notification perfdata statusdata syslog
693 Enabled features: checker mainlog notification
696 Using the `icinga2 feature enable` command you can enable features:
699 # icinga2 feature enable graphite
700 Enabling feature graphite. Make sure to restart Icinga 2 for these changes to take effect.
703 You can disable features using the `icinga2 feature disable` command:
706 # icinga2 feature disable ido-mysql livestatus
707 Disabling feature ido-mysql. Make sure to restart Icinga 2 for these changes to take effect.
708 Disabling feature livestatus. Make sure to restart Icinga 2 for these changes to take effect.
711 The `icinga2 feature enable` and `icinga2 feature disable` commands do not
712 restart Icinga 2. You will need to restart Icinga 2 using the init script
713 after enabling or disabling features.
717 ## Configuration Validation <a id="config-validation"></a>
719 Once you've edited the configuration files make sure to tell Icinga 2 to validate
720 the configuration changes. Icinga 2 will log any configuration error including
721 a hint on the file, the line number and the affected configuration line itself.
723 The following example creates an apply rule without any `assign` condition.
726 apply Service "my-ping4" {
727 import "generic-service"
728 check_command = "ping4"
729 //assign where host.address
733 Validate the configuration:
738 [2014-05-22 17:07:25 +0200] critical/ConfigItem: Location:
739 /etc/icinga2/conf.d/tests/my.conf(5): }
740 /etc/icinga2/conf.d/tests/my.conf(6):
741 /etc/icinga2/conf.d/tests/my.conf(7): apply Service "my-ping4" {
743 /etc/icinga2/conf.d/tests/my.conf(8): import "test-generic-service"
744 /etc/icinga2/conf.d/tests/my.conf(9): check_command = "ping4"
746 Config error: 'apply' is missing 'assign'
747 [2014-05-22 17:07:25 +0200] critical/ConfigItem: 1 errors, 0 warnings.
748 Icinga 2 detected configuration errors.
751 If you encounter errors during configuration validation, please make sure
752 to read the [troubleshooting](15-troubleshooting.md#troubleshooting) chapter.
754 You can also use the [CLI command](11-cli-commands.md#cli-command-object) `icinga2 object list`
755 after validation passes to analyze object attributes, inheritance or created
756 objects by apply rules.
757 Find more on troubleshooting with `object list` in [this chapter](15-troubleshooting.md#troubleshooting-list-configuration-objects).
760 ## Reload on Configuration Changes <a id="config-change-reload"></a>
762 Every time you have changed your configuration you should first tell Icinga 2
763 to [validate](11-cli-commands.md#config-validation). If there are no validation errors, you can
764 safely reload the Icinga 2 daemon.
767 # systemctl reload icinga2
770 The `reload` action will send the `SIGHUP` signal to the Icinga 2 daemon
771 which will validate the configuration in a separate process and not stop
772 the other events like check execution, notifications, etc.