Diagnose commands

Diagnose commands

Diagnose commands are used for debugging/troubleshooting purposes. These commands are executed from the base context.

Tail: Run this command to display the entries of a specific log file as they are printed in real time. Plugins and/or loggers may need to be enabled prior to running this command for more in-depth data gathering.

Debug Plugin: Debug plugin commands are used for listing, enabling, disabling, and getting performance metrics for the running FortiNAC plugins.

Debug Logger: Debug logger commands are used for listing loggers and setting their log levels.

Available commands

Command

diagnose agent agents [-Hx] [-all] [-columns] [-latest] [-legacy] [-platform=<os>] [-type=<type>] [-c=<cols>]...

Display available agents

Options

-all Display all installed agents

-c, <cols> Specify a Column to show. Repeat for more columns.
+
Example: -c Name Type

-columns Display available columns

-H, Display Headers

-latest Get Latest agent of a given type

-legacy Get Latest legacy agent of a given type

-platform=<os> Specify an OS to show agents for ( Windows, MacOSX, Linux )

-type=<type> Specify Agent Type

-x, Exclude special Agents (None types)

diagnose agent alarms [-create] [-disable] [--disable-lost] [--disable-regained] [-enable] [--enable-lost] [--enable-regained] [-remove] [-show] [-verify] [-adminscan=<adminScan>]

View and modify alarm mappings (legacy Lost Contact)

Options

-adminscan=<adminScan> The name of the admin scan to use. ValidAgentTest is the default

-create Create the Alarm Mapping and Alarm Action.Removes any existing mapping!!!

-disable Disable both Alarm Mappings

--disable-lost Disable Lost Contact Alarm Mapping

--disable-regained Disable Regained Contact Alarm Mapping

-enable Enable both Alarm Mappings

--enable-lost Enable Lost Contact Alarm Mapping

--enable-regained Enable Regained Contact Alarm Mapping

-remove Remove the Alarm Mapping and Alarm Action

-show Show the existing Alarm Mapping

-verify Verify that the settings are at the recommended state

diagnose agent debug [-p] [-appInventory]

[-disableDA] [-disableGlobal] [-dumphosts] [-dumpip] [-enableDA]

[-enableGlobal

[-nwswitch] [-reinit] [-supplicant]

[-validateSecurity]

[-disable=<noDebugIPAddress>]

[-dumpCache=<dumpCache>]

[-dumpPerformance=<dumpPerformance>]

[-enable=<debugIPAddress>]

[-flushCache=<flushCache>]

[-mac=<mac>] [-nwsaction=<nwsaction>]

[-poll=<ipAddress>]

[-ns=<nameServers>]... [-sd=<searchDomains>]...

Debug and diagnostics

Options

-appInventory

Request an app inventory from the host
-disable=<noDebugIPAddress>

Disable Debug for the IP Address specified.

-disableDA Disable extra debug output for the Dissolvable Agent (CSADebug -d true).

-disableGlobal, --disable-global Disable Debug for all Agent plugins.

-dumpCache=<dumpCache> Dump the contents of one of the PA server's internal data caches. (i.e -dumpCache 1,2,3,4)

-dumphosts Dump the Persistent Agent Server's list of active hosts.

-dumpip Display IP addresses which have debug enabled.

-dumpPerformance=<dumpPerformance> Dump the performance statistics for a plugin.

-enable=<debugIPAddress> Enable Debug for the IP Address specified.

-enableDA Enable extra debug output for the Dissolvable Agent (CSADebug -d true).

-enableGlobal, --enable-global Enable Debug for all Agent plugins.

-flushCache=<flushCache> Flush the contents of one of the PA server's internal data caches. (i.e -flushCache 1,2,3,4)

-mac=<mac> Check to see if the host for a MAC is in the list of active hosts.

-ns=<nameServers> Name Servers

-nwsaction=<nwsaction> The action to take with the fake Network Switch.

-nwswitch

Send a fake Network Switch to the adapter represented by -mac

-p, --performance

Display Persistent Agent Server Performance

-poll=<ipAddress>

Send a poll packet to the IP address specified.

-reinit

Reinitialize Packet Transports

-sd=<searchDomains>

Search Domains

-supplicant

Send agent specified by mac its supplicant configuration

-validateSecurity

Validate the security settings on this server.

diagnose agent directory [-list] [-subList] [-begin=<startIp>] [-disable=<disable>] [-display=<display>] [-enable=<enable>] [-end=<endIp>] [-fmt=<format>] [-remove=<remove>] [-subnet=] [-subTest=<subTest>] [-test=<test>] [-userDebug=<userDebug>] [-userID=<userID>]

Passive Agent Logins

Options

-begin=<startIp>

Start IP Range

-disable=<disable>

Disable the specified configuration.

-display=<display>

Display the specified configuration.

-enable=<enable>

Enable the specified configuration.

-end=<endIp>

End IP Range

-fmt=<format>

Select format to display information

-list

Display all configurations.

-remove=<remove>

Remove the specified configuration.

-subList

Display a table of the configured ip ranges.

-subnet=

Add or remove ip ranges from the DirectoryAgentServer's configuration. Acceptable values are add|remove

-subTest=<subTest>

Test whether an IP Address is serviced by the configured ip ranges.

-test=<test>

Display the applicable configuration. (Username must be in <username>@<domain_name> format.)

-userDebug=<userDebug>

Enable/Disable DirectoryAgentServer debug by username. (NOTE: Requires -userID flag)

-userID=<userID> Username to manipulate DirectoryAgentServer debug for. The default action is to disable debug.

diagnose agent help [-h] [COMMAND]

When no COMMAND is given, the usage help for the main command is displayed.
If a COMMAND is specified, the help for that command is shown.

Options

-h, --help Show usage help for the help command and exit.

Arguments

[COMMAND]
The COMMAND to display the usage help message for.

diagnose agent message [-duration=<duration>] [-file=<file>] [-group=<group>] [-hostsFile=<hostsFile>] [-id=<id>] [-m=<msg>] [-mac=<mac>] [-u=<url>]

Send Message to agents

Options

-duration=<duration> The number of minutes the message is valid

-file=<file> The file with one MAC Address per line to send the message to

-group=<group> The Host Group ID to send the message to

-hostsFile=<hostsFile> The file with one Host ID per line to send the message to

-id, -host=<id> The host id to send the message to

-m, -message, -msg=<msg> The message to send

-mac=<mac> The MAC address to send the message to.

-u, -url, -uri=<url> The URL to send.

diagnose agent packages [-all] [-remove=<removePkg>]

Display and manage agent packages

Options

-all Show all loaded packages

-remove=<removePkg> The package to remove.
+
Example: AgentTool packages -remove agent-2.1.2.4.jar

diagnose agent policy [-all] [-lock] [-refresh] [-sum] [-unlock] [-xml] [-name=<name>] [-os=<os>]

Scans

Options

-all Show all policies

-lock Lock the cached policies to avoid re-reading from the templates

-name=<name> Policy name

-os=<os> Get policy for specific Group Name

-refresh Clear the cached policies to re-read from the templates.

-sum Policy summary

-unlock Unlock the cached policies

-xml Output policy xml

diagnose agent products [-defUpdate=<defArchive>]

Manage Agent Product Definitions

Options

-defUpdate=<defArchive>

Absolute path to Product Definition archive.

diagnose agent protocol [-h]

[-bindAddress=<address>]

[-format=<format>]

[-id=<id>]

[-name=<name>]

[-packetQueueSize=<packetQueueSize>]

[-port=<port>]

[-tlsCertAlias=<tlsCertAlias>][-tlsCiphers=<tlsCiphers>][-tlsClientAuthAliases=<tlsClientAuthAliases>][-tlsClientAuthMode=<tlsClientAuthMode>][-tlsProtocols=<tlsProtocols>]

[-type=<transportType>] <operation>

Transport / Protocol Configuration

Options

-bindAddress=<address>
IP Address to bind to

-format=<format>
Format for list output

-h, -?, -help, --help
Help

-id=<id>
ID of the config

-name=<name>
Name of the config

-packetQueueSize=<packetQueueSize>

Max Packet Queue Size

-port=<port>
Port

-tlsCertAlias=<tlsCertAlias>
Certificate Alias of Server Certificate.

-tlsCiphers=<tlsCiphers>
Cipher suite

-tlsClientAuthAliases=<tlsClientAuthAliases>
Aliases for trusted client cert issuers

-tlsClientAuthMode=<tlsClientAuthMode>

Client Authentication mode

-tlsProtocols=<tlsProtocols>
TLS Protocols enabled

-type=<transportType>
Transport type

Arguments

<operation>
Operation: list, add, modify, remove, enable, disable

diagnose agent scan [-g] [-file=<file>] [-h=<hostsFile>] [-id=<id>]

[-mac=<mac>] [-p=<policy>]

Scan a host

Options

-file=<file>
The filename which contains one MAC address per line to perform the scan on

-g, -progress
Show progress bar to user

-h, -hostsFile=<hostsFile>
The filename which contains one Host ID address per line to perform the scan on

-id=<id>
The host id to scan

-mac=<mac>
The MAC address to scan.

-p, -policy=<policy>
The name of the policy to scan for. If not specified, use the currently applied policy.

diagnose agent settings [-all]

[-name=<settingName>] [-value=<settingValue>]

Various settings

Options

-all
Show all settings

-name=<settingName>
The name of the setting.Can be used as a filter to display specific settings

-value=<settingValue>
The new value of the setting

diagnose agent summary

Summary of Persistent Agent Hosts

diagnose agent supplicant [-dumpPolicies] [-dumpProfiles]

Display supplicant easyconnect policies and profiles

Options

-dumpPolicies Dump All Supplicant Policies

-dumpProfiles Dump All WifiConfiguration Profiles

diagnose agent update [-purge] [-agent=<agentID>] [-file=<file>] [-id=<id>] [-mac=<mac>] [-wait=<secondsToWait>]

Update persistent agents

Options

-agent=<agentID> The agent ID (UUID) to update to

-file=<file> The filename which contains one MAC address per line to perform the update on

-id=<id> The host id to update

-mac=<mac> The MAC address to update.

-purge Purge ALL update attempt records

-wait=<secondsToWait> The maximum time in seconds to wait for the update to occur.

diagnose agent usb [-deviceclass=<deviceClass>] [-deviceid=<deviceId>] [-friendlyName=<friendlyName>] [-id=<id>] [-matchtype=<matchType>] [-name=<name>] [-op=<operation>]

USB Disk Detection

Options

-deviceclass=<deviceClass> Filter for device Class (use single quotes)

-deviceid=<deviceId> Filter for device ID (use single quotes)

-friendlyName=<friendlyName> Filter for device Friendly Name (use single quotes)

-id=<id> The ID of the filter to list or remove

-matchtype=<matchType> Match Type

-name=<name> A name for the filter

-op=<operation> Allow or Remove an allowed USB Disk filter

diagnose debug logger unset <name>

Unset log level for a logger (INHERIT)

Arguments

<name>
Logger name

diagnose debug plugin disable <name>

Disable plugin debugging

Arguments

<name>
Plugin name

diagnose debug plugin enable <name>

Enable plugin debugging

Arguments

<name>
Plugin name

diagnose debug plugin perf [<name>]

Show plugin performance
Arguments

[<name>]
Plugin Name

diagnose hardware lspci [-v]

List PCI parameters.

Options

-v, Display admin user records

diagnose host adapter-attributes list (all | dbid=<dbid>)

List attributes of Dynamic Client

Options

all

Select all clients

dbid=<dbid>

Select by DBID of the client

diagnose host adapter-attributes update <dbid> <name> <value>

Update attributes of Dynamic Client

<dbid>

DBID of the client

<name>

Name of the attribute

<value>

new value to update the attribute with

Delete the selected host and its adapters

Options

all
Select all host records

dbid=<dbid>
Select host records by database id

owner=<owner>
Select host records by owner name

mac=<mac>
Select host records by MAC address

type=<type>
Select host records by type eg. 9, 6

host-name=<host-name>
Select host records by the host name of the host

role=<role>
Select host records by the role of a host

diagnose host device-profiling fingerprint delete help

Display usage

diagnose host device-profiling fingerprint display help

Display usage

diagnose host device-profiling fingerprint help

Display usage

diagnose host device-profiling fingerprint stats help

Display usage

diagnose host device-profiling host display all [-notes]

Display all Device Profiling host information

Options

-notes Include notes in output

diagnose host device-profiling host display profile-id [-notes] <id>

Display host device profiling information by profile id

Options

-notes Include notes in output

Arguments

<id>
Profile ID

diagnose host device-profiling host display profile-name [-notes] <name>

Display host device profiling information by profile name

Options

-notes Include notes in output

Arguments

<name>
Profile name

diagnose host device-profiling host display rule-id [-notes] <id>

Display Device Profiling host information for specified rule id

Options

-notes Include notes in output

Arguments

<id>
Rule ID

diagnose host device-profiling host display rule-name [-notes] <name>

Display Device Profiling host information for specified rule name

Options

-notes Include notes in output

Arguments

<name>
Rule name

diagnose host device-profiling host display sponsor-id [-notes] <id>

Display Device Profiling host information with matching sponsor id

Options

-notes Include notes in output

Arguments

<id>
Sponsor ID

diagnose host device-profiling host display sponsor-username [-notes]<username>

Display Device Profiling host information with matching sponsor username

Options

-notes Include notes in output

Arguments

<username>
Sponsor username

diagnose host device-profiling rules display all

Display all Device Profiling Rules

diagnose host device-profiling rules display id <id>

Display a device profiling rule by ID

Arguments

<id>
Device profiling rule ID

diagnose host device-profiling rules display name <name>

Display device profiling rule by name

Arguments

<name>
Device profiling rule name

diagnose host device-profiling rules export <filename>

Export Device Profiling rules to specified file

Arguments

<filename>
Filename for exported Device Profiling rules

diagnose host device-profiling rules help

Display usage

diagnose host device-profiling rules import <filename>

Import Device Profiling rules from specified file

Arguments

<filename>
Filename containing Device Profiling rules to import

diagnose host device-profiling rules scan all

Scan all rogues

diagnose host device-profiling rules scan flush

Flush scan queue

diagnose host device-profiling rules scan mac <mac>

Scan a specified MAC address

Arguments

<mac>
MAC address to scan

diagnose host device-profiling rules scan size

Display the scan queue size

disable the selected hosts and its adapters.

Options

all
Select all host records

dbid=<dbid>
Select host records by database id

host-name=<host-name>
Select host records by the host name of the host

mac=<mac>
Select host records by MAC address

owner=<owner>
Select host records by owner name

role=<role>
Select host records by the role of a host

type=<type>
Select host records by type eg. 9, 6

enable the selected hosts and its adapters.

Options

all
Select all host records

dbid=<dbid>
Select host records by database id

owner=<owner>
Select host records by owner name

mac=<mac>
Select host records by MAC address

type=<type>
Select host records by type eg. 9, 6

host-name=<host-name>
Select host records by the host name of the host

role=<role>
Select host records by the role of a host

List host records.

Options

all
Select all host records

dbid=<dbid>
Select host records by database id

owner=<owner>
Select host records by owner name

mac=<mac>
Select host records by MAC address

type=<type>
Select host records by type eg. 9, 6

host-name=<host-name>
Select host records by the host name of the host

role=<role>
Select host records by the role of a host

-format=<format> Format must be one of: text, json, xml

-adapters Include adapters in the output

diagnose network aaa add <server-name> <server-ip> <authentication-port>

<accounting-port> <secret> <user> <user-password>

Add a server definition.

Arguments

<server-name>

Name of a server definition used for addition.

<server-ip>

IP address of a server definition used for addition.

<authentication-port>

Server authentication port.

<accounting-port>

Server accounting port.

Server secret.

<user>

Test user name.

<user-password>

User password.

diagnose network aaa delete <server-name>

Delete a server definition.

Arguments

<server-name>

Name of a server definition used for deletion.

diagnose network aaa display (ip=<ip> | all | id=<id> | name=<name>)

Display information of the AAA Server database.

Options

all

Choose all servers in table

id, <id>

Database id of a server definition

ip, <ip>

IP address of a server definition

name=<name>

Name of a server definition

diagnose network aaa modify [accounting-port=<accounting-port>]

[authentication-port=<authentication-port>]

[secret=<secret>] [server-ip=<server-ip>]

[server-name=<server-name>] [user-name=<user-name>]

[user-password=<user-password>] <server>

Modify a server definition.

Options

server-name=<server-name>

Name of a server to be modified.

server-ip=<server-ip>

Server Definition IP Address.

authentication-port=<authentication-port>

Server authentication port.

accounting-port=<accounting-port>

Server accounting port.

secret=<secret>

Server secret.

user-name=<user-name>

Test user name.

user-password=<user-password>

Test user password.

Arguments

Server(s) available for modification.

diagnose network arp-cache find-ip [--cacheOnly] <ip>

Find a specific IP->Mac entry by the IP address

Options

--cacheOnly Only attempt to get the entry from the cache, do not trigger a poll of L3 to find it

Arguments

<ip>
IP Address of the device

diagnose network arp-cache find-mac [--cacheOnly] <mac>

Find a specific IP->Mac entry by the MAC address

Options

--cacheOnly Only attempt to get the entry from the cache, do not trigger a poll of L3 to find it

Arguments

<mac>
MAC Address of the device

diagnose network arp-cache list (ip=<ip> | all | dbid=<dbid> | group=<group>)

List the arp cache for one or all devices

Options

ip, <ip>
Select by IP Address of the device

all
Select all devices

dbid=<dbid>
Select by DBID of the device

group=<group>
Select all members of the provided group

diagnose network arp-cache update (ip <ip> | all | dbid <dbid> | group <group>)

Trigger a real L3 poll for the device(s) in question

Options

ip, <ip>
Select by IP Address of the device

all
Select all devices

dbid <dbid>
Select by DBID of the device

group <group>
Select all members of the provided group

diagnose network device certificate import [--ca-only]

Import device certificate chain

Options

--ca-only: Import only the CA certificates. By default, all the certificates are imported.

diagnose network device certificate show

Show device certificate information

diagnose network device certificate verify

Verify if the device certificate can be trusted

diagnose network device cdiagnose network device certificate show li-tool group <group> <command>...

Get the device using group name

Arguments

<group>
Device group name

<command>...
CLI command(s) to be sent to the device

diagnose network device cli-tool ip <ip> <command>...

Get the device using IP Address

Arguments

<ip>
IP Address of the device

<command>...
CLI command(s) to be sent to the device

Deletes the specified attribute of the device.

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

Arguments

<name>
Name of the attribute to delete.

Delete the device.

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

Deletes the specified port attribute for all ports on the device.

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

Arguments

<name>
Name of the port attribute to delete.

Display device model information.

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

diagnose network device export [-type=<type>] <filename> <protocol>

Export all eligible device information.

Options

-type=<type> Type of export devices eg. Unix, Registered Host, Server, Health Care Device, IPS/IDS, Windows, Printer, IP Phone, Alarm System, Hub, VPN, Environmental Control, Network, Watch, Gaming Device, UPS, Camera, Card Reader, macOS, Vending Machine, Wireless Access Point, PBX, Point of Sale, Generic Monitoring System, Android, Apple iOS, Firewall, Storage, Linux, Smart Home, Television, Pingable, Media Player, Mobile Device, Dialup Server

Arguments

<filename>
File name to export.

<protocol>
Protocol value snmp, pingable

diagnose network device grab-debug <ip>

Gather a debug report for the specified device.

Arguments

<ip>
Ip address of the device to gather a debug report

diagnose network device read-forwarding-table [-an] (ip=<ip> | all |group=<group>)

Read the forwarding table for the selected devices.

Options

ip, <ip>
IP Address of the device to read forwarding table information

all
Read forwarding table information for all devices

group=<group>
Device group name to read forwarding table information

-n, -no-update-vlans Do not update VLAN ID before performing L2 Poll

-a, -apply Apply the data read from the forwarding table to create and update host and adapter records

Sets the specified attribute of selected device.

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

Arguments

<name>
attribute name to be set

<value>
attribute value to be set

Sets the cli credential attribute onto the selected device.

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

Arguments

<user-name>
user name to be set

<password>
password to be set

<enable-password>
password to be set

<session-type>
session type to be set telnet, ssh, ssh2

set selected device(s) Status to Established.

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

Set selected device(s) Name.

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

Arguments

<name>
Name which needs to be set

Set selected device(s) pollable contact status.

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

Arguments

<pollable>
Device contact status polling enable, disable

Set selected device(s) contact status polling interval.

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

Arguments

<interval>
Time in minutes

Sets the specified port attribute for every port on the device

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

Arguments

<name>
attribute name to be set

<value>
attribute value to be set

Set selected device's role.

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

Arguments

<role>
role name

diagnose network device tail [-adds] [-removes] [-updates]

[class=<device-class>]

[container-name=<container-name>] [dbid=<dbid>]

[ident=<ident>] [ip=<ip>] [mac=<mac>]

[name=<name>] [parent=<parent>]

[protocol=<protocol>] [role=<role>]

[state=<state>] [status=<status>]

[attribute-name-list=<attribute-name-list>...]...

[attribute-value-list=<attribute-value-list>...]...

[type-list=<type-list>...]...

Display the changes to elements in the element table.

Options

-adds

-removes

-updates

ip, <ip>

IP Address of the device

dbid=<dbid>

Database id of the device

ident=<ident>

Identification of the device

class=<device-class>

Device class of the device

container-name=<container-name>

Select device by container name

name=<name>

Name of the device

parent=<parent>

Parent of the device

mac=<mac>

Physical address of the device

type-list=<type-list>...

Select the device using typelist

role=<role>

Role of the device

protocol=<protocol>

Protocol of the device

status=<status>

Status of the device

attribute-name-list=<attribute-name-list>...

Select the device using attribute name list

attribute-value-list=<attribute-value-list>...

Select the device using attribute value list

state=<state>

State of the device

Test device(s) snmp credentials.

Options

all
select all devices

attribute-name=<attribute-name>
select by device attribute

class-id=<class-id>
select device(s) by class in the range 0-56

container-name=<container-name>
select device by container name

dbid=<dbid>
select device by database Id

device-name=<device-name>
select device by name

group=<group>
select device(s) by group name

ip, <ip>
select device by IP Address

mac=<mac>
select device by MAC Address

diagnose network device tree (ip=<ip> | all)

Returns an Inventory tree of devices, ports, adapters and logged on users

Options

ip, <ip>
Device IPv4 Address

all
Returns an Inventory tree of all devices

diagnose network device update-interfaces (ip <ip> | all | group <group>)

Update the Interfaces on one or all devices

Options

ip, <ip>
IP Address of the device

all
Update Interfaces on all devices

group <group>
Update Interfaces for the group

diagnose network device update-version (ip=<ip> | all)

This program will update the version attribute on one or all devices

Options

ip, <ip>
IP Address of the device

all
Update Version on all devices

diagnose network l2-proactive-polling (all | ip=<ip> | dbid=<dbid> | group=<group>)

Display any proactive polling information.

Options

all
Select all device

ip, <ip>
Select the device by ip address

dbid=<dbid>
Select the device by database id

group=<group>
select device(s) by group name

diagnose network mac-notification-stats [num-devs=<num-devs>] [num-macs=<num-macs>] (all | mac=<mac> | dbid=<dbid>)

Display MAC Notification Trap handling statistics maintained by the running Network Sentry process.

Options

all
Display all stats

mac=<mac>
Display trap stats for the specified MAC Address

dbid=<dbid>
Display trap stats for specified network device

num-macs=<num-macs>
Display number of most active MAC Addresses

num-devs=<num-devs>
Display number of most active network devices

diagnose network mib-info (ip=<ip> | name=<name> | MIB-name=<MIB-name> | all)

Returns the Device Type, Telnet MIB file, and MIB ID that will be used for a device.

Options

ip, <ip>
Device IPv4 Address

name=<name>
Device Name

MIB-name=<MIB-name>
Returns MIB info for devices that use the specified MIB file

all
Returns MIB info for all devices

diagnose network port advanced clean

Clean the device port data

diagnose network port advanced fix-duplicates (ip=<ip> | all |device-name=<device-name> | group=<group>)

Fix the duplicate interfaces

Options

ip, <ip>
IP Address of the device

all
Perform action on all devices

device-name=<device-name>
Name of the device

group=<group>
Device Group Name

diagnose network port advanced set-default (ip=<ip> | all |device-name=<device-name> | group=<group>)

Set the current VLAN value into the default

Options

ip, <ip>
IP Address of the device

all
Perform action on all devices

device-name=<device-name>
Name of the device

group=<group>
Device Group Name

diagnose network port advanced set-display-name (ip=<ip> | all |device-name=<device-name> | group=<group>)

Set Display Name

Options

ip, <ip>
IP Address of the device

all
Perform action on all devices

device-name=<device-name>
Name of the device

group=<group>
Device Group Name

diagnose network port advanced set-interface-name (ip=<ip> | all |device-name=<device-name> | group=<group>)

Set IfName

Options

ip, <ip>
IP Address of the device

all
Perform action on all devices

device-name=<device-name>
Name of the device

group=<group>
Device Group Name

diagnose network port display (ip=<ip> | all | device-name=<device-name> | group=<group>)

Display ports and their attributes

Options

ip, <ip>
IP Address of the device

all
Perform action on all devices

device-name=<device-name>
Name of the device

group=<group>
Device Group Name

diagnose network radius send-coa disconnect <ip> <mac>

Disconnect client

Arguments

<ip>
NAS device IP

<mac>
Mac address of client to impact

diagnose network radius send-coa set-policy <ip> <mac> <policy>

VLAN/Role/etc to change for the client using CoA command

Arguments

<ip>
NAS device IP

<mac>
Mac address of client to impact

<policy>
VLAN/Role/etc to change for the client using CoA command

diagnose network remote-access delete (ip=<ip> | mac-address=<mac-address>)

Delete Probe Objects for remote hosts connected through remote access devices

Options

ip, <ip>
Delete Remote Probe Objects for the supplied IPv4 Address

mac-address=<mac-address>
Delete Remote Probe Objects for the supplied MAC Address

diagnose network remote-access list (ip=<ip> | mac-address=<mac-address> | device-ip=<ip> | managed-addresses | all)

List Probe Objects for remote hosts connected through remote access devices

Options

ip, <ip>
Return Remote Probe Objects for the supplied IPv4 Address

mac-address=<mac-address>
Return Remote Probe Objects for the supplied MAC Address

device-ip=<ip>
Return all Probe Objects associated with the supplied remote access device

managed-addresses
Return a list of managed IP Addresses for remote hosts

all
Return all Probe Objects for remote hosts

diagnose network remote-access update ip=<ip>

Update Probe Objects for remote hosts connected through remote access devices

Options

ip, <ip>
Device IPv4 Address

diagnose network snmp set [--debug] <ip> <oid> <type> <value>

Set the value of an OID for a given IP

Options

--debug Turns on detailed debug

Arguments

<ip>
IP Address of the device

<oid>
OID value to manipulate data through snmp4j commands

<type>
Type of value to set for this command. Please provide TYPE as one of the following : integer, unsignedinteger, timeticks, ipaddress, oid, string, hexstring, decimalstring, bits, counter, counter64, macaddress, gauge

<value>
Value to set for this command

diagnose network snmp walk [--bulk] [--debug] [--c <context>] <ip> <oid>

Provides SNMP Walk data for an OID of a given IP

Options

--c, --context <context> The context value

--debug Turns on detailed debug

--bulk Does a bulk get instead of a getNext

Arguments

<ip>
IP Address of the device

<oid>
OID value to manipulate data through snmp4j commands

diagnose network sso agent list all

List all the agents session info

diagnose network sso agent list ip <ip-address>

Session information of matching agents

Arguments

<ip-address>

IP address of the matching agent

diagnose network sso clear <agent-key>

Clear SSO messages of the agents

Arguments

<agent-key>

agent key to clear the SSO messages

diagnose network sso session-list [-rs] [-init] (ip=<ip> | group=<group>)

Lists the selected device(s) session info

Options

ip, <ip>

IP Address of the device

group=<group>

Device group name to get session information for the devices in the group

-init

initialize sso device

-r, -run

Add SSO message synchronization with devices.

-s, -show-address

show SSO registered addresses

diagnose network vlan change <ip> <port> <vlan>

Change VLAN on a single port for a device

Arguments

<ip>
IP Address of the device

<port>
IfName/suffix of the port

<vlan>
VLAN to change to

diagnose network vlan display (ip=<ip> | all | group=<group>) <vlan>

Accepts VLAN as parameter and display ports that are associated with it

Options

ip, <ip>
IP Address of the device

all
Select all devices

group=<group>
Select all members of the provided group

Arguments

<vlan>
Specify the VLAN for this command

diagnose network vlan fix-default-vlan (ip=<ip> | all | group=<group>) <vlan>

Fix ports with bad default

Options

ip, <ip>
IP Address of the device

all
Select all devices

group=<group>
Select all members of the provided group

Arguments

<vlan>
Specify the VLAN for this command

diagnose network vlan set-current-as-default (ip=<ip> | all | group=<group>)

Set the Default VLAN to whatever the current VLAN is on the port

Options

all
Select all devices

group=<group>
Select all members of the provided group

ip, <ip>
IP Address of the device

diagnose network vlan set-registration-vlan (ip=<ip> | all | group=<group>)<vlan>

Set the Registration vlan

Options

ip, <ip>
IP Address of the device

all
Select all devices

group=<group>
Select all members of the provided group

Arguments

<vlan>
Specify the VLAN for this command

diagnose network vlan update ports (ip=<ip> | all | group=<group>)

Update Ports on the device(s). Clears out the PortID attribute of all the port models and set the values afresh based on the latest info from the device.

Options

ip, <ip>
IP Address of the device

all
Select all devices

group=<group>
Select all members of the provided group

diagnose network vlan update vlans [--diff] [--readOnly] (ip=<ip> | all | group=<group>)

Update VLANs on the device(s). Refresh the device modeling to represent the most recent device configuration.

Options

ip, <ip>
IP Address of the device

all
Select all devices

group=<group>
Select all members of the provided group

--readOnly Operates in ReadOnly mode

--diff Returns Difference in results

diagnose sql db-size

Retrieve database size information

diagnose sql process kill <id>

Retrieve the database process listing

Arguments

<id>

ID of process to terminate

diagnose sql process list [full]

Retrieve the database process listing

Options

full

Display full process list

diagnose system bridge-performance check-vlan client-id <dbid>

Determines if a VLAN change is warranted for the switch port the specified Client (Host) is connected to, based on the host's state and the port's current VLAN.

Arguments

<dbid>
client-dbid

diagnose system bridge-performance check-vlan port-id <dbid>

Determines if a VLAN change is warranted for the specified port based on the state of the Host(s) currently connected to the port and the port's current VLAN.

Arguments

<dbid>
port-dbid

diagnose system bridge-performance debug device <enable|disable> <ipaddress>

Debug logging for the specified network device IP in BridgeManager. If enabled, the log output is appended to output.master.

Arguments

<enable|disable>
enable | disable

<ipaddress>
Device IP

diagnose system bridge-performance debug mac-notify <enable|disable>

Enable / Disable MAC Notification Trap debug

Arguments

<enable|disable>
enable | disable

diagnose system bridge-performance dump

Prints out the BridgeManager performance statistics.

diagnose system entitlements [-debug] [-poll]

Print out entitlements information

Options

-debug run with debug

-poll force a poll

diagnose system event [after <startDate>] [before <endDate>] [name <name>]

Display event information

Options

after <startDate>
Display events after specified date/time (YYYY-MM-DD HH:MM:SS)

before <endDate>
Display events before specified date/time (YYYY-MM-DD HH:MM:SS)

name <name>
Display events matching specified event name

diagnose system global-option display all

Display all of the current global options

diagnose system global-option display dbid <dbid>

Display global option by database ID

Arguments

<dbid>
Global option database ID

diagnose system global-option display name <name>

Display global option by specific name

Arguments

<name>
Global option name

diagnose system global-option set days <attribute> <days>

Set number of days

Arguments

<attribute>
The global option attribute to modify

<days>
Number of days

diagnose system global-option set hours <attribute> <hours>

Set number of hours

Arguments

<attribute>
The global option attribute to modify

<hours>
Number of hours

diagnose system global-option set minutes <attribute> <minutes>

Set number of minutes

Arguments

<attribute>
The global option attribute to modify

<minutes>
Number of minutes

diagnose system global-option set password <attribute> <password>

Set a password

Arguments

<attribute>
The global option attribute to modify

<password>
New password

diagnose system global-option set raw <attribute> [<value>...]

Set a raw value

Arguments

<attribute>
The global option attribute to modify

[<value>...]
Raw value

diagnose system global-option set seconds <attribute> <seconds>

Set number of seconds

Arguments

<attribute>
The global option attribute to modify

<seconds>
Number of seconds

diagnose system global-option set value <attribute> <value>

Set a value

Arguments

<attribute>
The global option attribute to modify

<value>
Value to set

diagnose system group clear-time id <id>

Clear valid/inactive times for elements in the specified Host group by id

Arguments

<id>
Group ID

diagnose system group clear-time name <name>

Clear valid/inactive times for elements in the specified Host group by name

Arguments

<name>
Group Name

diagnose system group delete id <id>

Delete the selected group using database ID

Arguments

<id>
Delete the selected group by ID

diagnose system group delete name <name>

Delete the selected group

Arguments

<name>
Delete the selected group by name

diagnose system group display all [-elements]

Display all groups

Options

-elements Display group information and elements

diagnose system group display id [-elements] <groupID>

Display group information and/or elements using group ID

Options

-elements Display group information and elements

Arguments

<groupID>
Select group with specified name

diagnose system group display name [-elements] <name>

Display group information and/or elements by group name

Options

-elements Display group information and elements.

Arguments

<name>
Select group with specified name

diagnose system group element add (-userdbid=<userDbID> | -hostdbid=<hostDbID> | -portdbid=<portDbID> | -devicedbid=<deviceDbID> | -groupdbid=<groupDbID>) <name>

Add an element to the selected group

Options

-devicedbid=<deviceDbID> Database ID of device to delete from selected device group

-groupdbid=<groupDbID> Database ID of managed group to delete from selected group

-hostdbid=<hostDbID> Database ID of host to delete from selected host group

-portdbid=<portDbID> Database ID of port to delete from selected port group

-userdbid=<userDbID> Database ID of user to delete from selected user group

Arguments

<name>
Specified element name

diagnose system group element remove (-userdbid=<userDbID> | -hostdbid=<hostDbID> | -portdbid=<portDbID> | -devicedbid=<deviceDbID> | -groupdbid=<groupDbID>) <name>

Remove an element referenced by name from the selected group

Options

-devicedbid=<deviceDbID> Database ID of device to delete from selected device group

-groupdbid=<groupDbID> Database ID of managed group to delete from selected group

-hostdbid=<hostDbID> Database ID of host to delete from selected host group

-portdbid=<portDbID> Database ID of port to delete from selected port group

-userdbid=<userDbID> Database ID of user to delete from selected user group

Arguments

<name>
Specified element name

diagnose system scheduled-task delete <task-name>

Delete a scheduled task.

Arguments

<task-name>
Select the task by task name

diagnose system scheduled-task display all [-hidden] <task-name>

Display summary of all scheduled tasks.

Options

-hidden

Show system tasks normally hidden.

Arguments

<task-name>

Select the task by task name

diagnose system scheduled-task display id <task-name>

Display detailed of a scheduled task.

Arguments

<task-name>
Select the task by task name

diagnose system scheduled-task enable <task-name>

Enable a scheduled task.

Arguments

<task-name>
Select the task by task name

diagnose system scheduled-task pause <task-name>

Pause a scheduled task.

Arguments

<task-name>
Select the task by task name

diagnose system scheduled-task run <task-name>

Run a scheduled task.

Arguments

<task-name>
Select the task by task name

diagnose system send-test-email [-file=<fileName>] -message=<message> -subject=<subject> -to=<mailTo>

Send a Test email to verify Email server config

Options

-file=<fileName> File to attach to test email

-message=<message> Message to be used in the test email ex: This is a mail test

-subject=<subject> Subject to be used in the test email ex: mail test

-to=<mailTo> Email To address ex: user@mail.com

diagnose system server-certificates show all

Shows all the server certificates

diagnose system server-certificates show sha1 <sha1>

Shows the certificates by sha1

Arguments

<sha1>

sha1 fingerprint

diagnose system server-certificates show type <type>

Shows the certificates by target type

Arguments

<type>

Certificate type

diagnose system trusted-certificates show all

Shows all the trusted certificates

diagnose system trusted-certificates show issuer <dn>

Shows the trusted certificates by issuer

Arguments

<dn>

Issuer DN name. Full or partial name can also be used.

diagnose system trusted-certificates show sha1 <sha1>

Shows the trusted certificates by sha1

Arguments

<sha1>

sha1 fingerprint

diagnose system trusted-certificates show subject <dn>

Shows the trusted certificates by subject

Arguments

<dn>

Subject DN name. Full or partial name can also be used.

New subcommand "diagnose system tail-clients":

diagnose system tail-clients adapter [-adds] [-removes] [-updates] [ip=<ip>]

[location=<location>] [mac=<mac>]

Options

-adds

-removes

-updates

mac=<mac>

Physical address of the adapter.

ip, <ip>

IP Address assigned to the adapter.

location=<location>

Location of the adapter in the network.

diagnose system tail-clients host [-adds] [-removes] [-updates] [os=<os>]

[role=<role>] [type=<type>]

Options

-adds

-removes

-updates

os, <os>

Host's operating system

role=<role>

Role assigned to the host

type=<type>

The host type

diagnose system tail-clients multi [-adds] [-removes] [-updates] <filter-type>

-multi requires another argument indicating the primary filter type: [adapter | host | user]

Options

-adds

-removes

-updates

Arguments

<filter-type>

adapter, host, user

diagnose system tail-clients user [-adds] [-removes] [-updates]

[firstname=<firstname>] [lastname=<lastname>]

[userrole=<userrole>]

Options

-adds

-removes

-updates

lastname=<lastname>

User's last name

firstname=<firstname>

User's first name

userrole=<userrole>

Role assigned to the user

diagnose user admin-profile display all

Display all Admin Profiles

diagnose user admin-profile display id <id>

Display a specified Admin Profile by ID

Arguments

<id>
Admin Profile ID

diagnose user admin-profile display name <name>

Display a specified Admin Profile by name

Arguments

<name>
Admin Profile name

Delete the user record(s).
'all' will delete all user records - Be Careful!!!

Options

all
Select all user records

dbid=<dbid>
Select user records by database id

first=<first>
Select user records by first name

last=<last>
Select user records by last name

email=<email>
Select user records by email id

user-id=<user-id>
Select user records by user id

diagnose user guest-templates list (all | name=<name> | dbid=<dbid>)

list guest template information.

Options

all
Select all the guest templates

dbid=<dbid>
Select guest templates by database id

name=<name>
Select the guest templates by the name

List user records.

Options

all
Select all user records

dbid=<dbid>
Select user records by database id

first=<first>
Select user records by first name

last=<last>
Select user records by last name

email=<email>
Select user records by email id

user-id=<user-id>
Select user records by user id

-admin Display admin user records

-policy Display policy for selected user

device-id=<device-id>
device id (used with -policy)

execute restore config local <config file>

Restore configuration via local configuration backup

Arguments

<config file>
Config file to restore

execute restore config scp <remote file> <host> <username> <password>

Restore configuration via SCP

Arguments

<remote file>
Config file to restore

<host>
Host to retrieve config file from

<username>
Username

<password>
Password

execute restore config tftp <remote file> <host>

Restore configuration via TFTP

Arguments

<remote file>
Config file to restore

<host>
Host to retrieve config file from

diagnose-agent

Agent-related configuration and diagnostics

agents

Display available agents

alarms

View and modify alarm mappings (legacy Lost Contact)

debug

Debug and diagnostics

directory, passive

Passive Agent Logins

message

Send Message to agents

packages

Display and manage agent packages

policy, scans

Scans

protocol

Transport / Protocol Configuration

scan

Scan a host

settings

Various settings

summary

Summary of Persistent Agent Hosts

supplicant

Display supplicant easyconnect policies and profiles

update

Update persistent agents

usb

USB Disk Detection

help

Displays help information about the specified command

diagnose agent agents [-Hx] [-all] [-columns] [-latest] [-legacy] [-platform=<os>] [-type=<type>] [-c=<cols>]…

Display available agents

Options

-all

Display all installed agents

-c, <cols>

Specify a Column to show. Repeat for more columns.

Example: -c Name Type

-columns

Display available columns

-H,

Display Headers

-latest

Get Latest agent of a given type

-legacy

Get Latest legacy agent of a given type

-platform=<os>

Specify an OS to show agents for ( Windows, MacOSX, Linux )

-type=<type>

Specify Agent Type

-x,

Exclude special Agents (None types)

diagnose agent alarms [-create] [-disable] [--disable-lost]

[--disable-regained] [-enable] [--enable-lost]

[--enable-regained] [-remove] [-show] [-verify]

[-adminscan=<adminScan>]

diagnose tail (-F|-f|-k <numKB>) [<file>]

Tails the specified logfile.

Example:

diagnose tail -F output.master

Tab completion can be used to list the files available to tail.

Ctrl-C stops tail.

Available options:

-F

Follow the file changes as it is updated. Follow through the file being replaced

-f

Follow the file changes as it is updated. Does not follow if the file is replaced

-k <numKB>

Display only the last numKB kibibytes of the file

diagnose debug logger list

Lists all the loggers available

Sets the log level for the specified logger to the chosen log level (eg info, severe, etc)

diagnose debug logger unset [<logger>]

Unset the specified loggers log level back to INHERIT

diagnose debug plugin list

Lists all the plugins, their associated loader, and their debug status. Type “q” to return to prompt

diagnose debug plugin list-debug-enabled

Lists all the debug-enabled plugins along with their associated loader

diagnose debug plugin perf [<plugin>]

Display the performance metrics for the specified plugin

diagnose debug plugin [enable|disable] [<plugin>]

Enable or disable debug for the specified plugin

diagnose send-test-email [-file=<fileName>] -message=<message> -subject=<subject> -to=<mailTo>

Send a Test email to verify Email server configuration.

diagnose entitlements [-debug] [-poll]

Print out entitlements information.

diagnose group [COMMAND]

Display and manipulate group model information

Available options:

`display-all`	Display all groups
`display-group-by-name`	Display group information and/or elements by group name
`display-group-by-id`	Display group information and/or elements using group ID
`delete-group-by-id`	Delete the selected group using database ID
`delete-group-by-name`	Delete the selected group
`clear-time-by-name`	Clear valid/inactive times for elements in the the Host group
`clear-time-by-id`	Clear valid/inactive times for elements in the the Host group
`delete-from-group-by-name`	Delete an element referenced by name from the selected group
`add-element-to-group`	Add an element to the selected group
`help`	Display usage

diagnose hardware deviceinfo disk

Display information of all disks.

diagnose hardware deviceinfo nic [<ifname>]

Display NIC information.

diagnose hardware deviceinfo tpm

Display TPM information.

diagnose hardware info

Show hardware info.

diagnose hardware lspci [-v]

List PCI parameters.

Option

-v : Display verbose output

diagnose hardware lspci [-tv]

List PCI parameters.

Options

-v,

Display PCI parameters with details

-t,

Display PCI parameters in tree format

diagnose hardware psu

Show power supply info

diagnose hardware sysinfo cpu

Display detailed information for all installed CPU(s).

diagnose hardware sysinfo interrupts

Display system interrupts information.

diagnose hardware sysinfo iomem

Display memory map of I/O ports.

diagnose hardware sysinfo ioports

Display address list of I/O ports.

diagnose hardware sysinfo memory

Display system memory information.

diagnose hardware sysinfo mtrr

Display memory type range registers.

diagnose hardware sysinfo partitions

Display disk partitions.

diagnose hardware sysinfo slab

Display memory allocation information.

diagnose hardware sysinfo systime

Display system time information.

diagnose system disk info

Show the SMART information.

diagnose system disk health

Show the SMART health status.

diagnose system disk errors

Show the SMART error logs.

diagnose system disk attributes

Show vendor specific SMART attributes.

diagnose system raid status

Show RAID status.