DSCTL(8) Generated Python Manual DSCTL(8)

# [NAME](#NAME)

dsctl

# [SYNOPSIS](#SYNOPSIS)

**dsctl** \[-h] \[-v] \[-j] \[-l] \[instance] {restart,start,stop,status,remove,db2index,db2bak,db2ldif,dbverify,bak2db,ldif2db,backups,ldifs,index-check,tls,healthcheck,get-nsstate,ldifgen,dsrc,cockpit,dblib,thread-pool} ...

# [POSITIONAL ARGUMENTS](#POSITIONAL_ARGUMENTS)

[**dsctl** *restart*](#dsctl)

Restart an instance of Directory Server, if it is running: else start it.

[**dsctl** *start*](#dsctl~2)

Start an instance of Directory Server, if it is not currently running

[**dsctl** *stop*](#dsctl~3)

Stop an instance of Directory Server, if it is currently running

[**dsctl** *status*](#dsctl~4)

Check running status of an instance of Directory Server

[**dsctl** *remove*](#dsctl~5)

Destroy an instance of Directory Server, and remove all data.

[**dsctl** *db2index*](#dsctl~6)

Initialise a reindex of the server database. The server must be stopped for this to proceed.

[**dsctl** *db2bak*](#dsctl~7)

Initialise a BDB backup of the database. The server must be stopped for this to proceed.

[**dsctl** *db2ldif*](#dsctl~8)

Initialise an LDIF dump of the database. The server must be stopped for this to proceed.

[**dsctl** *dbverify*](#dsctl~9)

Perform a db verification. You should only do this at direction of support

[**dsctl** *bak2db*](#dsctl~10)

Restore a BDB backup of the database. The server must be stopped for this to proceed.

[**dsctl** *ldif2db*](#dsctl~11)

Restore an LDIF dump of the database. The server must be stopped for this to proceed.

[**dsctl** *backups*](#dsctl~12)

List backup's found in the server's default backup directory

[**dsctl** *ldifs*](#dsctl~13)

List all the LDIF files located in the server's LDIF directory

[**dsctl** *index-check*](#dsctl~14)

Check for index ordering mismatches (parentid/ancestorid). The server must be stopped.

[**dsctl** *tls*](#dsctl~15)

Manage TLS certificates

[**dsctl** *healthcheck*](#dsctl~16)

Run a healthcheck report on a local Directory Server instance. This is a safe and read-only operation. Do not attempt to run this on a remote Directory Server as this tool needs access to local resources, otherwise the report may be inaccurate.

[**dsctl** *get-nsstate*](#dsctl~17)

Get the replication nsState in a human readable format

Replica DN: The DN of the replication configuration entry Replica Suffix: The replicated suffix Replica ID: The Replica identifier Gen Time The time the CSN generator was created Gen Time String: The time string of generator Gen as CSN: The generation CSN Local Offset: The offset due to the local clock being set back Local Offset String: The offset in a nice human format Remote Offset: The offset due to clock difference with remote systems Remote Offset String: The offset in a nice human format Time Skew: The time skew between this server and its replicas Time Skew String: The time skew in a nice human format Seq Num: The number of multiple csns within a second System Time: The local system time Diff in Seconds: The time difference in seconds from the CSN generator creation to now Diff in days/secs: The time difference broken up into days and seconds Endian: Little/Big Endian

[**dsctl** *ldifgen*](#dsctl~18)

LDIF generator to make sample LDIF files for testing

[**dsctl** *dsrc*](#dsctl~19)

Manage the .dsrc file

[**dsctl** *cockpit*](#dsctl~20)

Enable the Cockpit interface/UI

[**dsctl** *dblib*](#dsctl~21)

database library (i.e bdb/lmdb) migration

[**dsctl** *thread-pool*](#dsctl~22)

Offline thread pool diagnostics read from the local mmap status file

# COMMAND *'dsctl* *restart'*

usage: dsctl \[-v] \[-j] \[instance] restart \[-h]

# COMMAND *'dsctl* *start'*

usage: dsctl \[-v] \[-j] \[instance] start \[-h]

# COMMAND *'dsctl* *stop'*

usage: dsctl \[-v] \[-j] \[instance] stop \[-h]

# COMMAND *'dsctl* *status'*

usage: dsctl \[-v] \[-j] \[instance] status \[-h]

# COMMAND *'dsctl* *remove'*

usage: dsctl \[-v] \[-j] \[instance] remove \[-h] \[--do-it]

# OPTIONS *'dsctl* *remove'*

[**--do-it**](#do)

By default we do a dry run. This actually initiates the removal of the instance.

# COMMAND *'dsctl* *db2index'*

usage: dsctl \[-v] \[-j] \[instance] db2index \[-h] \[--attr ATTR] backend

[**backend**](#backend)

The backend to reindex. IE userRoot

# OPTIONS *'dsctl* *db2index'*

[**--attr** *ATTR*](#attr)

An attribute to reindex. IE: --attr member --attr cn ...

# COMMAND *'dsctl* *db2bak'*

usage: dsctl \[-v] \[-j] \[instance] db2bak \[-h] \[--watch] \[archive]

[**archive**](#archive)

The destination for the archive. This will be created during the db2bak process.

# OPTIONS *'dsctl* *db2bak'*

[**--watch**](#watch)

Watch the status of the db2bak task

# COMMAND *'dsctl* *db2ldif'*

usage: dsctl \[-v] \[-j] \[instance] db2ldif \[-h] \[--replication] \[--encrypted] \[--watch]  
backend \[ldif]

[**backend**](#backend~2)

The backend to output as an LDIF. IE userRoot

[**ldif**](#ldif)

The path to the ldif output location.

# OPTIONS *'dsctl* *db2ldif'*

[**--replication**](#replication)

Export replication information, suitable for importing on a new consumer or backups.

[**--encrypted**](#encrypted)

Export encrypted attributes

[**--watch**](#watch~2)

Watch the status of the db2ldif task

# COMMAND *'dsctl* *dbverify'*

usage: dsctl \[-v] \[-j] \[instance] dbverify \[-h] backend

[**backend**](#backend~3)

The backend to verify. IE userRoot

# COMMAND *'dsctl* *bak2db'*

usage: dsctl \[-v] \[-j] \[instance] bak2db \[-h] \[--watch] archive

[**archive**](#archive~2)

The archive to restore. This will erase all current server databases.

# OPTIONS *'dsctl* *bak2db'*

[**--watch**](#watch~3)

Watch the status of the bak2db task

# COMMAND *'dsctl* *ldif2db'*

usage: dsctl \[-v] \[-j] \[instance] ldif2db \[-h] \[--encrypted] \[--watch] backend ldif

[**backend**](#backend~4)

The backend to restore from an LDIF. IE userRoot

[**ldif**](#ldif~2)

The path to the ldif to import

# OPTIONS *'dsctl* *ldif2db'*

[**--encrypted**](#encrypted~2)

Import encrypted attributes

[**--watch**](#watch~4)

Watch the status of the ldif2db task

# COMMAND *'dsctl* *backups'*

usage: dsctl \[-v] \[-j] \[instance] backups \[-h] \[--delete DELETE]

# OPTIONS *'dsctl* *backups'*

[**--delete** *DELETE*](#delete)

Delete backup directory

# COMMAND *'dsctl* *ldifs'*

usage: dsctl \[-v] \[-j] \[instance] ldifs \[-h] \[--delete DELETE]

# OPTIONS *'dsctl* *ldifs'*

[**--delete** *DELETE*](#delete~2)

Delete LDIF file

# COMMAND *'dsctl* *index-check'*

usage: dsctl \[-v] \[-j] \[instance] index-check \[-h] \[--fix] \[backend]

[**backend**](#backend~5)

Backend to check. If not specified, all backends are checked.

# OPTIONS *'dsctl* *index-check'*

[**--fix**](#fix)

Fix mismatches by adjusting config to match on-disk data

# COMMAND *'dsctl* *tls'*

usage: dsctl \[-v] \[-j] \[instance] tls \[-h]  
{list-ca,list-client-ca,show-server-cert,show-cert,generate-server-cert-csr,import-client-ca,import-ca,import-server-cert,import-server-key-cert,remove-cert,export-cert} ...

# POSITIONAL ARGUMENTS *'dsctl tls'*

[**dsctl tls** *list-ca*](#dsctl~23)

list server certificate authorities including intermediates

[**dsctl tls** *list-client-ca*](#dsctl~24)

list client certificate authorities including intermediates

[**dsctl tls** *show-server-cert*](#dsctl~25)

Show the active server certificate that clients will see and verify

[**dsctl tls** *show-cert*](#dsctl~26)

Show a certificate's details referenced by it's nickname. This is analogous to certutil -L -d <path> -n <nickname>

[**dsctl tls** *generate-server-cert-csr*](#dsctl~27)

Generate a Server-Cert certificate signing request - the csr is then submitted to a CA for verification, and when signed you import with import-ca and import-server-cert

[**dsctl tls** *import-client-ca*](#dsctl~28)

Import a CA trusted to issue user (client) certificates. This is part of how client certificate authentication functions.

[**dsctl tls** *import-ca*](#dsctl~29)

Import a CA or intermediate CA for signing this servers certificates (aka Server-Cert). You should import all the CA's in the chain as required. PEM bundles are accepted

[**dsctl tls** *import-server-cert*](#dsctl~30)

Import a new Server-Cert after the csr has been signed from a CA.

[**dsctl tls** *import-server-key-cert*](#dsctl~31)

Import a new key and Server-Cert after having been signed from a CA. This is used if you have an external csr tool or a service like lets encrypt that generates PEM keys externally.

[**dsctl tls** *remove-cert*](#dsctl~32)

Delete a certificate from this database. This will remove it from acting as a CA, a client CA or the Server-Cert role.

[**dsctl tls** *export-cert*](#dsctl~33)

Export a certificate to PEM or DER/Binary format. PEM format is the default

# COMMAND *'dsctl* *tls* *list-ca'*

usage: dsctl \[-v] \[-j] \[instance] tls list-ca \[-h]

# COMMAND *'dsctl* *tls* *list-client-ca'*

usage: dsctl \[-v] \[-j] \[instance] tls list-client-ca \[-h]

# COMMAND *'dsctl* *tls* *show-server-cert'*

usage: dsctl \[-v] \[-j] \[instance] tls show-server-cert \[-h]  
\[--nickname NICKNAME]

# OPTIONS *'dsctl* *tls* *show-server-cert'*

[**--nickname** *NICKNAME*](#nickname)

The nickname (friendly name) of the certificate to display if different than

# COMMAND *'dsctl* *tls* *show-cert'*

usage: dsctl \[-v] \[-j] \[instance] tls show-cert \[-h] nickname

[**nickname**](#nickname~2)

The nickname (friendly name) of the certificate to display

# COMMAND *'dsctl* *tls* *generate-server-cert-csr'*

usage: dsctl \[-v] \[-j] \[instance] tls generate-server-cert-csr  
\[-h] \[--subject SUBJECT] \[--nickname NICKNAME] \[alt\_names ...]

[**alt\_names**](#alt_names)

Certificate requests subject alternative names. These are auto-detected if not provided

# OPTIONS *'dsctl* *tls* *generate-server-cert-csr'*

[**--subject** *SUBJECT*, **-s** *SUBJECT*](#subject)

Certificate Subject field to use

[**--nickname** *NICKNAME*](#nickname~3)

The name of the certificate if different than 'Server-Cert'

# COMMAND *'dsctl* *tls* *import-client-ca'*

usage: dsctl \[-v] \[-j] \[instance] tls import-client-ca \[-h] cert\_path nickname

[**cert\_path**](#cert_path)

The path to the x509 cert to import as a client trust root

[**nickname**](#nickname~4)

The name of the certificate once imported

# COMMAND *'dsctl* *tls* *import-ca'*

usage: dsctl \[-v] \[-j] \[instance] tls import-ca \[-h]  
cert\_path  
nickname \[nickname ...]

[**cert\_path**](#cert_path~2)

The path to the x509 cert to import as a server CA

[**nickname**](#nickname~5)

The name of the certificate once imported

# COMMAND *'dsctl* *tls* *import-server-cert'*

usage: dsctl \[-v] \[-j] \[instance] tls import-server-cert \[-h]  
\[--nickname NICKNAME]  
cert\_path

[**cert\_path**](#cert_path~3)

The path to the x509 cert to import as Server-Cert

# OPTIONS *'dsctl* *tls* *import-server-cert'*

[**--nickname** *NICKNAME*](#nickname~6)

The name of the certificate if different than 'Server-Cert'

# COMMAND *'dsctl* *tls* *import-server-key-cert'*

usage: dsctl \[-v] \[-j] \[instance] tls import-server-key-cert  
\[-h] \[--nickname NICKNAME] cert\_path key\_path

[**cert\_path**](#cert_path~4)

The path to the x509 cert to import as Server-Cert

[**key\_path**](#key_path)

The path to the x509 key to import associated to Server-Cert

# OPTIONS *'dsctl* *tls* *import-server-key-cert'*

[**--nickname** *NICKNAME*](#nickname~7)

The name of the certificate if different than 'Server-Cert'

# COMMAND *'dsctl* *tls* *remove-cert'*

usage: dsctl \[-v] \[-j] \[instance] tls remove-cert \[-h] nickname

[**nickname**](#nickname~8)

The name of the certificate to delete

# COMMAND *'dsctl* *tls* *export-cert'*

usage: dsctl \[-v] \[-j] \[instance] tls export-cert \[-h] \[--binary-format]  
\[--output-file OUTPUT\_FILE]  
nickname

[**nickname**](#nickname~9)

The name of the certificate to export

# OPTIONS *'dsctl* *tls* *export-cert'*

[**--binary-format**](#binary)

Export certificate in DER/binary format

[**--output-file** *OUTPUT\_FILE*](#output)

The name for the exported certificate. Default name is the certificate nickname with an extension of ".pem" or ".crt"

# COMMAND *'dsctl* *healthcheck'*

usage: dsctl \[instance] healthcheck \[-h] \[--list-checks] \[--list-errors]  
\[--dry-run] \[--check CHECK \[CHECK ...]]  
\[--exclude-check EXCLUDE\_CHECK \[EXCLUDE\_CHECK ...]]

# OPTIONS *'dsctl* *healthcheck'*

[**--list-checks**](#list)

List of known checks

[**--list-errors**](#list~2)

List of known error codes

[**--dry-run**](#dry)

Do not execute the actual check, only list what would be done

[**--check** *CHECK \[CHECK ...\]*](#check)

Areas to check. These can be obtained by --list-checks. Every element on the left of the colon (:) may be replaced by an asterisk if multiple options on the right are available.

[**--exclude-check** *EXCLUDE\_CHECK \[EXCLUDE\_CHECK ...\]*](#exclude)

Areas to skip. These can be obtained by --list-checks. Every element on the left of the colon (:) may be replaced by an asterisk if multiple options on the right are available.

# COMMAND *'dsctl* *get-nsstate'*

usage: dsctl \[instance] get-nsstate \[-h] \[--suffix SUFFIX] \[--flip FLIP]

# OPTIONS *'dsctl* *get-nsstate'*

[**--suffix** *SUFFIX*](#suffix)

The DN of the replication suffix to read the state from

[**--flip** *FLIP*](#flip)

Flip between Little/Big Endian, this might be required for certain architectures

# COMMAND *'dsctl* *ldifgen'*

usage: dsctl \[-v] \[-j] \[instance] ldifgen \[-h]  
{users,groups,cos-def,cos-template,roles,mod-load,nested} ...

# POSITIONAL ARGUMENTS *'dsctl ldifgen'*

[**dsctl ldifgen** *users*](#dsctl~34)

Generate a LDIF containing user entries

[**dsctl ldifgen** *groups*](#dsctl~35)

Generate a LDIF containing groups and members

[**dsctl ldifgen** *cos-def*](#dsctl~36)

Generate a LDIF containing a COS definition (classic, pointer, or indirect)

[**dsctl ldifgen** *cos-template*](#dsctl~37)

Generate a LDIF containing a COS template

[**dsctl ldifgen** *roles*](#dsctl~38)

Generate a LDIF containing a role entry (managed, filtered, or indirect)

[**dsctl ldifgen** *mod-load*](#dsctl~39)

Generate a LDIF containing modify operations. This is intended to be consumed by ldapmodify.

[**dsctl ldifgen** *nested*](#dsctl~40)

Generate a heavily nested database LDIF in a cascading/fractal tree design

# COMMAND *'dsctl* *ldifgen* *users'*

usage: dsctl \[-v] \[-j] \[instance] ldifgen users \[-h] \[--number NUMBER]  
\[--suffix SUFFIX]  
\[--parent PARENT] \[--generic]  
\[--start-idx START\_IDX]  
\[--rdn-cn] \[--localize]  
\[--ldif-file LDIF\_FILE]

# OPTIONS *'dsctl* *ldifgen* *users'*

[**--number** *NUMBER*](#number)

The number of users to create.

[**--suffix** *SUFFIX*](#suffix~2)

The database suffix where the entries will be created.

[**--parent** *PARENT*](#parent)

The parent entry that the user entries should be created under. If not specified, the entries are stored under random Organizational Units.

[**--generic**](#generic)

Create generic entries in the format of "uid=user####". These entries are also compatible with ldclt.

[**--start-idx** *START\_IDX*](#start)

For generic LDIF's you can choose the starting index for the user entries. The default is "0".

[**--rdn-cn**](#rdn)

Use the attribute "cn" as the RDN attribute in the DN instead of "uid"

[**--localize**](#localize)

Localize the LDIF data

[**--ldif-file** *LDIF\_FILE*](#ldif~3)

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

# COMMAND *'dsctl* *ldifgen* *groups'*

usage: dsctl \[-v] \[-j] \[instance] ldifgen groups \[-h] \[--number NUMBER]  
\[--suffix SUFFIX]  
\[--parent PARENT]  
\[--num-members NUM\_MEMBERS]  
\[--create-members]  
\[--member-parent MEMBER\_PARENT]  
\[--member-attr MEMBER\_ATTR]  
\[--ldif-file LDIF\_FILE]  
NAME

**NAME**

The group name.

# OPTIONS *'dsctl* *ldifgen* *groups'*

[**--number** *NUMBER*](#number~2)

The number of groups to create.

[**--suffix** *SUFFIX*](#suffix~3)

The database suffix where the groups will be created.

[**--parent** *PARENT*](#parent~2)

The parent entry that the group entries should be created under. If not specified the groups are stored under the suffix.

[**--num-members** *NUM\_MEMBERS*](#num)

The number of members in the group. Default is 10000

[**--create-members**](#create)

Create the member user entries.

[**--member-parent** *MEMBER\_PARENT*](#member)

The entry DN that the members should be created under. The default is the suffix entry.

[**--member-attr** *MEMBER\_ATTR*](#member~2)

The membership attribute to use in the group. Default is "uniquemember".

[**--ldif-file** *LDIF\_FILE*](#ldif~4)

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

# COMMAND *'dsctl* *ldifgen* *cos-def'*

usage: dsctl \[-v] \[-j] \[instance] ldifgen cos-def \[-h] \[--type TYPE]  
\[--parent PARENT]  
\[--create-parent]  
\[--cos-specifier COS\_SPECIFIER]  
\[--cos-template COS\_TEMPLATE]  
\[--cos-attr \[COS\_ATTR ...]]  
\[--ldif-file LDIF\_FILE]  
NAME

**NAME**

The COS definition name.

# OPTIONS *'dsctl* *ldifgen* *cos-def'*

[**--type** *TYPE*](#type)

The COS definition type: "classic", "pointer", or "indirect".

[**--parent** *PARENT*](#parent~3)

The parent entry that the COS definition should be created under.

[**--create-parent**](#create~2)

Create the parent entry

[**--cos-specifier** *COS\_SPECIFIER*](#cos)

Used in a classic COS definition, this attribute located in the user entry is used to select which COS template to use.

[**--cos-template** *COS\_TEMPLATE*](#cos~2)

The DN of the COS template entry, only used for "classic" and "pointer" COS definitions.

[**--cos-attr** *\[COS\_ATTR ...\]*](#cos~3)

A list of attributes which defines which attribute the COS generates values for.

[**--ldif-file** *LDIF\_FILE*](#ldif~5)

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

# COMMAND *'dsctl* *ldifgen* *cos-template'*

usage: dsctl \[-v] \[-j] \[instance] ldifgen cos-template \[-h] \[--parent PARENT]  
\[--create-parent]  
\[--cos-priority COS\_PRIORITY]  
\[--cos-attr-val COS\_ATTR\_VAL]  
\[--ldif-file LDIF\_FILE]  
NAME

**NAME**

The COS template name.

# OPTIONS *'dsctl* *ldifgen* *cos-template'*

[**--parent** *PARENT*](#parent~4)

The DN of the entry to store the COS template entry under.

[**--create-parent**](#create~3)

Create the parent entry

[**--cos-priority** *COS\_PRIORITY*](#cos~4)

Sets the priority of this conflicting/competing COS templates.

[**--cos-attr-val** *COS\_ATTR\_VAL*](#cos~5)

defines the attribute and value that the template provides.

[**--ldif-file** *LDIF\_FILE*](#ldif~6)

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

# COMMAND *'dsctl* *ldifgen* *roles'*

usage: dsctl \[-v] \[-j] \[instance] ldifgen roles \[-h] \[--type TYPE]  
\[--parent PARENT]  
\[--create-parent]  
\[--filter FILTER]  
\[--role-dn \[ROLE\_DN ...]]  
\[--ldif-file LDIF\_FILE]  
NAME

**NAME**

The Role name.

# OPTIONS *'dsctl* *ldifgen* *roles'*

[**--type** *TYPE*](#type~2)

The Role type: "managed", "filtered", or "nested".

[**--parent** *PARENT*](#parent~5)

The DN of the entry to store the Role entry under

[**--create-parent**](#create~4)

Create the parent entry

[**--filter** *FILTER*](#filter)

A search filter for gathering Role members. Required for a "filtered" role.

[**--role-dn** *\[ROLE\_DN ...\]*](#role)

A DN of a role entry that should be included in this role. Used for "nested" roles only.

[**--ldif-file** *LDIF\_FILE*](#ldif~7)

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

# COMMAND *'dsctl* *ldifgen* *mod-load'*

usage: dsctl \[-v] \[-j] \[instance] ldifgen mod-load \[-h] \[--create-users]  
\[--delete-users]  
\[--num-users NUM\_USERS]  
\[--parent PARENT]  
\[--create-parent]  
\[--add-users ADD\_USERS]  
\[--del-users DEL\_USERS]  
\[--modrdn-users MODRDN\_USERS]  
\[--mod-users MOD\_USERS]  
\[--mod-attrs \[MOD\_ATTRS ...]]  
\[--randomize]  
\[--ldif-file LDIF\_FILE]

# OPTIONS *'dsctl* *ldifgen* *mod-load'*

[**--create-users**](#create~5)

Create the entries that will be modified or deleted. By default the script assumes the user entries already exist.

[**--delete-users**](#delete~3)

Delete all the user entries at the end of the LDIF.

[**--num-users** *NUM\_USERS*](#num~2)

The number of user entries that will be modified or deleted

[**--parent** *PARENT*](#parent~6)

The DN of the parent entry where the user entries are located.

[**--create-parent**](#create~6)

Create the parent entry

[**--add-users** *ADD\_USERS*](#add)

The number of additional entries to add during the load.

[**--del-users** *DEL\_USERS*](#del)

The number of entries to delete during the load.

[**--modrdn-users** *MODRDN\_USERS*](#modrdn)

The number of entries to perform a modrdn operation on.

[**--mod-users** *MOD\_USERS*](#mod)

The number of entries to modify.

[**--mod-attrs** *\[MOD\_ATTRS ...\]*](#mod~2)

List of attributes the script will randomly choose from when modifying an entry. The default is "description".

[**--randomize**](#randomize)

Randomly perform the specified add, mod, delete, and modrdn operations

[**--ldif-file** *LDIF\_FILE*](#ldif~8)

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

# COMMAND *'dsctl* *ldifgen* *nested'*

usage: dsctl \[-v] \[-j] \[instance] ldifgen nested \[-h] \[--num-users NUM\_USERS]  
\[--node-limit NODE\_LIMIT]  
\[--suffix SUFFIX]  
\[--ldif-file LDIF\_FILE]

# OPTIONS *'dsctl* *ldifgen* *nested'*

[**--num-users** *NUM\_USERS*](#num~3)

The total number of user entries to create in the entire LDIF (does not include the container entries).

[**--node-limit** *NODE\_LIMIT*](#node)

The total number of user entries to create under each node/subtree

[**--suffix** *SUFFIX*](#suffix~4)

The suffix DN for the LDIF

[**--ldif-file** *LDIF\_FILE*](#ldif~9)

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

# COMMAND *'dsctl* *dsrc'*

usage: dsctl \[-v] \[-j] \[instance] dsrc \[-h] {create,modify,delete,display,repl-mon} ...

# POSITIONAL ARGUMENTS *'dsctl dsrc'*

[**dsctl dsrc** *create*](#dsctl~41)

Generate the .dsrc file

[**dsctl dsrc** *modify*](#dsctl~42)

Modify the .dsrc file

[**dsctl dsrc** *delete*](#dsctl~43)

Delete instance configuration from the .dsrc file.

[**dsctl dsrc** *display*](#dsctl~44)

Display the contents of the .dsrc file.

[**dsctl dsrc** *repl-mon*](#dsctl~45)

Display the contents of the .dsrc file.

# COMMAND *'dsctl* *dsrc* *create'*

usage: dsctl \[-v] \[-j] \[instance] dsrc create \[-h] \[--uri URI]  
\[--basedn BASEDN]  
\[--people-rdn PEOPLE\_RDN]  
\[--groups-rdn GROUPS\_RDN]  
\[--binddn BINDDN]  
\[--saslmech SASLMECH]  
\[--tls-cacertdir TLS\_CACERTDIR]  
\[--tls-cert TLS\_CERT]  
\[--tls-key TLS\_KEY]  
\[--tls-reqcert TLS\_REQCERT]  
\[--starttls] \[--pwdfile PWDFILE]  
\[--do-it]

# OPTIONS *'dsctl* *dsrc* *create'*

[**--uri** *URI*](#uri)

The URI (LDAP URL) for the Directory Server instance.

[**--basedn** *BASEDN*](#basedn)

The default database suffix.

[**--people-rdn** *PEOPLE\_RDN*](#people)

Set the RDN for the 'people' subtree. Default is "ou=people"

[**--groups-rdn** *GROUPS\_RDN*](#groups)

Set the RDN for the 'groups' subtree. Default is "ou=groups"

[**--binddn** *BINDDN*](#binddn)

The default Bind DN used or authentication.

[**--saslmech** *SASLMECH*](#saslmech)

The SASL mechanism to use: PLAIN or EXTERNAL.

[**--tls-cacertdir** *TLS\_CACERTDIR*](#tls)

The directory containing the Trusted Certificate Authority certificate.

[**--tls-cert** *TLS\_CERT*](#tls~2)

The absolute file name to the server certificate.

[**--tls-key** *TLS\_KEY*](#tls~3)

The absolute file name to the server certificate key.

[**--tls-reqcert** *TLS\_REQCERT*](#tls~4)

Request certificate strength: 'never', 'allow', 'hard'

[**--starttls**](#starttls)

Use startTLS for connection to the server.

[**--pwdfile** *PWDFILE*](#pwdfile)

The absolute path to a file containing the Bind DN's password.

[**--do-it**](#do~2)

Create the file without any confirmation.

# COMMAND *'dsctl* *dsrc* *modify'*

usage: dsctl \[-v] \[-j] \[instance] dsrc modify \[-h] \[--uri \[URI]]  
\[--basedn \[BASEDN]]  
\[--people-rdn \[PEOPLE\_RDN]]  
\[--groups-rdn \[GROUPS\_RDN]]  
\[--binddn \[BINDDN]]  
\[--saslmech \[SASLMECH]]  
\[--tls-cacertdir \[TLS\_CACERTDIR]]  
\[--tls-cert \[TLS\_CERT]]  
\[--tls-key \[TLS\_KEY]]  
\[--tls-reqcert \[TLS\_REQCERT]]  
\[--starttls] \[--cancel-starttls]  
\[--pwdfile \[PWDFILE]] \[--do-it]

# OPTIONS *'dsctl* *dsrc* *modify'*

[**--uri** *\[URI\]*](#uri~2)

The URI (LDAP URL) for the Directory Server instance.

[**--basedn** *\[BASEDN\]*](#basedn~2)

The default database suffix.

[**--people-rdn** *\[PEOPLE\_RDN\]*](#people~2)

Sets the RDN used for the 'people' container

[**--groups-rdn** *\[GROUPS\_RDN\]*](#groups~2)

Sets the RDN used for the 'groups' container

[**--binddn** *\[BINDDN\]*](#binddn~2)

The default Bind DN used or authentication.

[**--saslmech** *\[SASLMECH\]*](#saslmech~2)

The SASL mechanism to use: PLAIN or EXTERNAL.

[**--tls-cacertdir** *\[TLS\_CACERTDIR\]*](#tls~5)

The directory containing the Trusted Certificate Authority certificate.

[**--tls-cert** *\[TLS\_CERT\]*](#tls~6)

The absolute file name to the server certificate.

[**--tls-key** *\[TLS\_KEY\]*](#tls~7)

The absolute file name to the server certificate key.

[**--tls-reqcert** *\[TLS\_REQCERT\]*](#tls~8)

Request certificate strength: 'never', 'allow', 'hard'

[**--starttls**](#starttls~2)

Use startTLS for connection to the server.

[**--cancel-starttls**](#cancel)

Do not use startTLS for connection to the server.

[**--pwdfile** *\[PWDFILE\]*](#pwdfile~2)

The absolute path to a file containing the Bind DN's password.

[**--do-it**](#do~3)

Update the file without any confirmation.

# COMMAND *'dsctl* *dsrc* *delete'*

usage: dsctl \[-v] \[-j] \[instance] dsrc delete \[-h] \[--do-it]

# OPTIONS *'dsctl* *dsrc* *delete'*

[**--do-it**](#do~4)

Delete this instance's configuration from the .dsrc file.

# COMMAND *'dsctl* *dsrc* *display'*

usage: dsctl \[-v] \[-j] \[instance] dsrc display \[-h]

# COMMAND *'dsctl* *dsrc* *repl-mon'*

usage: dsctl \[-v] \[-j] \[instance] dsrc repl-mon \[-h]  
\[--add-conn ADD\_CONN \[ADD\_CONN ...]]  
\[--del-conn DEL\_CONN \[DEL\_CONN ...]]  
\[--add-alias ADD\_ALIAS \[ADD\_ALIAS ...]]  
\[--del-alias DEL\_ALIAS \[DEL\_ALIAS ...]]

# OPTIONS *'dsctl* *dsrc* *repl-mon'*

[**--add-conn** *ADD\_CONN \[ADD\_CONN ...\]*](#add~2)

Add a replica connection: 'NAME:HOST:PORT:BINDDN:CREDENTIAL'

[**--del-conn** *DEL\_CONN \[DEL\_CONN ...\]*](#del~2)

delete a replica connection by its NAME

[**--add-alias** *ADD\_ALIAS \[ADD\_ALIAS ...\]*](#add~3)

Add a host/port alias: 'ALIAS\_NAME:HOST:PORT'

[**--del-alias** *DEL\_ALIAS \[DEL\_ALIAS ...\]*](#del~3)

delete a host/port alias by its ALIAS\_NAME

# COMMAND *'dsctl* *cockpit'*

usage: dsctl \[-v] \[-j] \[instance] cockpit \[-h]  
{enable,open-firewall,disable,close-firewall} ...

# POSITIONAL ARGUMENTS *'dsctl cockpit'*

[**dsctl cockpit** *enable*](#dsctl~46)

Enable the Cockpit socket

[**dsctl cockpit** *open-firewall*](#dsctl~47)

Open the firewall for the "cockpit" service

[**dsctl cockpit** *disable*](#dsctl~48)

Disable the Cockpit socket

[**dsctl cockpit** *close-firewall*](#dsctl~49)

Remove the "cockpit" service from the firewall settings

# COMMAND *'dsctl* *cockpit* *enable'*

usage: dsctl \[-v] \[-j] \[instance] cockpit enable \[-h]

# COMMAND *'dsctl* *cockpit* *open-firewall'*

usage: dsctl \[-v] \[-j] \[instance] cockpit open-firewall \[-h] \[--zone ZONE]

# OPTIONS *'dsctl* *cockpit* *open-firewall'*

[**--zone** *ZONE*](#zone)

The firewall zone

# COMMAND *'dsctl* *cockpit* *disable'*

usage: dsctl \[-v] \[-j] \[instance] cockpit disable \[-h]

# COMMAND *'dsctl* *cockpit* *close-firewall'*

usage: dsctl \[-v] \[-j] \[instance] cockpit close-firewall \[-h]

# COMMAND *'dsctl* *dblib'*

usage: dsctl \[-v] \[-j] \[instance] dblib \[-h] {bdb2mdb,mdb2bdb,cleanup} ...

# POSITIONAL ARGUMENTS *'dsctl dblib'*

[**dsctl dblib** *bdb2mdb*](#dsctl~50)

Migrate bdb databases to lmdb

[**dsctl dblib** *mdb2bdb*](#dsctl~51)

Migrate lmdb databases to bdb

[**dsctl dblib** *cleanup*](#dsctl~52)

Remove migration ldif file and old database

# COMMAND *'dsctl* *dblib* *bdb2mdb'*

usage: dsctl \[-v] \[-j] \[instance] dblib bdb2mdb \[-h] \[--tmpdir TMPDIR]

# OPTIONS *'dsctl* *dblib* *bdb2mdb'*

[**--tmpdir** *TMPDIR*](#tmpdir)

ldif migration files directory path.

# COMMAND *'dsctl* *dblib* *mdb2bdb'*

usage: dsctl \[-v] \[-j] \[instance] dblib mdb2bdb \[-h] \[--tmpdir TMPDIR]

# OPTIONS *'dsctl* *dblib* *mdb2bdb'*

[**--tmpdir** *TMPDIR*](#tmpdir~2)

ldif migration files directory path.

# COMMAND *'dsctl* *dblib* *cleanup'*

usage: dsctl \[-v] \[-j] \[instance] dblib cleanup \[-h]

# COMMAND *'dsctl* *thread-pool'*

usage: dsctl \[-v] \[-j] \[instance] thread-pool \[-h] {status} ...

# POSITIONAL ARGUMENTS *'dsctl thread-pool'*

[**dsctl thread-pool** *status*](#dsctl~53)

Display pool gauges and per-worker activity without an LDAP connection

# COMMAND *'dsctl* *thread-pool* *status'*

usage: dsctl \[-v] \[-j] \[instance] thread-pool status \[-h] \[--file FILE]

# OPTIONS *'dsctl* *thread-pool* *status'*

[**--file** *FILE*](#file)

Read this thread-pool status file instead of the instance's live file (e.g. a crash file preserved as threadpool.YYYYMMDD-HHMMSS)

# [OPTIONS](#OPTIONS)

[**-v**, **--verbose**](#v)

Display verbose operation tracing during command execution

[**-j**, **--json**](#j)

Return result in JSON object

[**-l**, **--list**](#l)

List available Directory Server instances

# [AUTHOR](#AUTHOR)

```
"Red Hat, Inc., and William Brown" <389-devel@lists.fedoraproject.org>
```

1980-01-01 lib389 3.3.1

---

Document: dsctl(8) from py3.13-lib389 3.3.1-r10 (Chainguard OS)
Source: https://github.com/389ds/389-ds-base.git