Eyeglass CLI Commands

Introduction

The following igls commands are available and can be executed directly from the Eyeglass shell, or any SSH session to the Eyeglass appliance. These commands cover appliance administration and the Data Security / DR product features that run on the appliance.

info

This reference covers igls commands that are generic to the Eyeglass appliance and to the Data Security features (Easy Auditor, Ransomware Defender, AirGap).

Security CLI Commands

Change Cluster Service Account Password

info

The command igls adv changepwd is deprecated on PowerScale OneFS 9.5 and above.

igls adv changepwd --cluster <cluster-name> --password <new-password> --restart true

note

--restart true is required for the password change to take effect — it restarts the SCA process. If --restart true is not used, the SCA will need to be restarted later with sudo systemctl restart sca. After running this command, log in to the UI, open the Jobs icon, and verify configuration sync jobs complete successfully.

The Eyeglass service account must be used — AD accounts are not supported and are not best practice, since they reduce system availability due to dependency on AD domain controllers.

igls adv changepwd help

Appliance Management

Disk Management Monitoring

This command and configuration file allow increasing the support-backup disk-monitor alarm threshold from the default of 800 MB to a higher value.

Edit /opt/superna/sca/conf/DiskSpaceMonitorConfig.xml to change the second rule to a higher value in MB, save the file, then run:

igls adv reloaddiskspacemonitorrules

This reloads the monitor to use the new configured limits. If you get this alarm, you can delete old backup files located in /srv/www/htdocs/archive.

Alarm Database Table Compression

igls adv managealarmdatacompression

Checks whether alarm data compression is able to store in the database. Contact support before attempting to change this.

Easy Auditor CLI Commands

These commands are used for Easy Auditor configuration changes.

Bulk-Load Historical Audit Events

When a cluster has had auditing enabled, a history of audit logs is stored on the cluster. This command ingests old audit messages for searching, or ingests data collected while the ECA cluster was down or unable to reach a cluster.

igls rswsignals bulkLoadTAEvents --file=/opt/superna/sca/tmp/bulkLoadTAConfig.json

A JSON file specifies the cluster, node names, and the compressed audit files that should be ingested. A sample file exists on the appliance at /opt/superna/sca/tmp/bulkLoadTAConfig.json for editing:

[{
  "cluster_name": "sourcein8",
  "cluster_guid": "0050569f9a9f4d819b58261e950907a632ad",
  "node": [
    {
      "node_id": "node001",
      "audit_files": ["00000000.gz", "00000001.gz", "00000002.gz", "00000003.gz"]
    },
    {
      "node_id": "node002",
      "audit_files": ["00000000.gz", "00000001.gz", "00000002.gz", "00000003.gz"]
    }
  ]
}]

CSV Report Archive Path

igls admin eaCsvArchivePath show

Shows where CSV reports are currently saved.

igls admin eaCsvArchivePath set --value=<path>

Sets the path. This can be an NFS mount on the Eyeglass appliance, to centralize reports as they're generated. There is no default — if unset, the report job still succeeds even though nothing is saved.

Robot Audit

Robot Audit performs continuous auditing by creating user events as an SMB-connected user, then verifying they were ingested and stored in the database. This gives the highest level of confidence that audit data is being processed and stored. Audit lag is the time from when an event is created to when it's searchable.

igls easyauditor roboaudit

Shows the current lag value.

igls easyauditor roboaudit set --eventlag=15

Sets the lag value to 15 minutes.

igls easyauditor roboaudit set --runpathreport=true

Disables the path search step (which can take variable time) so it's excluded from the automated test.

Event Result Percent for Robot Audit

note

Use only when directed by support.

igls easyauditor roboaudit set --reportpercent=60

Where Did My Folder Go — Query Event Limit

Sets the limit on the number of events returned by a "Where did my folder go" search.

info

This feature has been tested to return 5000 events; going over this limit may overwhelm the browser's ability to display the data.

igls easyauditor folderquerylimit set --limit=2500

Easy Auditor and Ransomware Defender Common CLI Commands

Reset Real-Time Queue to Skip Backlog

Easy Auditor and Ransomware Defender both use real-time triggers. If a misconfigured trigger creates a backlog of detections, it can take a long time to process. Each product has its own real-time processing queue, with Ransomware Defender given priority.

To skip to the end of the queue (ignoring the backlog and processing only new events going forward):

igls adv eventTriggers set --operation=reset --topic=rsw

Resets processing on the Ransomware queue.

igls adv eventTriggers set --operation=reset --topic=ea

Resets processing on the Easy Auditor real-time active-audit-trigger queue.

Ransomware CLI Commands

Convert Ignored List to Monitor-Only List

Available in 2.5.7 and later. Converts all entries on the Ignored list (by path, user, or IP address) to the Monitor list — the preferred way to protect data without applying a lockout.

igls rsw convertignoredlist set

info

All existing Ignored List entries are deleted and moved to Monitor Mode.

General Ransomware Settings

note

Some settings are managed in the GUI instead.

igls rsw generalsettings

Sample output:

{
  "snapshot_expiry_hours": 48,
  "escalate": false,
  "critical_on": true,
  "monitor_only": false,
  "snapshotOn": "WARNING",
  "lock_root": false,
  "root_sids": ["S-1-1-1-0", "S-1-22-1-0"]
}

Default Snapshot Expiry

igls rsw generalsettings set --snapshot_expiry_hours 72

Security Guard Delay Detection

Changes the security timer that delays the failure message when audit events are behind on the cluster.

igls rsw securityguardsettings help

Valid options: sg_waitforevent_timer_seconds and sg_restore_timer_seconds.

igls rsw securityguardsettings set --sg_waitforevent_timer_seconds=600
igls rsw securityguardsettings set --sg_restore_timer_seconds=60

NFS Event Processing and Lockout

Enables NFS I/O processing and lockout for Ransomware events based on GUI-configured thresholds. The lockout function removes the client IP address from the export definition to lock out the NFS host (host names are not mapped to IP addresses in this release).

igls rsw nfsevents set --enabled=true

Enables NFS lockout (default is disabled).

igls rsw nfsevents

Checks the currently configured value.

Extensions Allow List

The file-extension list tracks over 2000 well-known extensions seen in ransomware incidents. Some may be valid in a customer's environment — these commands add extensions to an allow list.

igls rsw allowedfiles add --extensions='*.ext1'
igls rsw allowedfiles
igls rsw allowedfiles remove --extensions='*.ext1'

False-Positive Override Per User

note

Contact support before entering values — support should provide the values used to modify a user's threat-level settings.

These commands use a user's SID. To find the SID/user mapping, SSH to the appliance and run:

cat /opt/superna/sca/data/ad_principal_cache.json

Add an override:

igls rsw RSWUserOverride post --user=<SID> --tdid=03 --parameter=X --multiplier=16.008001000000004

Delete an override:

igls rsw RSWUserOverride delete --sid=<SID> --tdid=03 --parameter=X --multiplier=16.008001000000004

View current overrides:

igls rsw RSWUserOverride get

All entries use the format [SID] : [Threat detector ID] : [Parameter ID] : [Multiplier].

Restore a Locked-Out User in Error State

Used only when a locked-out user's security event errors out due to cluster reachability, or some shares weren't unlocked. Re-attempts recovery of the user's share access.

caution

Do not use this command if users were assigned directly to shares instead of via AD groups.

igls rsw RSWRestoreAccess set --user="<DOMAIN>\<user>"

This scans the Eyeglass database for all shares with a "deny" applied to the user via AD group membership, and builds/executes the restore job for those shares. This command is intended for use by Superna support in cases where a lockout reported no shares successfully locked out, but deny flags were actually applied on the storage platform.

Ransomware Defender Banned File Version Commands

note

Requires the 2.5.7 update 1 release or later. The Eyeglass VM requires internet access to download and apply new versions of the banned file list.

igls rsw filefiltersettings

Lists current settings.

igls rsw filefiltersettings --diff=<version1,version2>

Shows extensions added/removed between two versions.

igls rsw filefiltersettings --version=<version>

Switches Eyeglass to a specific version of the banned file list.

igls rsw filefiltersettings set --mode=Latest

Automatically switches to new versions as they're released.

igls rsw filefiltersettings set --mode=Fixed --version=<version>

Pins Eyeglass Ransomware Defender to a specific file-list version.

AirGap CLI Commands

Check and Change AirGap Schedule

Check the existing schedule:

igls airgap changeschedule --job=<job-name>

Set a new schedule using a cron string:

igls airgap changeschedule set --job=<job-name> --cronstr="<5-field cron string>"

Example — run every 15 minutes:

igls airgap changeschedule set --job="isi-prod_rw-airgap-testshare" --cronstr="*/15 * * * *"

Confirm the updated schedule either in the AirGap GUI or by re-running the changeschedule --job= command. Any cron string supported by the AirGap GUI schedule options is valid through the CLI.

Multi-Vault CLI Commands

Lists the registered vault agent VMs for customers with multiple cyber vaults:

igls airgap checkvaults

AirGap State Change

igls airgap disable

Quick-disables all policies — no syncing occurs. This is a maintenance state and raises a major alarm ("airgap policy sync state disabled by administrator").

igls airgap enable

Quick-enables all policies.

Update Passwords in the Vault Agent

After changing the protected-cluster and vault-cluster passwords, update the Vault Agent with:

ecactl isilons modify --name <protected-or-vault-cluster-name> --update-password

Temporary Maintenance Commands — AirGap Enterprise

note

These commands only work if remote maintenance is enabled on the vault agent — it's disabled by default.

igls airgap vaultaccessrequest --interval=<minutes> --vault=<vault-eca-id>

Sets a maintenance-access request that the vault agent VM picks up (checks every 2 hours). The airgap opens for the requested interval and auto-closes afterward. The vault's ECA ID is found in /opt/superna/eca/eca-env-common.conf.

igls airgap vaultaccessview [--vault=<vault-eca-id>]

Lists any pending requests and their requested interval; --vault filters by vault agent.

igls airgap vaultaccesscancel

Cancels any pending requests.

Temporary Maintenance Commands — AirGap Basic

Opens an airgap for maintenance with an explicit timeout, so the network isn't accidentally left open.

igls airgap connect --job=<job-name> --timeout=<duration>[m|h]
igls airgap connect --policy=<policy> --source=<source> --timeout=<duration>[m|h]

Enables a network connection to the target device of an AirGap policy, auto-closing once the timeout is reached. --timeout defaults to minutes if no m/h suffix is given.

igls airgap disconnect --job=<job-name>
igls airgap disconnect --policy=<policy> --source=<source>

Disables the network connection immediately, without waiting for the timeout.

Eyeglass Reports and Scheduling

The cluster diff report and most recurring Eyeglass tasks are controlled by igls admin schedules and igls config settings. Large configurations can make some reports take hours to run.

View and Update Config Settings

igls config settings

Lists the tags available in system.xml.

igls config settings --tag <tag-name>

Returns the value of a tag.

igls config settings set --tag <tag-name> --value <value>

Updates a tag's value.

igls config settings help

Example (syncIsilonsToZK is a PowerScale-specific tag, shown here only to illustrate the command syntax):

igls config settings --tag syncIsilonsToZK
igls config settings set --tag syncIsilonsToZK --value true

Enable, Disable, and Reschedule Tasks

igls admin schedules

Lists all scheduled tasks with their interval, enabled state, ID, and label.

igls admin schedules set --id <task-id> --enabled <true|false>
igls admin schedules set --id <task-id> --interval <interval>

Valid intervals: 1M, 2M, 3M, 4M, 5M, 6M, 10M, 15M, 20M, 30M, 1H, 2H, 3H, 4H, 6H, 8H, 12H, 1D, 7D, 31D.

The scheduling mechanism is shared across product features. Task IDs you may encounter include (product feature in parentheses):

Task ID	Label	Feature
EventAuditProgress	Event Audit Progress Monitoring	Easy Auditor
InventoryReport	Eyeglass Reports	DR
PrintInventoryToSyslog	Print Inventory to Syslog	DR
QuotaRequestsReport	Quota Requests Report	Cluster Storage Monitor
RSWEventsMonitor	Ransomware Events Monitoring	Ransomware Defender
RSWHbaseScan	Ransomware Hbase Scanning	Ransomware Defender
Readiness	Zone Readiness	DR
RecoveryShareCleanUp	Recovery Share Clean Up	Cluster Storage Monitor
Replication	Configuration Replication	DR
RunbookRobot	Runbook Robot	DR
SecurityGuard	Security Guard	Ransomware Defender
ServicesScan	Services Scanning	—
StorageMonitorReport	Storage Monitor Report	Cluster Storage Monitor

Examples:

igls admin schedules set --id InventoryReport --enabled false
igls admin schedules set --id InventoryReport --interval 7D
igls admin schedules set --id Replication --interval 10M
igls admin schedules set --id RunbookRobot --interval 10M
igls admin schedules set --id Readiness --interval 2H

Scope note

The scheduling CLI mechanism itself (igls admin schedules) is generic. The individual task IDs shown above belong to specific product features (DR, Cluster Storage Monitor, Ransomware Defender, Easy Auditor) — see each feature's own documentation for platform applicability.

Appliance Diagnostics and Maintenance

igls admin health

Displays overall appliance health status.

igls admin appid

Displays the appliance ID.

igls admin version

Displays the Eyeglass component versions (UI, REST, SCA, etc.).

igls alarm active

Retrieves the current active alarm list. Pipe to more to page through a long list: igls alarm active | more.

igls alarm all

Displays the total number of alarms received.

igls alarm settings help

Controls alarm behavior:

igls alarm settings set --code=<AlarmCode> --raise=[false|true] --email=[false|true] --severity=[informational|warning|critical|major|minor|fatal]

--raise=false disables the alarm entirely. --email=false still shows it in the GUI but suppresses email/other notification. See the Alarm Codes reference for the full list of codes.

igls app upgrade [--url <installer-url>]

Performs an online upgrade of the appliance software.

igls app restore

Restores Eyeglass data and configuration from an Eyeglass backup archive. Must be run as admin or root.

• Release 2.5.5 and earlier: igls app restore [--anyrelease]. The --anyrelease flag allows a version mismatch between the backup and target appliance (skips restoring some items — retains licenses, clusters, and passwords).
• Release 2.5.6 and later: igls app restore /srv/www/htdocs/archive (scans for and prompts to confirm the most recent backup), or igls app restore /srv/www/htdocs/archive/backupfile.zip (restores a specific file).

igls appliance rediscover

Rebuilds the Eyeglass database while preserving job status, quota requests, and data-recovery databases. Use only when directed by support. After completion, refresh the UI login screen and check the Jobs icon for the initial discovery job.

igls appliance report

Diagnostic log-parsing tool for dark/secure sites where on-site log analysis is required. Summarizes API, SSH, and other errors, plus config-sync and failover analysis. View the result at https://<eyeglass IP address>/report/. See also the Backup and Restore reference.

Advanced Commands (Use Only If Directed by Support)

HBASE Query Commands

igls hbase rowkeyscangenerator --cluster=<GUID> --path=<path> [--starttime=<DateTime>] [--endtime=<DateTime>] [--user=<user>] [--protocol={SMB|NFS}] [--operation={keys|data}] [--explain=<value>] [--dir=<dir>]

--cluster and --path are mandatory. --starttime/--endtime default to the current day and one day back if omitted (format dd-MM-yyyy HH:mm:ss). --operation=keys (default) documents the start/end row keys; adding --explain breaks the row key into its components in the output table. --dir sets the output directory (default /tmp); the generated file is named ScanKeys_<CREATION_DATE>.log.

Memory Watchdog

igls adv memorywatchdog help
igls adv memorywatchdog
igls adv memorywatchdog set --forcegcthreshold=77

Sets the memory threshold (percentage used) at which forced garbage collection runs and a debug log entry is written.

Database Insertion Validation

igls adv verifydata [set] [--verify={true|false}]

Default true — removes orphaned records from the database to avoid insertion errors. Do not disable without direction from support.

Resolve AD User/Group to SID (Easy Auditor, Ransomware Defender)

igls adv resolve --user 'DOMAIN\user'
igls adv resolve --user 'user@domain.com'
igls adv resolve --user <SID>

igls adv resolve --group 'DOMAIN\group'
igls adv resolve --group SID:<SID>

note

Use single quotes around the user/group name, and enter the domain in uppercase.