Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

CLI Guide for Disaster Recovery for Dell

Introduction​

alt text

This page consolidates the igls CLI commands referenced across the Disaster Recovery documentation into a single reference, organized by task. Each command links back to the full procedure on its source page — use this page to find the right command quickly, and the linked page for the complete context and prerequisites around it.

Appliance Health and Diagnostics​

igls admin health

Displays the overall health status of the Eyeglass appliance. See Appliance Check.

igls admin version

Displays Eyeglass component versions (UI, REST, and SCA services).

The appliance ID is also displayed directly in the 2.15.0 GUI, in Inventory → License Management, with a Copy Appliance ID button next to it.

igls admin appid

Displays the appliance ID over SSH, as an alternative to the GUI.

igls appliance report

Diagnostic log-parsing tool for dark or secure sites where on-site log analysis is required before contacting support — summarizes API errors, SSH errors, configuration sync analysis, and failover analysis. See Appliance Check — Generate a Diagnostic Report.

igls adv reloaddiskspacemonitorrules

Reloads the support-backup disk monitor alarm threshold after editing its configuration file. See Appliance Check.

Backup and Restore​

igls app restore /full_path_to_your_file.extension/

Restores an Eyeglass appliance from a backup archive. See Backup and Restore.

igls app restore /srv/www/htdocs/archive

Accepts a directory path instead of a specific file — scans all backup files present, identifies the most recent one, and prompts for confirmation before proceeding. See Advanced Restore and Rediscover Operations.

igls app pull-config

Migrates configuration to a new appliance, referenced as part of pre-upgrade backup best practice. See Upgrade Guide.

igls appliance rediscover

Rebuilds the Eyeglass database without requiring a backup archive. Use only when directed by Superna Support. See Advanced Restore and Rediscover Operations.

Configuration Replication​

igls admin schedules set --id Replication --enabled false
igls admin schedules set --id Replication --enabled true

Disables and re-enables the Configuration Replication job — for example, as a workaround around failover for the SMB Data Integrity deny-permission corner case. See Technical Advisories and Configuration Replication.

igls admin ignoreunresolvablehosts

Used when a client-list hostname on an export cannot be resolved or removed. See Configuration Replication.

Failover Configuration​

igls adv failovermode set --parallel=true
igls adv failovermode set --parallel=false

Enables or disables multi-threaded, parallel step execution across all failover jobs. See Parallel Failover Configuration.

igls adv failovertimeout

Displays or sets the per-step failover task timeout. See Considerations Before Using DR Rehearsal Mode.

igls adv runbookrobot set --createExport=false

Disables automatic export creation/update by Runbook Robot — use only when directed by Superna Support. See Runbook Robot — Advanced Settings.

SPN Failover Delay​

Adjusts the delay between the delete and create steps of an SPN failover, to give a domain controller time to replicate the delete before the create is attempted.

igls adv spndelay

Displays the current setting.

igls adv spndelay set --seconds=<seconds>

Sets the delay, in seconds, between the delete and create SPN operations during failover — for example, igls adv spndelay set --seconds=10.

note

This command exists for environments where domain controller replication is slow enough to cause SPN failover issues. Later Eyeglass releases pin SPN failover commands to a single node and domain controller, which removes the need to tune this delay in most environments.

Readiness and Validation​

igls admin schedules set --id SyncMonitorTask --enabled true
igls admin schedules

Enables the SyncIQ Monitor Task and displays current schedule status. See Failover Validations Reference.

igls admin schedules set --id Readiness --enabled true

Enables the Zone Readiness task (disabled by default) — required for Runbook Robot. The same igls admin schedules set pattern (substituting the job ID) changes the schedule of any job. See Runbook Robot — Advanced DR Configuration.

igls adv readinessvalidation set --dualdelegation=false
igls adv readinessvalidation set --spnsdelegation=false

Disables DNS delegation validation and SPN test validation, respectively, during readiness checks. See Failover Validations Reference.

Two-Factor Authentication​

igls auth 2fa --command status

Displays the current 2FA configuration.

igls auth 2fa --command enable
igls auth 2fa --command disable

Enables or disables 2FA globally across the system.

igls auth 2fa --command enforce
igls auth 2fa --command no-enforce

Requires or relaxes 2FA enrollment for all eligible users.

igls auth 2fa --command enroll --user <username> --mail <userEmail>

Enrolls a user for 2FA from the command line.

See Two-Factor Authentication for the full enrollment workflow, login flow, audit logging, and troubleshooting.

Storage Tier and Quota Management​

Storage Tier and Quota Template Commands​

These commands manage the tier and template objects used by Advanced Quota Replication to group and apply quota templates by tier:

igls csm tier help

Lists tiers that group quota templates together (list is the default action). add --id=<value> creates a new tier; delete --id=<value> removes one.

igls csm template help

Templates define a quota (hard, soft, or accounting) and an AD group, and are assigned to a tier — the tier must exist before a template can be assigned to it. list [--tier=<value>] [--name=<value>] lists templates and their tier; add creates a new quota template with flags for --tier, --name, --hard/--hardunit, --soft/--softunit, and --softgrace/--softgraceunit.

AD Group Based Quota Management​

AD group based quota management uses a job that evaluates the AD group membership of users and automatically applies the quota templates configured with the igls csm commands. It runs on a default schedule of once per day.

To use the feature:

  1. Enable the AD group discovery job to retrieve AD groups and users.
  2. Enable the separate quota inventory job. It defaults to every 12 hours, so quotas are only collected if there are changes every 12 hours.
  3. Create a storage tier to label quotas, then create a template (igls csm tier and igls csm template).
  4. Create AD groups and add users to the groups. The Domain Users group cannot be used; a new AD group is required if the goal is a default domain-wide quota.
  5. Add the AD groups to SMB shares.
  6. Run the on-demand AD group job to evaluate user groups and the quotas to create.
note

All references to the AD domain should use uppercase characters.

To enable the AD group quota scheduled job (releases earlier than 2.5.7):

igls admin schedules set --id ADGroupThresholds_2_5_5 --enabled true

This enables a schedule that runs every 2 hours. When ADGroupThresholds_2_5_5 is not enabled, it is not displayed by the igls admin schedules command. For releases later than 2.5.7, the schedule ID is ADGroupThresholds_2_5_7.

After changing the schedule, restart the sca service for the change to take effect (SSH to the appliance, run sudo su -, then systemctl restart sca and systemctl status sca), and verify the schedule with:

igls admin schedules

To check the AD group membership more often than every 2 hours (the default), for example every 10 minutes for testing only:

igls admin schedules set --id ADGroupThresholds_2_5_7 --interval 10M

To start an on-demand AD quota scan and quota creation (for testing), run the following command, and monitor the evaluation with tail -f /opt/superna/sca/logs/csm.log:

igls adv ADGroupThresholds

By default, templates create user quotas. Add the --quotasmode=group option to the igls csm template add command to create a group quota on a share where the template AD group has been applied to the permissions list.

igls adv adgroupmode
igls adv adgroupmode set --enabled=true
igls adv adgroupmode set --enabled=false

Shows the AD group mode used in quota templates, or enables or disables group mode. The default is user mode, which shows false. When enabled (true), the AD group named in the template gets the list of users and all of the users' groups, and every share detected as accessible to each listed user has a user quota created on it based on the template definition.

warning

Use igls adv adgroupmode with caution. It applies quotas based on user share access, can create a lot of quotas, and limits the user on each share they have access to. The default is disabled. Do not change this setting unless directed by Superna Support.

To troubleshoot, review the log on the appliance:

cat /opt/superna/sca/logs/csm.log

Cluster Credentials​

igls adv changepwd --cluster <cluster-name> --password <password> --restart true

Changes the cluster service account password stored in Eyeglass (requires 2.5.6 or later). Run igls adv changepwd help for usage.

  • --restart true is required for the password to take effect, and restarts the SCA process. If it is not used, restart the SCA later with sudo systemctl restart sca.
  • After running the command, log in to the UI, open the Jobs page, and verify that configuration sync jobs complete successfully.
  • The Eyeglass service account must be used. AD accounts are not supported and are not best practice, since they reduce the availability of the system by adding a dependency on AD domain controllers.
note

The igls adv changepwd command is deprecated from OneFS 9.5 and above.

Request Timeout​

igls adv requesttimeout
igls adv requesttimeout set --inventory <time>

Displays, or sets, the REST API timeout. Increase the value when cluster or WAN responses take longer to return. For example:

igls adv requesttimeout set --inventory 300

Report Schedule and Reporting Commands​

igls admin schedules set --id InventoryReport --enabled <true|false>
igls admin schedules set --id InventoryReport --interval <interval>

Enables or disables the schedule for the Eyeglass reports, or changes the schedule. Valid intervals are 1M, 2M, 3M, 4M, 5M, 6M, 10M, 15M, 20M, 30M, 1H, 2H, 3H, 4H, 6H, 8H, 12H, 1D, 7D, and 31D. For example, igls admin schedules set --id InventoryReport --interval 7D.

igls adv runreports --report_type=rpo

Manually generates the SyncIQ Job Report (RPO report) and emails it. The time the command is run is the starting time for the report and associated calculations. See RPO Trending and Reporting.

igls adv skipscreenshots set --skip=true
igls adv skipscreenshots set --skip=false

Disables or enables the RPO chart screenshots in the RPO report.

Role-Based Authentication​

When proxy login is used for pass-through authentication to AD, Eyeglass sends an SMB authentication request for the user's AD user ID and password to a share on PowerScale, using the SmartConnect FQDN of a share discovered in the zone. The authentication uses the ordered list of SmartConnect FQDNs until the password test succeeds and the user can log in. During the process, the user's AD groups are also retrieved to map the user to a role. Use the following commands to manage the list of SmartConnect FQDNs for the Access Zone where users authenticate to the AD provider:

igls admin auth
igls admin auth add --fqdn <name>
igls admin auth modify --fromfqdn <name> --tofqdn <newName>
igls admin auth delete --fqdn <name>
igls admin auth delete --all true

In order, these commands list the FQDNs, add an FQDN, change an FQDN, delete an FQDN, and delete all FQDNs.

AirGap and Multi Vault​

igls airgap changeschedule --job=<job-name>

Displays the current cron string for an AirGap job. For example, igls airgap changeschedule --job=isi-prod_rw-airgap-testshare returns Cron String for job isi-prod_rw-airgap-testshare is */10 * * * *.

igls airgap changeschedule set --job=<job-name> --cronstr=<5-fields-cron-string>

Sets a new schedule using a cron string. Both --job and --cronstr are required. For example, igls airgap changeschedule set --job="isi-prod_rw-airgap-testshare" --cronstr="*/15 * * * *" sets the job to run every 15 minutes. Confirm the new schedule in the AirGap GUI or by running the display command above. Any cron string can be generated by changing the AirGap GUI schedule options supported through the CLI.

igls airgap checkvaults

Lists the registered Vault Agent VMs, for customers with multiple cyber vaults.

igls airgap disable
igls airgap enable

Quickly disables or enables all AirGap policies. When disabled, no syncing occurs; this is a maintenance state. Disabling raises a major alarm ("airgap policy sync state disabled by administrator").

ecactl isilons modify --name <protected-or-vault-cluster-name> --update-password

After changing the protected cluster and vault cluster passwords, updates the password in the Vault Agent.

These temporary maintenance commands for AirGap Enterprise only work if the remote maintenance variable is enabled on the Vault Agent. It is disabled by default.

igls airgap vaultaccessrequest --interval=<minutes> --vault=<vault-id>
igls airgap vaultaccessview [--vault=<vault-id>]
igls airgap vaultaccesscancel
  • vaultaccessrequest sets a request in Eyeglass that is picked up by the Vault Agent VM. The Vault Agent checks in every 2 hours for requests. If a request is set, the AirGap opens for the requested number of minutes for maintenance and closes automatically afterward. The vault ID is the ECA ID of the Vault Agent, found in /opt/superna/eca/eca-env-common.conf.
  • vaultaccessview lists any requests that have been set and the interval requested. The --vault option filters by Vault Agent.
  • vaultaccesscancel cancels any pending requests.

Advanced Commands (Use Only if Directed by Support)​

igls hbase rowkeyscangenerator --cluster=<GUID> --path=<path> [--starttime=<DateTime>] [--endtime=<DateTime>] [--user=<user>] [--protocol={SMB | NFS}] [--operation={keys | data}] [--explain=<value>] [--dir=<dir>]

Queries HBase row keys. The cluster GUID and path are mandatory. Start and end time are optional and default to the current day and one day back; if provided, they must use the format dd-MM-yyyy HH:mm:ss. The --operation parameter selects the request type: keys (the default) documents the list of start and end row keys in a file, and adding --explain (the value is not relevant) breaks each row key into its components and documents the result as a table. The --dir parameter sets where the result file is written (default /tmp); the file name format is ScanKeys_<CREATION_DATE>.log.

igls adv memorywatchdog help
igls adv memorywatchdog
igls adv memorywatchdog set --forcegcthreshold=77

Shows the help, the current settings, or sets the memory threshold at which the memory watchdog forces garbage collection to free unused memory. The set option accepts [--forcegc={true | false}] [--forcegcthreshold=<integer>]. In the example, garbage collection runs when more than 77% of memory is used, and a debug log entry is written when the threshold is crossed ("Threshold has been reached, requesting GC to be executed if the GC is actually requested.").

igls adv verifydata [set] [--verify={true | false}]

Database insertion validation. The default is true, which removes orphaned records from the database to avoid insertion errors.

See Also​