DSCTL(8) Generated Python Manual DSCTL(8) (NAME) dsctl - Directory Server (SYNOPSIS) dsctl [-h] [-v] [-j] [-l] [instance] {restart,start,stop,status,remove,db2index,db2bak,db2ldif,dbverify,bak2db,ldif2db,backups,ldifs,index- check,tls,healthcheck,get-nsstate,ldifgen,dsrc,cockpit,dblib,thread- pool} ... (POSITIONAL ARGUMENTS) dsctl restart Directory Server . dsctl start Directory Server . dsctl stop Directory Server . dsctl status Directory Server. dsctl remove Directory Server . dsctl db2index (reindex) . . dsctl db2bak BDB . . dsctl db2ldif LDIF . . dsctl dbverify . . dsctl bak2db BDB . . dsctl ldif2db LDIF. . dsctl backups . dsctl ldifs LDIF LDIF . dsctl index-check (parentid/ancestorid). . dsctl tls TLS. dsctl healthcheck (healthcheck) Directory Server. . Directory Server . dsctl get-nsstate nsState : Replica DN: The DN of the replication configuration entry Replica Suffix: The replicated suffix Replica ID: The Replica identifier Gen Time The time the CSN generator was created Gen Time String: The time string of generator Gen as CSN: The generation CSN Local Offset: The offset due to the local clock being set back Local Offset String: The offset in a nice human format Remote Offset: The offset due to clock difference with remote systems Remote Offset String: The offset in a nice human format Time Skew: The time skew between this server and its replicas Time Skew String: The time skew in a nice human format Seq Num: The number of multiple csns within a second System Time: The local system time Diff in Seconds: The time difference in seconds from the CSN generator creation to now Diff in days/secs: The time difference broken up into days and seconds Endian: Little/Big Endian dsctl ldifgen LDIF LDIF . dsctl dsrc .dsrc. dsctl cockpit Cockpit. dsctl dblib ( bdb/lmdb). dsctl thread-pool (thread pool) mmap. (COMMAND) 'dsctl restart' : dsctl [-v] [-j] [instance] restart [-h] (COMMAND) 'dsctl start' : dsctl [-v] [-j] [instance] start [-h] (COMMAND) 'dsctl stop' : dsctl [-v] [-j] [instance] stop [-h] (COMMAND) 'dsctl status' : dsctl [-v] [-j] [instance] status [-h] (COMMAND) 'dsctl remove' : dsctl [-v] [-j] [instance] remove [-h] [--do-it] (OPTIONS) 'dsctl remove' --do-it (dry run) . . (COMMAND) 'dsctl db2index' : dsctl [-v] [-j] [instance] db2index [-h] [--attr ATTR] backend backend ( userRoot). (OPTIONS) 'dsctl db2index' --attr ATTR : --attr member --attr cn ... (COMMAND) 'dsctl db2bak' : dsctl [-v] [-j] [instance] db2bak [-h] [--watch] [archive] archive . db2bak . (OPTIONS) 'dsctl db2bak' --watch db2bak. (COMMAND) 'dsctl db2ldif' : dsctl [-v] [-j] [instance] db2ldif [-h] [--replication] [--encrypted] [--watch] backend [ldif] backend LDIF userRoot. ldif ldif. (OPTIONS) 'dsctl db2ldif' --replication (replication) (consumer) . --encrypted . --watch db2ldif. (COMMAND) 'dsctl dbverify' : dsctl [-v] [-j] [instance] dbverify [-h] backend backend userRoot. (COMMAND) 'dsctl bak2db' : dsctl [-v] [-j] [instance] bak2db [-h] [--watch] archive archive . . (OPTIONS) 'dsctl bak2db' --watch bak2db. (COMMAND) 'dsctl ldif2db' : dsctl [-v] [-j] [instance] ldif2db [-h] [--encrypted] [--watch] backend ldif backend LDIF userRoot. ldif ldif . (OPTIONS) 'dsctl ldif2db' --encrypted . --watch ldif2db. (COMMAND) 'dsctl backups' : dsctl [-v] [-j] [instance] backups [-h] [--delete DELETE] (OPTIONS) 'dsctl backups' --delete DELETE . (COMMAND) 'dsctl ldifs' : dsctl [-v] [-j] [instance] ldifs [-h] [--delete DELETE] (OPTIONS) 'dsctl ldifs' --delete DELETE LDIF. (COMMAND) 'dsctl index-check' : dsctl [-v] [-j] [instance] index-check [-h] [--fix] [backend] backend . . (OPTIONS) 'dsctl index-check' --fix . (COMMAND) 'dsctl tls' : dsctl [-v] [-j] [instance] tls [-h] {list-ca,list-client-ca,show-server-cert,show-cert,generate-server-cert-csr,import-client-ca,import-ca,import-server-cert,import-server-key-cert,remove-cert,export-cert} ... (POSITIONAL ARGUMENTS) 'dsctl tls' dsctl tls list-ca (CA) . dsctl tls list-client-ca () . dsctl tls show-server-cert . dsctl tls show-cert . certutil -L -d -n . dsctl tls generate-server-cert-csr (CSR) Server-Cert - csr CA import-ca import-server-cert . dsctl tls import-client-ca CA (). . dsctl tls import-ca CA CA ( Server-Cert). CA . PEM . dsctl tls import-server-cert Server-Cert csr CA. dsctl tls import-server-key-cert Server-Cert CA. csr Lets Encrypt PEM . dsctl tls remove-cert . CA CA Server-Cert . dsctl tls export-cert PEM DER/. PEM . (COMMAND) 'dsctl tls list-ca' : dsctl [-v] [-j] [instance] tls list-ca [-h] (COMMAND) 'dsctl tls list-client-ca' : dsctl [-v] [-j] [instance] tls list-client-ca [-h] (COMMAND) 'dsctl tls show-server-cert' : dsctl [-v] [-j] [instance] tls show-server-cert [-h] [--nickname NICKNAME] (OPTIONS) 'dsctl tls show-server-cert' --nickname NICKNAME ( ) 'Server-Cert' . (COMMAND) 'dsctl tls show-cert' : dsctl [-v] [-j] [instance] tls show-cert [-h] nickname nickname ( ) . (COMMAND) 'dsctl tls generate-server-cert-csr' : dsctl [-v] [-j] [instance] tls generate-server-cert-csr [-h] [--subject SUBJECT] [--nickname NICKNAME] [alt_names ...] alt_names (subject alternative names) . . (OPTIONS) 'dsctl tls generate-server-cert-csr' --subject SUBJECT, -s SUBJECT (Subject) . --nickname NICKNAME 'Server-Cert' . (COMMAND) 'dsctl tls import-client-ca' : dsctl [-v] [-j] [instance] tls import-client-ca [-h] cert_path nickname cert_path x509 . nickname . (COMMAND) 'dsctl tls import-ca' : dsctl [-v] [-j] [instance] tls import-ca [-h] cert_path nickname [nickname ...] cert_path x509 CA . nickname . (COMMAND) 'dsctl tls import-server-cert' : dsctl [-v] [-j] [instance] tls import-server-cert [-h] [--nickname NICKNAME] cert_path cert_path x509 Server-Cert. (OPTIONS) 'dsctl tls import-server-cert' --nickname NICKNAME 'Server-Cert' . (COMMAND) 'dsctl tls import-server-key-cert' : dsctl [-v] [-j] [instance] tls import-server-key-cert [-h] [--nickname NICKNAME] cert_path key_path cert_path x509 Server-Cert. key_path x509 Server-Cert. (OPTIONS) 'dsctl tls import-server-key-cert' --nickname NICKNAME 'Server-Cert' . (COMMAND) 'dsctl tls remove-cert' : dsctl [-v] [-j] [instance] tls remove-cert [-h] nickname nickname . (COMMAND) 'dsctl tls export-cert' : dsctl [-v] [-j] [instance] tls export-cert [-h] [--binary-format] [--output-file OUTPUT_FILE] nickname nickname . (OPTIONS) 'dsctl tls export-cert' --binary-format DER/. --output-file OUTPUT_FILE . ".pem" ".crt" . (COMMAND) 'dsctl healthcheck' : dsctl [instance] healthcheck [-h] [--list-checks] [--list-errors] [--dry-run] [--check CHECK [CHECK ...]] [--exclude-check EXCLUDE_CHECK [EXCLUDE_CHECK ...]] (OPTIONS) 'dsctl healthcheck' --list-checks . --list-errors . --dry-run . --check CHECK [CHECK ...] . --list-checks . (:) . --exclude-check EXCLUDE_CHECK [EXCLUDE_CHECK ...] . --list-checks . (:) . (COMMAND) 'dsctl get-nsstate' : dsctl [instance] get-nsstate [-h] [--suffix SUFFIX] [--flip FLIP] (OPTIONS) 'dsctl get-nsstate' --suffix SUFFIX DN . --flip FLIP Little/Big Endian . (COMMAND) 'dsctl ldifgen' : dsctl [-v] [-j] [instance] ldifgen [-h] {users,groups,cos-def,cos-template,roles,mod-load,nested} ... (POSITIONAL ARGUMENTS) 'dsctl ldifgen' dsctl ldifgen users LDIF . dsctl ldifgen groups LDIF . dsctl ldifgen cos-def LDIF COS ( ). dsctl ldifgen cos-template LDIF COS. dsctl ldifgen roles LDIF ( ). dsctl ldifgen mod-load LDIF . ldapmodify . dsctl ldifgen nested LDIF /. (COMMAND) 'dsctl ldifgen users' : dsctl [-v] [-j] [instance] ldifgen users [-h] [--number NUMBER] [--suffix SUFFIX] [--parent PARENT] [--generic] [--start-idx START_IDX] [--rdn-cn] [--localize] [--ldif-file LDIF_FILE] (OPTIONS) 'dsctl ldifgen users' --number NUMBER . --suffix SUFFIX . --parent PARENT . . --generic "uid=user####". ldclt . --start-idx START_IDX LDIF . "0" . --rdn-cn "cn" RDN DN "uid". --localize LDIF. --ldif-file LDIF_FILE LDIF. LDIF 'ldifgen.ldif' . (COMMAND) 'dsctl ldifgen groups' : dsctl [-v] [-j] [instance] ldifgen groups [-h] [--number NUMBER] [--suffix SUFFIX] [--parent PARENT] [--num-members NUM_MEMBERS] [--create-members] [--member-parent MEMBER_PARENT] [--member-attr MEMBER_ATTR] [--ldif-file LDIF_FILE] NAME NAME . (OPTIONS) 'dsctl ldifgen groups' --number NUMBER . --suffix SUFFIX . --parent PARENT . . --num-members NUM_MEMBERS . 10000 . --create-members . --member-parent MEMBER_PARENT DN . . --member-attr MEMBER_ATTR . "uniquemember" . --ldif-file LDIF_FILE LDIF. LDIF 'ldifgen.ldif' . (COMMAND) 'dsctl ldifgen cos-def' : dsctl [-v] [-j] [instance] ldifgen cos-def [-h] [--type TYPE] [--parent PARENT] [--create-parent] [--cos-specifier COS_SPECIFIER] [--cos-template COS_TEMPLATE] [--cos-attr [COS_ATTR ...]] [--ldif-file LDIF_FILE] NAME NAME COS. (OPTIONS) 'dsctl ldifgen cos-def' --type TYPE COS: "classic" "pointer" "indirect". --parent PARENT COS . --create-parent . --cos-specifier COS_SPECIFIER COS COS . --cos-template COS_TEMPLATE DN COS COS "classic" "pointer" . --cos-attr [COS_ATTR ...] COS . --ldif-file LDIF_FILE LDIF. LDIF 'ldifgen.ldif' . (COMMAND) 'dsctl ldifgen cos-template' : dsctl [-v] [-j] [instance] ldifgen cos-template [-h] [--parent PARENT] [--create-parent] [--cos-priority COS_PRIORITY] [--cos-attr-val COS_ATTR_VAL] [--ldif-file LDIF_FILE] NAME NAME COS. (OPTIONS) 'dsctl ldifgen cos-template' --parent PARENT DN COS . --create-parent . --cos-priority COS_PRIORITY COS . --cos-attr-val COS_ATTR_VAL . --ldif-file LDIF_FILE LDIF. LDIF 'ldifgen.ldif' . (COMMAND) 'dsctl ldifgen roles' : dsctl [-v] [-j] [instance] ldifgen roles [-h] [--type TYPE] [--parent PARENT] [--create-parent] [--filter FILTER] [--role-dn [ROLE_DN ...]] [--ldif-file LDIF_FILE] NAME NAME (Role). (OPTIONS) 'dsctl ldifgen roles' --type TYPE : "managed" "filtered" "nested". --parent PARENT DN . --create-parent . --filter FILTER . "filtered" . --role-dn [ROLE_DN ...] DN . "nested" . --ldif-file LDIF_FILE LDIF. LDIF 'ldifgen.ldif' . (COMMAND) 'dsctl ldifgen mod-load' : dsctl [-v] [-j] [instance] ldifgen mod-load [-h] [--create-users] [--delete-users] [--num-users NUM_USERS] [--parent PARENT] [--create-parent] [--add-users ADD_USERS] [--del-users DEL_USERS] [--modrdn-users MODRDN_USERS] [--mod-users MOD_USERS] [--mod-attrs [MOD_ATTRS ...]] [--randomize] [--ldif-file LDIF_FILE] (OPTIONS) 'dsctl ldifgen mod-load' --create-users . . --delete-users LDIF. --num-users NUM_USERS . --parent PARENT DN . --create-parent . --add-users ADD_USERS . --del-users DEL_USERS . --modrdn-users MODRDN_USERS modrdn . --mod-users MOD_USERS . --mod-attrs [MOD_ATTRS ...] . "description" . --randomize add mod delete modrdn. --ldif-file LDIF_FILE LDIF. LDIF 'ldifgen.ldif' . (COMMAND) 'dsctl ldifgen nested' : dsctl [-v] [-j] [instance] ldifgen nested [-h] [--num-users NUM_USERS] [--node-limit NODE_LIMIT] [--suffix SUFFIX] [--ldif-file LDIF_FILE] (OPTIONS) 'dsctl ldifgen nested' --num-users NUM_USERS LDIF ( ). --node-limit NODE_LIMIT /. --suffix SUFFIX DN LDIF. --ldif-file LDIF_FILE LDIF. LDIF 'ldifgen.ldif' . (COMMAND) 'dsctl dsrc' : dsctl [-v] [-j] [instance] dsrc [-h] {create,modify,delete,display,repl-mon} ... (POSITIONAL ARGUMENTS) 'dsctl dsrc' dsctl dsrc create .dsrc. dsctl dsrc modify .dsrc. dsctl dsrc delete .dsrc. dsctl dsrc display .dsrc. dsctl dsrc repl-mon .dsrc. (COMMAND) 'dsctl dsrc create' : dsctl [-v] [-j] [instance] dsrc create [-h] [--uri URI] [--basedn BASEDN] [--people-rdn PEOPLE_RDN] [--groups-rdn GROUPS_RDN] [--binddn BINDDN] [--saslmech SASLMECH] [--tls-cacertdir TLS_CACERTDIR] [--tls-cert TLS_CERT] [--tls-key TLS_KEY] [--tls-reqcert TLS_REQCERT] [--starttls] [--pwdfile PWDFILE] [--do-it] (OPTIONS) 'dsctl dsrc create' --uri URI URI ( LDAP URL) Directory Server. --basedn BASEDN . --people-rdn PEOPLE_RDN RDN 'people'. "ou=people" . --groups-rdn GROUPS_RDN RDN 'groups'. "ou=groups" . --binddn BINDDN Bind DN . --saslmech SASLMECH SASL : PLAIN EXTERNAL. --tls-cacertdir TLS_CACERTDIR . --tls-cert TLS_CERT . --tls-key TLS_KEY . --tls-reqcert TLS_REQCERT : 'never' 'allow' 'hard'. --starttls startTLS . --pwdfile PWDFILE Bind DN . --do-it . (COMMAND) 'dsctl dsrc modify' : dsctl [-v] [-j] [instance] dsrc modify [-h] [--uri [URI]] [--basedn [BASEDN]] [--people-rdn [PEOPLE_RDN]] [--groups-rdn [GROUPS_RDN]] [--binddn [BINDDN]] [--saslmech [SASLMECH]] [--tls-cacertdir [TLS_CACERTDIR]] [--tls-cert [TLS_CERT]] [--tls-key [TLS_KEY]] [--tls-reqcert [TLS_REQCERT]] [--starttls] [--cancel-starttls] [--pwdfile [PWDFILE]] [--do-it] (OPTIONS) 'dsctl dsrc modify' --uri [URI] URI ( LDAP URL) Directory Server. --basedn [BASEDN] . --people-rdn [PEOPLE_RDN] RDN 'people'. --groups-rdn [GROUPS_RDN] RDN 'groups'. --binddn [BINDDN] Bind DN . --saslmech [SASLMECH] SASL : PLAIN EXTERNAL. --tls-cacertdir [TLS_CACERTDIR] . --tls-cert [TLS_CERT] . --tls-key [TLS_KEY] . --tls-reqcert [TLS_REQCERT] : 'never' 'allow' 'hard'. --starttls startTLS . --cancel-starttls startTLS . --pwdfile [PWDFILE] Bind DN . --do-it . (COMMAND) 'dsctl dsrc delete' : dsctl [-v] [-j] [instance] dsrc delete [-h] [--do-it] (OPTIONS) 'dsctl dsrc delete' --do-it .dsrc. (COMMAND) 'dsctl dsrc display' : dsctl [-v] [-j] [instance] dsrc display [-h] (COMMAND) 'dsctl dsrc repl-mon' : dsctl [-v] [-j] [instance] dsrc repl-mon [-h] [--add-conn ADD_CONN [ADD_CONN ...]] [--del-conn DEL_CONN [DEL_CONN ...]] [--add-alias ADD_ALIAS [ADD_ALIAS ...]] [--del-alias DEL_ALIAS [DEL_ALIAS ...]] (OPTIONS) 'dsctl dsrc repl-mon' --add-conn ADD_CONN [ADD_CONN ...] : 'NAME:HOST:PORT:BINDDN:CREDENTIAL' --del-conn DEL_CONN [DEL_CONN ...] NAME . --add-alias ADD_ALIAS [ADD_ALIAS ...] /: 'ALIAS_NAME:HOST:PORT' --del-alias DEL_ALIAS [DEL_ALIAS ...] / ALIAS_NAME . (COMMAND) 'dsctl cockpit' : dsctl [-v] [-j] [instance] cockpit [-h] {enable,open-firewall,disable,close-firewall} ... (POSITIONAL ARGUMENTS) 'dsctl cockpit' dsctl cockpit enable Cockpit. dsctl cockpit open-firewall "cockpit". dsctl cockpit disable Cockpit. dsctl cockpit close-firewall "cockpit" . (COMMAND) 'dsctl cockpit enable' : dsctl [-v] [-j] [instance] cockpit enable [-h] (COMMAND) 'dsctl cockpit open-firewall' : dsctl [-v] [-j] [instance] cockpit open-firewall [-h] [--zone ZONE] (OPTIONS) 'dsctl cockpit open-firewall' --zone ZONE (zone) . (COMMAND) 'dsctl cockpit disable' : dsctl [-v] [-j] [instance] cockpit disable [-h] (COMMAND) 'dsctl cockpit close-firewall' : dsctl [-v] [-j] [instance] cockpit close-firewall [-h] (COMMAND) 'dsctl dblib' : dsctl [-v] [-j] [instance] dblib [-h] {bdb2mdb,mdb2bdb,cleanup} ... (POSITIONAL ARGUMENTS) 'dsctl dblib' dsctl dblib bdb2mdb bdb lmdb. dsctl dblib mdb2bdb lmdb bdb. dsctl dblib cleanup ldif . (COMMAND) 'dsctl dblib bdb2mdb' : dsctl [-v] [-j] [instance] dblib bdb2mdb [-h] [--tmpdir TMPDIR] (OPTIONS) 'dsctl dblib bdb2mdb' --tmpdir TMPDIR ldif. (COMMAND) 'dsctl dblib mdb2bdb' : dsctl [-v] [-j] [instance] dblib mdb2bdb [-h] [--tmpdir TMPDIR] (OPTIONS) 'dsctl dblib mdb2bdb' --tmpdir TMPDIR ldif. (COMMAND) 'dsctl dblib cleanup' : dsctl [-v] [-j] [instance] dblib cleanup [-h] (COMMAND) 'dsctl thread-pool' : dsctl [-v] [-j] [instance] thread-pool [-h] {status} ... (POSITIONAL ARGUMENTS) 'dsctl thread-pool' dsctl thread-pool status LDAP. (COMMAND) 'dsctl thread-pool status' : dsctl [-v] [-j] [instance] thread-pool status [-h] [--file FILE] (OPTIONS) 'dsctl thread-pool status' --file FILE ( threadpool.YYYYMMDD-HHMMSS). (OPTIONS) -v, --verbose . -j, --json JSON. -l, --list Directory Server. (AUTHORS) "Red Hat, Inc., and William Brown" <389-devel@lists.fedoraproject.org> lib389 3.3.1 2026-09-07 DSCTL(8)