TOS CLI Reference

Global Parameters

Many of the commands can be run with the following optional flags

• --help or -h: lists the usage, available commands and the flags (options) for the command for example, sudo tos backup --help
• --debug or -d: adds additional information for some commands, used for troubleshooting for example, sudo tos backup --debug
• --skip cli-validation: skips the cli version validation

TOS CLI Commands

If your system runs on TufinOS, all TOS commands must be run using sudo, because user root is not available on this operating system.

For details of SecureChange CLI commands, see the SecureChange Command Line Reference.

Archive Revision Data

This is a subset of commands that allows you to archive and temporarily restore old revision data (device policy rules):

• sudo tos archive create

• sudo tos archive load

• sudo tos archive unload

sudo tos archive create

Description

This command is a variant of sudo tos archive. It removes old revision data (rules) from the TOS Aurora database and stores it in a file outside of the cluster. If a previously archived file is currently loaded (see sudo tos archive load), you cannot create a new archive containing any rules in the loaded range.

We recommend first running the screen command to ensure that the archive command runs to completion.

Syntax

[<ADMIN> ~]$ sudo tos archive create [-t|--date=<TODATE>] [-p|--path=<PATH>]

Parameters

On completion:

• A log file is created /opt/tufin/logs/services/st-archive-job/app.log.

• If the operation completes successfully, the archive file is created in the target directory, with the to-date as part of its name.

Example

[<ADMIN> ~]$ sudo tos archive create --date=2021-12-31 --path=/tmp
Archive completed successfully. Archive file created: /tmp/archive_2021-12-31.tar         

sudo tos archive load

Description

This command is a variant of sudo tos archive. It restores old revision data from a file created previously with sudo tos archive create. More than one archive can be loaded at a time. If the command is run again with a different archive file, the data will be appended to the database. The archive file can only be loaded on the machine in which it was created.

Syntax

[<ADMIN> ~]$ sudo tos archive load [-p|--path=<PATH>]

Parameters

Example

[<ADMIN> ~]$ sudo tos archive load --path=/tmp/archive_2021-12-31
Loading archive file completed successfully.

sudo tos archive unload

Description

This command is a variant of sudo tos archive. It removes all revision data from the TOS Aurora database that was previously loaded from one or more archives using sudo tos archive load.

Syntax

[<ADMIN> ~]$ sudo tos archive unload 

Parameters

• Global parameters only

Example

[<ADMIN> ~]$ sudo tos archive unload
Unloading revisions completed successfully.

Backup Creation and Management

A subset of commands to create on-time backups and manage backup policy.

• sudo tos backup create

• sudo tos backup delete

• sudo tos backup expiry

• sudo tos backup export

• sudo tos backup import

• sudo tos backup list

• sudo tos backup policy delete

• sudo tos backup policy get

• sudo tos backup policy set

• sudo tos backup status

• sudo tos backup storage set

sudo tos backup create

Description

Create an on-demand backup of your data. You can create this type of backup at any time, whether you have a policy defined or not. The command will check if there is enough disk space available. The backup requires a little over twice the space currently taken up by your databases.

Syntax

[<ADMIN> ~]$ sudo tos backup create [--name <NAME>] [--ttl <TIME TO LIVE>]

Parameters

sudo tos backup delete

Description

Delete a single backup, multiple backups, or all backups. This does not affect the backup policy. The alias remove can be used instead.

Syntax

[<ADMIN> ~]$ sudo tos backup delete [<FILENAME1>] [<FILENAME2>][--all]

Parameters

sudo tos backup expiry

Description

Assigns an expiration date to a specific backup. The backup is deleted once it is expired.

Syntax

[<ADMIN> ~]$ sudo tos backup expiry <BACKUP_NAME> <"EXPIRY_DATE_TIME">

Parameters

Example

$ sudo tos backup expiry tufin-scheduler-000999 "2022-04-30 00:30:45"
		

sudo tos backup export

Description

Transfer all your backup files from the TOS backup directory to a single .gzip file in a remote location so they can be restored if required. All the backup files and your backup policy will be saved to a single backup archive file in the specified target location. If the target location is not specified, the archive will be created in /opt/tufin/backups. The alias tar can be used instead.

The backup archive file will be named in the following format: 

backup-<TOSVER>-YYYYMMDDHHMMSS.tar.gzip

where <TOSVER> is your SecureTrack version number. We strongly recommend using the screen command before proceeding.

Syntax

[<ADMIN> ~]$ sudo tos backup export [-t|--target "<PATH>"]

Parameters

Examples

$ sudo tos backup export --target /mapdrive/save/
$ sudo tos backup export -t "/opt/myarchive/"		

To ensure you have enough disk space, we recommend that before exporting, you check the disk usage of your backup files and compare it to the available space in the target destination.

To check disk usage of your backup files:

[<ADMIN> ~]$ sudo du -sh /opt/tufin/data/volumes/minio/velerok8s/

To check available space in the target:

[Target location]$ sudo df -h <path>

where <path> is the target path.

The files will be compressed in the export but the degree of compression cannot be known in advance. We recommend ensuring that you have at least the amount of space available in your target equal to the original files.

After the backup is exported, we recommend verifying that the file contents can be viewed by running the following command:

[Target location]$ tar tzvf <filename>

sudo tos backup import

Description

Extract all backups from a TOS Aurora backup export file (gzip format) file and place them in the TOS backup directory, so they can be subsequently restored to your database. The import command does not restore data. If the source location is not specified, the default path/file name /opt/tufin/backups/backup.tar.gzip will be used. After completion of the command, the restored backups and policy will replace those currently in your system. We strongly recommend using the screen command before proceeding.

The alias untar can be used instead.

Syntax

[<ADMIN> ~]$ sudo tos backup import [-s|--source <FULLPATH>

Parameters

Example

$ sudo tos backup import --source /etc/mapped/save/backup-20-1-pga-20200526092902.tar.gzip

sudo tos backup list

Description

List all backups in the backup location, including automated backups created from the policy and on-demand backups created manually.

Syntax

[<ADMIN> ~]$ sudo tos backup list

Information Provided in Output

• Backup name
• Date/time started
• Date/time completed
• Modules included
• Whether high availability was active at the time of backup
• TOS Aurora release and build
• file expiration date
• Completion Status

Sample Output

[“16-december-2020-12-4”]
			Started: “2020-12-16 10:04:14 +0000 UTC”
			Completed: “2020-12-16 10:05:52 +0000 UTC”
			Modules: “RC”
			HA mode: “false”
			TOS release: “21.1 (PRC1)”
			TOS build: “21.1.1100-201215163002315”
			Expiration Date: “2021-01-15 10:04:14 +0000 UTC”
			Status: “Completed” # sudo tos backup list
			["23-august-2021-16-18"]
			Started: "2021-08-23 13:18:43 +0000 UTC"
			Completed: "N/A"
			Modules: "ST, SC"
			HA mode: "false"
			TOS release: "21.2 (PGA.0.0) Final"
			TOS build: "21.2.2100-210722164631509"
			Expiration Date: "2021-09-22 13:18:43 +0000 UTC"
		Status: "InProgress"

sudo tos backup policy delete

Description

Delete the current backup policy and stop further automatic backups until a new backup policy is created.

Syntax

[<ADMIN> ~]$ sudo tos backup policy delete

sudo tos backup policy get

Description

Display the current backup policy.

Syntax

[<ADMIN> ~]$ sudo tos backup policy get

Information Provided in Output

• Policy creation date and time
• backup days, hour and minute in cron format
• Status - always Enabled
• Last backup date and time
• Number of backups found that were produced from this policy

Sample Output

[tufin-scheduler]
Creation Time: 2019-11-18 12:13:47 +0000 UTC
Cron: 0 0 * * 0,1,2
TTL: 720h0m0s
Status: Enabled
Last backup: 2019-11-18 12:13:47 +0000 UTC
Found backups: 1

sudo tos backup policy set

Description

Create a backup policy, which will run automatically and perform self cleanup. Only one backup policy can be defined at a time, so executing this command a second time will delete the current policy and create a new one in its place.

Syntax

$ sudo tos backup policy set --days <DAYS> --hour <HOUR> [--min <MINUTE>] [--ttl <TIME TO LIVE>]

Parameters

Examples

• sudo tos backup policy set --days sun,fri --hour 23 --min 30 (backup every Sunday and Friday at 23:30)
• sudo tos backup policy set --days sun,mon,tue,wed,thu,fri,sat --hour 00 --min 05 --ttl 720h00m00s (backup every day of the week at 5 minutes past midnight, expiry after 30 days)

sudo tos backup status

Description

Show details of backups currently in progress.

Syntax

[<ADMIN> ~]$ sudo tos backup status

Sample Output

$ sudo tos backup status
Found active backup "23-august-2021-16-18"

$ sudo tos backup status
No active backup was found

sudo tos backup storage set

Description

Sets either local backup storage or remote backup storage. Supported for all cloud providers (AWS/Azure/GCP) for public cloud only and not private cloud.

Syntax

$ sudo tos backup storage set --location <LOCATION> [--conf <CONF_PATH>] [--provider <PROVIDER_TYPE>] 

Parameters

Provider Details

In the configuration file, provide the following information:

Example

$ sudo tos backup storage set --location external --provider aws
		

Certificate Management

This is a subset of commands related to certificates:

• sudo tos certificate client generate

• sudo tos certificate import

• sudo tos certificate renew

sudo tos certificate client generate

Description

Create an authorization certificate for an OPM device.

[<ADMIN> ~]$ sudo tos certificate client generate[--id=<"ID">][--output=<"OUTPUT.TAR.GZ"][--help][--debug]

Parameters

sudo tos certificate import

Description

Import your own SSL certificates to authenticate and encrypt communications with your TOS server. Generation of certificates must be done outside of TOS Aurora (see Importing and Reverting a Signed Certificate). TOS Aurora must be stopped before running this command and started again afterwards.

Syntax

[<ADMIN> ~]$ sudo tos stop

[<ADMIN> ~]$ sudo tos certificate import [-t|--type=["server"]["auth"]["syslog"]] [-c|--cert=<CERT-PATH>][-k|--key=<KEY-PATH>][--ca=<CA-PATH>][--help] [--debug]

[<ADMIN> ~]$ sudo tos run

Parameters

Example

$ sudo tos certificate import --type="server" --cert=/tmp/certfile.pem --key=/tmp/keyfile.key

sudo tos certificate Renew

Description

Renew your existing SSL certificates to authenticate and encrypt communications with your TOS server. TOS Aurora must be stopped before running this command and started again afterwards.

Syntax

[<ADMIN> ~]$ sudo tos stop

[<ADMIN> ~]$ sudo tos certificate renew [-t|--type=["server"]["auth"]["all"]][--help] [--debug]

[<ADMIN> ~]$ sudo tos run

Parameters

Cluster Management

This is a subset of commands related specifically to clusters:

• sudo tos cluster connect

• sudo tos cluster disconnect-rc-cluster

• sudo tos cluster generate-otp

• sudo tos cluster ha-disable

• sudo tos cluster ha-enable

• sudo tos cluster list

• sudo tos cluster node add

• sudo tos cluster node list

• sudo tos cluster node remove

• sudo tos cluster node replace

• sudo tos cluster primary-vip get

• sudo tos cluster primary-vip set

• sudo tos cluster rotate-certificate

• sudo tos cluster node set-primary

• sudo tos cluster snapshot create

• sudo tos cluster snapshot restore

• sudo tos cluster syslog-vip add

• sudo tos cluster syslog-vip list

• sudo tos cluster syslog-vip remove

sudo tos cluster connect

Description

Connect a remote collector cluster to the central cluster. The command is run on the remote collector cluster after generating a password by running tos cluster generate-one-time-password on the central cluster. Requires the password generated previously by running tos cluster generate-otp on the central server.

In rare cases, connecting or disconnecting one RC can cause additional RCs to disconnect. Check that no other RCs have been disconnected by going on the SecureTrack status page. If you see that an RC has become disconnected, wait a few minutes. If it remains disconnected, connect it manually.

See Connect a Remote Collector for full procedure.

Syntax

[<ADMIN> ~]$ sudo tos cluster connect ​
                --central-cluster-vip=​
                --remote-cluster-vip=​
                --remote-cluster-name=​
            --initial-secret=​

Parameters

sudo tos cluster disconnect-rc-cluster

Description

Disconnect a remote collector cluster from its central cluster.

In rare cases, connecting or disconnecting one RC can cause additional RCs to disconnect. Check that no other RCs have been disconnected by going on the SecureTrack status page. If you see that an RC has become disconnected, wait a few minutes. If it remains disconnected, connect it manually.

Syntax

[<ADMIN> ~]$ sudo tos cluster disconnect-rc-cluster --cluster-id <ID>

Parameters

See Disconnect a Remote Collector for full procedure.

sudo tos cluster generate-otp

Description

Run on a central server to which you want to connect a remote collector and generates a password that needs to be provided when connecting the remote collector using tos cluster connect. The password remains valid for about five minutes. (otp stands for one time password.)

Syntax

[<ADMIN> ~]$] sudo tos cluster generate-otp

Example

[tufin-admin@TufinOS ~]$ sudo tos cluster generate-otp
4a120db6-401a-4991-b0c5-54ufc91c150c
[tufin-admin@TufinOS ~]$
		

sudo tos cluster ha disable

Turn off high availability mode.

1. On the primary data node:

   [<ADMIN> ~]$ sudo tos cluster ha disable [--force]

   sudo tos cluster ha disable

   --force should be used only if the cluster status is not healthy - see sudo tos status.

   On completion replication of data to the additional data nodes will cease.

1. Verify that HA is no longer active by running sudo tos status on the primary data node.

2. Data nodes other than the primary data node will contribute very little to the running of the cluster. We recommend removing them using sudo tos cluster node remove.

sudo tos cluster ha enable

Description

Turn on high availability mode.

Prerequisites:

• A total of three data nodes in your cluster.

Steps:

1. On the primary data node:

   [<ADMIN> ~]$ sudo tos cluster ha enable

   sudo tos cluster ha enable

   Replication of data will commence. The time to completion will vary depending on the size of your database.

   On completion,  TOS Aurora will be in high availability mode.

2. Verify that HA is active by running sudo tos status.

3. We recommend defining a notification to inform you in the event of a change in the health of your cluster - see TOS Monitoring.

sudo tos cluster list

Description

List all remote collector clusters for a central cluster.

Syntax

[<ADMIN> ~]$ sudo tos cluster list <FORMAT>

Parameters

Example

sudo tos cluster node add

Description

This command adds a data node or worker node to the cluster.

Steps

1. On the primary data node run:

   [<ADMIN> ~]$ sudo tos cluster node add --role=<TYPE>

   sudo tos cluster node add --role=<TYPE>

   where <TYPE> is worker or data, depending on the type of node you want to add.

   On completion, a new command string is displayed, which you will need to run on the new node within one hour. If the allocated time expires, you will need to repeat the current step.

2. Log in to the CLI of the server to be added as a new node in the cluster.

3. On the new node, run the command string displayed previously on the primary data node in step 2 above. If the allocated time has expired, you will need to start from the beginning.
4. Verify that the node was added by running sudo tos cluster node list on the primary data node.

sudo tos cluster node list

Description

This command lists all nodes in the cluster showing IP address, node status and other attributes for each.

Syntax

[<ADMIN> ~]$ sudo tos cluster node list [--output|-o <type>]

Parameters

Example Output:

# tos cluster node list -o text
			
Nodes list:
			
[ node1 ]
Status:  Ready
Role:  data
Primary:  true
Data-Enabled:  true

[ node2 ]
Status:  Ready
Role:  data
Primary:  false
Data-Enabled:  true

[ node3 ]
Status:  Ready
Role:  data
Primary:  false
Data-Enabled:  true	

sudo tos cluster node remove

Description

This command removes a node definition from the cluster. If you want to replace a node, we recommend using sudo tos cluster node replace instead of removing and adding nodes.

When a node is removed from the cluster, the functions it performed and data it contained are transferred to the primary data node and/or other nodes.

Limitations

• A data node cannot be removed from the cluster while high availability is active.

• The command will not remove a node, with a status is not healthy, unless the --force flag is used. Running the command without force flag on the wrong node will not result in the destruction of the cluster as there is hostname match validation; however, running it with --force on the wrong node can destroy the cluster.

Steps

1. Identify the worker node you want to remove.
2. On the primary data node, check the status of the node you want to remove.

   Run sudo tos cluster node list.

   • If the node is in a healthy state:

     1. On the primary data node, run:

        [<ADMIN> ~]$ sudo tos cluster node remove <node>

        sudo tos cluster node remove <node>

        Parameters

        Parameter	Description	Required/Optional
        <node>	Hostname of the node to remove.	Required

        On completion, a new command string is displayed, which you will need to run on the node you want to remove within 30 minutes. If the allocated time expires, you will need to repeat the current step.

     2. Log in to the CLI of the node to be removed.

     3. On the node to be removed, run the command string displayed on completion of the command above. On completion, all TOS-related directories and data will be deleted from the node, therefore make sure you run it on the correct node. Running the command on the wrong node will destroy the cluster.

     All TOS-related directories will be deleted from the node.

   • If the node you want to remove is not in a healthy state:

     1. On the primary data node, run:

        [<ADMIN> ~]$ sudo tos cluster node remove <node> --force

        sudo tos cluster node remove <node> --force

        Parameters

        Parameter	Description	Required/Optional
        <node>	Hostname address of the node to remove.	Required

        TOS directories will not be deleted from the node

     2. If the machine is still serviceable, you can delete the TOS directories manually:

        [<ADMIN> ~]$ sudo rm -rf /opt/tufin/data/*

        sudo rm -rf /opt/tufin/data/*

        [<ADMIN> ~]$ sudo rm -rf /opt/tufin/logs/*

        sudo rm -rf /opt/tufin/logs/*

        [<ADMIN> ~]$ sudo rm -rf /opt/tufin/migration/*

        sudo rm -rf /opt/tufin/migration/*

        [<ADMIN> ~]$ sudo rm -rf /opt/tufin/dumps/*

        sudo rm -rf /opt/tufin/dumps/*
3. Verify that the node has been removed by again running sudo tos cluster node list.

sudo tos cluster node replace

Description

Replace an existing data node in the cluster with a new node.

Limitations

• If the existing node is not healthy, you must use the --force flag. This will allow the command to be run but will not delete the TOS Aurora data.

• The new node cannot already be a node in the cluster.

• The primary data node cannot be replaced using this command. You must first elect a different data node for the role, using sudo tos cluster set-primary.

Cluster and node status and health can be seen using sudo tos status.

Steps

To replace an existing node with a new one:

1. On the primary data node:

   [primary data node]# sudo tos cluster node replace <OLD_NODE> [--force] 

   sudo tos cluster node replace <OLD_NODE> [--force]

   Parameters

   Parameter	Description	Required/Optional
   <OLD NODE>	Name of the node you want to remove, as seen in the output of sudo tos cluster node list.	Required
   --force	Only use this flag when the node you want to remove is not in a healthy state.	Optional

   On completion, one or two new command strings will appear in the output. The second command string will appear only if the original node was in a healthy state, i.e.  -force was not used.

2. Copy/paste the first string and run it on the new node.

3. If a second string appeared in the output from the command that you ran on the primary data node, copy/paste this string and run it on the old node.

4. Verify that the nodes in the cluster are what you expected, by running sudo tos cluster node list on the primary data node.

sudo tos cluster primary-vip get

Display the primary VIP of the cluster.

[<ADMIN> ~]$ sudo tos cluster primary-vip get

sudo tos cluster primary-vip set

Description

Change the primary VIP of the cluster, providing a valid IPv4 address. When completed, check that the command succeeded by running command tos cluster primary-vip get.

Syntax

[<ADMIN> ~]$ sudo tos cluster primary-vip set <11.22.33.44>

sudo tos cluster rotate-certificate

Description

Creates a new SSL certificate on a central server for connection with remote collectors.

Syntax

[<ADMIN> ~]$ sudo tos cluster rotate-certificate

sudo tos cluster node set-primary

Description

This command gives the role of primary data node to a data node in the cluster. It can be run on any data node.

Steps

1. On the node you want to assume the role of primary data node:

   [Data Node]$ sudo tos cluster node set-primary

   sudo tos cluster node set-primary

2. Verify that the node roles are as you intended, by running sudo tos cluster node list on any data node.

3. We strongly recommend performing a one-time backup and exporting it immediately, as all prior backups are deleted from the original primary data node.

sudo tos cluster snapshot create

Description

Saves a snapshot of TOS Aurora and Tufin Extensions.

After saving the snapshot, this command stops TOS Aurora. Use this command before an upgrade of TufinOS.

After the upgrade, the sudo tos cluster snapshot restore command restores the saved data and restarts TOS Aurora.

Syntax

[<ADMIN> ~]$ sudo tos cluster snapshot create

sudo tos cluster snapshot restore

Description

Restores a snapshot of TOS Aurora and Tufin Extensions.

Before upgrading TufinOS, the sudo tos cluster snapshot create command saves the data and stops TOS Aurora.

Use this command during a re-installation, after an upgrade of TufinOS, to restore TOS Aurora data. After re-installation, this command starts TOS Aurora. The snapshot is stored in /opt/tufin/cluster-snapshot/binaries. The command needs to be run there.

Syntax

[<ADMIN> ~]$ sudo /opt/tufin/cluster-snapshot/binaries/tos cluster snapshot restore

sudo tos cluster syslog-vip add

Description

Add a syslog VIP, specifying the IP to use. This action will temporarily stop TOS services until it completes, which may take up to 15 minutes or more.

Syntax

[<ADMIN> ~]$ sudo tos cluster syslog-vip add <SYSLOG_VIP> [--port <PORT>] [--transport <STRING>]

Parameters

sudo tos cluster syslog-vip list

Description

List all syslog VIPs.

Syntax

[<ADMIN> ~]$ sudo tos cluster syslog-vip list

sudo tos cluster syslog-vip remove

Remove a syslog VIP, specifying the VIP to remove. This action will temporarily stop TOS services until it completes, which may take up to 15 minutes or more.

[<ADMIN> ~]$ sudo tos cluster syslog-vip remove <SYSLOG_VIP>

Configuration Management

tos config is a subset of commands for viewing and changing various TOS Aurora settings or properties. It has four formats:

• tos config get

• tos config list

• tos config log-level

• tos config set

• tos config reset

Each is described in more detail below.

Global and Service-Specific Properties

There are two types of TOS property - global and service-specific. Some global properties can be changed freely to suit the needs of your organization and these are explained in Configuring TOS. However the majority of properties - mostly service-specific but also some global - should be changed only if specific problems are encountered and should be done only with the guidance of Tufin support.

sudo tos config get

Description

Variant of sudo tos config. Display the current value of one or more TOS Aurora properties that have been configured using tos config set and/or properties that still retain their default values. You can filter by service, property or both, or run without any parameters to list all properties for all services. Properties that have never been set using sudo tos config set or have been reset using sudo tos config reset are not displayed unless the --default or -d flags are used.

Syntax

[<ADMIN> ~]$ sudo tos config get [-p param1,param2...][-s service][--default|-d]

Parameters

Examples

[<ADMIN> ~]$ sudo tos config get
[<ADMIN> ~]$ sudo tos config get -p server.timezone
[<ADMIN> ~]$ sudo tos config get -s device-collector -f
[<ADMIN> ~]$ sudo tos config get -f -p tos.sso.enabled,promtail.memory.limit -s device-collector	

Output Formats

No parameters - all properties in all services, sorted by property.

[<ADMIN> ~]$ sudo tos config get
SERVICE    PROPERTY    VALUE   MESSAGE
service1   property1   value
service2   property1   value
service3   property1   value
service1   property2   value
service2   property2   value
..
..
..

Parameter -s only - all properties for specified service

[<ADMIN> ~]$ sudo tos config get -s <service name>
SERVICE          PROPERTY    VALUE   MESSAGE
<service name>   property1   value
<service name>   property2   value
<service name>   property3   value   Awaiting approval
<service name>   property4   value   Authorized by IT
<service name>   property5   value
..
..
..

Parameter -p only - all specified properties in all services. sorted by property

[<ADMIN> ~]$ sudo tos config get -p <property1,property2 name>
SERVICE     PROPERTY           VALUE   MESSAGE
service 1   <property1 name>   value
service 2   <property1 name>   value   Changed by admin
service 2   <property2 name>   value
service 1   <property2 name>   value
service 5   <property2 name>   value
..
..
..	

Parameter -p and -s - all specified properties for specified service

[<ADMIN> ~]$ sudo tos config get -p <property name> -s <service name>
SERVICE          PROPERTY    VALUE   MESSAGE
<service name>   property1   value
<service name>   property2   value
<service name>   property3   value
<service name>   property4   value
<service name>   property5   value
..
..
..

sudo tos config list

Description

Variant of sudo tos config. List properties that can be configured using sudo tos config set. Each property is listed followed by information such as description, default value, type, whether applicable globally or service-specific, and constraints such as values and format.

Syntax

[<ADMIN> ~]$ sudo tos config list [-p <property1>,<property2>...>][-s <service>][--services][--all]

Parameters

Output Format (all except when used with --services parameter)

[<ADMIN> ~]$ sudo tos config list
PROPERTY 1
  Description - <description>
  Default - <default value>
  Applicable on - global/service-specific
  Type - <string, boolean...>
  Constraints - values, format etc
PROPERTY 2
  Description - <description>
  Default - <default value>
  Applicable on - global/service-specific
  Type - <string, boolean...>
  Constraints - values, format etc
	..
	.. 

Examples

[<ADMIN> ~]$ sudo tos config list
[<ADMIN> ~]$ sudo tos config list -p server.timezone
[<ADMIN> ~]$ sudo tos config list -p server.timezone,web.session.inactivityTimeout
[<ADMIN> ~]$ sudo tos config list --all
[<ADMIN> ~]$ sudo tos config list --services

sudo tos config log-level

Description

Variant of sudo tos config. This command is intended for use by Tufin support only to view and set the log levels of the various TOS Aurora services. By default, services do not have a debug log level. This needs to be manually set.

Syntax

[<ADMIN> ~]$ sudo tos config log-level [command]

Parameters

sudo tos config set

Description

Variant of sudo tos config. Change one or more TOS Aurora properties.

There are two types of TOS property - global and service-specific. You are encouraged to modify global properties to suit the needs of your organization. See all global properties by running command tos config list. Changing service-specific properties should only be done if specific problems are encountered and should be done only with the guidance of Tufin support.

Syntax

[<ADMIN> ~]$ sudo tos config set –p param1=val1[,param2=val2...][-s service1,service2][-c] [-m <TEXT>] [-d]

Parameters

Examples

[<ADMIN> ~]$ sudo tos config set -p load.model=medium -d 24h -m temporary change of load for a day
[<ADMIN> ~]$ sudo tos config set -p st.trace.Mem=false -s device-collector

sudo tos config reset

Description

Variant of sudo tos config. Reset one or more TOS Aurora settings to their default values.

Syntax

[<ADMIN> ~]$ sudo tos config reset [–p param1=val1,param2=val2...][-s service1,service2][-c]

Parameters

Examples

[<ADMIN> ~]$  tos config reset -p load.model
[<ADMIN> ~]$  tos config reset -p st.trace.Mem=false -s device-collector

Disaster Recovery Management

This is a subset of commands related to disaster recovery:

• sudo tos dr connect

• sudo tos dr disable

• sudo tos dr generate-token

• sudo tos dr init

• sudo tos dr status

• sudo tos dr switch

sudo tos dr connect

Run this command on the cluster that will be designated as the standby cluster.

Description

Connects the standby cluster with the active cluster. After the connection is complete, most of the services in the standby cluster will be shutdown.

Syntax

[<ADMIN> ~]$ sudo tos dr connect [-n <name>][-p <IP_ADDRESS>][-t <TOKEN>]

Parameters

Example

$ sudo tos dr connect -p 192.168.32.23 -t Zbk7lwH4Qu7rINz8DvuwjQgJgpWjcsgtxKe3h90=
[Jul 18 10:39:07]  INFO Local cluster state is "StandBy"	

sudo tos dr disable

Run this command to disable disaster recovery on a cluster with DR.

Description

Disables DR on the cluster.

Syntax

[<ADMIN> ~]$ sudo tos dr disable

sudo tos dr generate-token

Run this command on the cluster that will be designated as the active cluster.

Description

Generates a unique token that is used to authenticate the connection between the two clusters.

Syntax

[<ADMIN> ~]$ sudo tos dr generate-token

Example

$ sudo tos dr generate-token
[Jul 18 10:38:45]  INFO Please save the token and use it when running the connect command from remote peer
Token: z1obGYNhdcb85rsDI7IrygGfMP5rHFq50iygPcEWxnE=		

sudo tos dr init

Run this command on the cluster that will be designated as the active cluster.

Description

Initializes DR on a cluster and makes it the active cluster. The backup destination must be set to external storage before running. The command also sets the backup policy in the same way as sudo tos backup policy set.

Syntax

[<ADMIN> ~]$ sudo tos dr init [-n <NAME>][--rate <RATE>][--hour <HOUR>][--minute <MINUTE>]

Parameters

Example

$ sudo tos dr init 
[Jul 18 10:38:34]  INFO DR initialization finished successfully	

sudo tos dr status

Description

Display DR status for active and standby peers. The standby cluster can view the backups taken on the active cluster .

Syntax

[<ADMIN> ~]$ sudo tos dr status

Example

$ sudo tos dr status 
DR configuration: 
  Backup policy rate: 24H
  Hour: 0:0h

Last compatible healthy backup Timestamp: 2023-07-10 06:10:40 +0000 UTC

Local cluster status:
  Name: local
  State: Active, Ready
  Last Update: 2023-07-10 09:33:45 +0300 IDT
  Version: 23.2.1100-20230709122412+23-2-pga.0.0
  HA: false
  Modules: ST, SC

Peer cluster status:  
  Name: remote
  State: StandBy, Ready
  Last Update: 2022-07-26 13:53:22 +0300 IDT
  Version: 23.2.1100-20230709122412+23-2-pga.0.0
  HA: false
  Modules: ST, SC

sudo tos dr switch

Description

Switches activity between peer clusters.

Syntax

[<ADMIN> ~]$ sudo tos dr switch [-b <BACKUP_NAME>] [-c]

Parameters

Example

$ sudo tos dr switch
[Jul 18 10:46:55]  INFO Switching current peer to Active
[Jul 18 10:46:55]  INFO Setting peer to "Switch" mode	

General Commands

This is a subset of commands that allows you to archive and temporarily restore old revision data (device policy rules):

• sudo tos completion

• sudo tos help

• sudo tos install

• sudo tos maintenance

• sudo tos report

• sudo tos restore

• sudo tos run

• sudo tos start

• sudo tos status

• sudo tos status history

• sudo tos stop

• sudo tos uninstall

• sudo tos update

• sudo tos version

sudo tos completion

Description

Adds the ability to use auto-completion for commands or arguments in a Linux shell session. Run these commands:

Syntax

[<ADMIN> ~]$ sudo tos completion bash > ~/.bash

[<ADMIN> ~]$ source ~/.bash

sudo tos help

Description

List all available TOS CLI commands.

Syntax

[<ADMIN> ~]$ sudo tos help

sudo tos install

Description

Initiate the installation of TOS Aurora on your system.

Syntax

[<ADMIN> ~]$ sudo tos install [--dry-run] --modules=<MODULE-TYPE> --primary-vip=<PRIMARY> --services-network=<SERVICE-CIDR> --load-model=<LOAD> -d

Parameters

Examples:

[<ADMIN> ~]$ sudo tos install --migrate --modules=ST,SC --primary-vip=192.168.1.2 --services-network=10.10.10.0/24 --load-model=small

[<ADMIN> ~]$ sudo tos install --clean --modules=RC --primary-vip=external --services-network=10.10.10.0/24 --load-model=large

sudo tos maintenance

Description

tos maintenance lets you put TOS Aurora into maintenance mode, a state in which users cannot access the UI and communication with devices and connected clusters is halted. Only command line access is allowed.

Syntax

[<ADMIN> ~]$ sudo tos maintenance --mode <state>

Parameters

Examples

[<ADMIN> ~]$ sudo tos maintenance --mode on
[<ADMIN> ~]$ sudo tos maintenance --mode off

sudo tos report

Description

Create a file containing a list of cluster events, similar to sudo tos status history.

You can use the flags only or a combination of the commands with flags (see examples).

You can also use label sets with commands. The syntax for label sets is key=value. Examples of label sets include container, filename, instance, or pod (see examples).

Syntax

[<ADMIN> ~]$ sudo tos report [command]

[<ADMIN> ~]$ sudo tos report [flags]

Parameters - Command

Parameters - Flags

Examples

[<ADMIN> ~]$ sudo tos report -f myreport
[<ADMIN> ~]$ sudo tos report -s 12h30m30s (syntax before R23-2 PGA.0.0)
[<ADMIN> ~]$ sudo tos report -s "2022-01-01 14:00:00" -u "2023-01-01 14:00:00" 
[<ADMIN> ~]$ sudo tos report collect -s "2022-10-20 13:30:00" -u "2022-12-20 13:30:00" 			
[<ADMIN> ~]$ sudo tos report list -s "2022-10-20 13:30:00" -u "2022-12-20 13:30:00"
[<ADMIN> ~]$ sudo tos report list pod=cassandra
[<ADMIN> ~]$ sudo tos report list instance=dev

sudo tos restore

Description

Restore your data from a single backup from the same TOS release and version (for example, backups made under R24-1PHF4.1.0 can only be restored to an R24-1PHF4.1.0 deployment).

If you are restoring a remote collector cluster, you must reconnect the RC to the central cluster after the restore. If you are restoring a central cluster with remote collectors attached, you must reconnect all remote collectors after the restore.

The backup policy is not included in backups, so after restoring you must configure a new backup policy using tos backup policy set.

Tufin auto-generated certificates will be automatically re-created on the first connection following the restore.

We strongly recommend using the screen command before proceeding.

Important. After you restore TOS to a different or changed production environment, such as a new appliance or VM, or an in-place machine following an operating system upgrade, you must upload the license file. If you are restoring to a lab environment, there is no need to upload the license file. TOS will be fully functional and in 'lab mode' . TOS will then automatically shut down after 30 days.

Syntax

[<ADMIN> ~]$ sudo tos restore from-backup <BACKUP-NAME>

Parameters

Examples

• sudo tos restore from-backup 26-october-2020-11-49 (for on-demand backups)

• sudo tos restore from-backup tufin-scheduler-20201208073700 (for scheduled backups)

sudo tos run

Description

Start the TOS Aurora services. The alias start can be used instead.

Syntax

[<ADMIN> ~]$ sudo tos run

Parameters

sudo tos start

Description

An alias for sudo tos run.

Syntax

[<ADMIN> ~]$ sudo tos start

sudo tos status

Description

Display information about your TOS Aurora system.

Syntax

[<ADMIN> ~]$ sudo tos status [-o|--output <type>]

Parameters

Example Output

Click here to see an example

[<ADMIN> ~]$ sudo tos status -o yaml
[Aug 7 14:55:49]  INFO Checking cluster health status
status: 1
version: 24-1-prc1.0.0
cluster:
  metadata:
    type: node
    name: node
    annotations: []
  status: 1
  clustermode: 2
  nodes:
    node1:
	  status: 1
	  type: 4
	  healthy: true
	  diskusage:
	    /opt:
		  status: 1
		  usage: 24.740473
	node3:
	  status: 1
	  type: 1
	  healthy: true
	  diskusage:
		/opt:
		  status: 1
		  usage: 4.0426407
backup:
  metadata:
    type: backupstorage
    name: backupstorage
    annotations: []
  status: 1
  location: 'Local s3:http://minio.default.svc:9000/velerok8s/restic/default '
  lastbackupstatus: Ok
  lastbackuptimestamp: null
registry:
  metadata:
    type: registry
    name: registry
    annotations: []
  status: 1
  certificateexpiryindays: 819
  renewalfailed: false
disasterrecovery:
  metadata: null
  enabled: false
databases:
  - metadata:
    type: database
    name: postgres
    annotations: []
  status: 1
  outofsync: null
  - metadata:
    type: database
    name: ongDb
    annotations: []
  status: 1
  outofsync: null
  - metadata:
    type: database
    name: kafka
    annotations: []
  status: 1
  outofsync: null
  - metadata:
    type: database
    name: cassandra
    annotations: []
  status: 1
  outofsync: null
  - metadata:
    type: database
    name: mongodb
    annotations: []
  status: 1
  outofsync: null
				

sudo tos status history

Description

List cluster events, similar to sudo tos report.

Syntax

[<ADMIN> ~]$ sudo tos status history [-r|--reverse] [-s|--since <HMS>]

Parameters

Examples

[<ADMIN> ~]$ sudo tos status history --reverse
[<ADMIN> ~]$ sudo tos status history -s 12h30m0s
[<ADMIN> ~]$ sudo tos status history			

sudo tos stop

Description

Stop all TOS Aurora services. This process may take time. To prevent corrupted backup files, tos stop cannot be run while a backup is in progress. If you force the command, the backup file will be deleted.

Syntax

[<ADMIN> ~]$ sudo tos stop [--confirm] [--force]

Parameters

sudo tos uninstall

Description

Uninstalls TOS on the primary data node. After TOS is uninstalled, certain TOS directories, including data, backup files and log files will remain on the machine. These files and directories will be deleted if TOS is reinstalled.

If high availability is enabled, disable it first and if the cluster contains worker nodes, remove them first.

For the full procedure, see Uninstalling TOS.

Syntax

[<ADMIN> ~]$ sudo tos uninstall

sudo tos upgrade

Description

Update TOS from an earlier version of TOS Aurora. See Upgrade From TOS Aurora.

sudo tos version

Description

Get information about the TOS Aurora and supporting software installed on your system.

• TOS Aurora
• Helm
• Kubernetes
• CLI - TufinOS command line interface

Syntax

[<ADMIN> ~]$ sudo tos version [-f|--full][-o|--output=("text")("json")("yaml")]
            

Parameters

Tufin Extensions (formerly Tufin Marketplace)

These commands are used for the management of Tufin extensions (formerly Tufin Marketplace apps) and Professional Services (PS) solutions. Installation and upgrading of Tufin extensions will normally be done by executing the downloaded run file as explained in the appropriate Tufin Extensions KC.

• sudo tos apps list

• sudo tos apps install

• sudo tos apps upgrade

• sudo tos apps uninstall

sudo tos apps list

Description

List all installed Tufin extensions and Professional Services solutions.

Syntax

[<ADMIN> ~]$ sudo tos apps list [--output|-o <type>]

Parameters

Examples

[tufin-admin@TufinOS ~]$ sudo tos apps list
NAME          TITLE                    STATUS     PROVIDER   VERSION   INSTALLATION DATE
qa-test-app   PS Customizations test   Deployed   ps         1.2.5     2021-09-14
ps-proxy      PS Proxy                 Deployed   ps         1.0.0     2021-09-14

[tufin-admin@TufinOS ~]$ sudo tos apps list -o yaml
items:
- name: qa-test-app
  title: PS Customizations test
  status: Deployed 
  provider: ps
  version: 1.2.5
  creationTimestamp: "2021-09-14"
- name: ps-proxy
  title: PS Proxy
  status: Deployed
  provider: ps
  version: 1.0.0
  creationTimestamp: "2021-09-14"	

sudo tos apps install

Description

This is meant for installing a PS solution from a .tar file. It is not normally used for Tufin extensions, which are installed by executing the downloaded run file as explained in the Tufin Extensions KC.

Syntax

[<ADMIN> ~]$ sudo tos apps install <FILE-NAME> [--no-wait]

Parameters

sudo tos apps upgrade

Description

This is meant for upgrading a PS solution from a .tar file. It is not normally used for Tufin extensions, which are installed by executing the downloaded run file as explained in the Tufin Extensions KC.

Syntax

[<ADMIN> ~]$ sudo tos apps upgrade <FILE-NAME>

Parameters

sudo tos apps uninstall

Description

Remove an installed Tufin extension.

Syntax

[<ADMIN> ~]$ sudo tos apps uninstall <NAME>

Parameters

Module Management

A subset of commands to add, remove and list active modules of TOS Aurora.

Subset includes commands:

• sudo tos modules add

• sudo tos modules list

• sudo tos modules remove

There are 3 types of modules:

• SecureTrack (ST)

• SecureChange (SC)

• Remote Collector (RC)

sudo tos modules add

Description

Add a module to TOS Aurora. In the current release, only the SecureChange module can be added.

Syntax

[<ADMIN> ~]$ sudo tos modules add SC

sudo tos modules list

List the active TOS Aurora modules. The alias ls can be used instead.

[<ADMIN> ~]$ sudo tos modules list

sudo tos modules remove

Description

Remove a module from TOS Aurora. In the current release, only the SecureChange module can be removed. When you remove a SecureChange module, both SecureChange and SecureApp data is removed. The alias rm can be used instead.

Syntax

[<ADMIN> ~]$ sudo tos modules remove SC

Profile Management

This is a subset of commands that allows you to archive and temporarily restore old revision data (device policy rules):

• sudo tos profile export

• sudo tos profile import

• sudo tos profile reload

• sudo tos profile show

sudo tos profile export

Description

Create a file containing the definitions of the current configuration of your TOS Aurora setup (see sudo tos profile show). The exported file can be modified and used to update the current configuration using the sudo tos profile import command.

Syntax

[<ADMIN> ~]$ sudo tos profile export <FILE>

Parameters

sudo tos profile import

Description

Place a new or changed configuration into the TOS Aurora cluster. The change can be made in a file previously exported with the sudo tos profile export command or with a clean file containing only the sections needing change, using the --merge parameter. After the command has run, you will need to run three additional commands as shown.

Syntax

[<ADMIN> ~]$ sudo tos profile import [--merge] <FILE>

[<ADMIN> ~]$ sudo tos profile reload

Parameters

sudo tos profile reload

Description

Update the current profile of your TOS Aurora application and server with the settings of a profile imported with the command sudo tos profile import.

Syntax

[<ADMIN> ~]$ sudo tos profile reload

sudo tos profile show

Description

Display the current configuration of your TOS Aurora setup. Information displayed includes:

• Tufin Orchestration Suite settings
• Tomcat settings
• TOS Aurora image version
• Load balancer IP - the IP required to connect to TOS Aurora through the browser and from devices
• TOS Aurora timezone (could be different from the server timezone)
• Database details

Syntax

[<ADMIN> ~]$ sudo tos profile show [--imported] 

Example Output

[root@TufinOS3-0029 ~]$ sudo tos profile show
			core:
			device-collector:
			TosConfig:
			CommitManagerService:
			maxConnections:
			..
			..
		.. 

Parameters

Script Management

This is a subset of commands that allows you to manage SecureChange scripts.

• sudo tos scripts sc list

• sudo tos scripts sc pull

• sudo tos scripts sc push

• sudo tos scripts sc remove

sudo tos scripts sc list

Description

List files and directories containing the SecureChange scripts you have uploaded.

Syntax

[<ADMIN> ~]$ sudo tos scripts sc list [relative path on SecureChange] [--detailed]

Include -l or [--detailed] to include details of the files, for example:

$ sudo tos scripts sc list --detailed
-rwxrwxr-x 1 1000 1000 35 Dec 15 11:17 basic.yaml
-rwxr-xr-x 1 1000 1000 267346 Dec 15 11:17 metrics
-rwxr-xr-x 1 1000 1000 292 Dec 15 11:17 promui.yaml
-rwxr-xr-x 1 1000 1000 298 Dec 15 11:15 promui1.yaml
drwxr-xr-x 2 root root 23 Dec 15 11:17 myfile
-rwxr-xr-x 1 1000 1000 11 Dec 15 11:17 myfile.txt

sudo tos scripts sc pull

Description

Download SecureChange scripts from SecureChange.

Syntax

[<ADMIN> ~]$ sudo tos scripts sc pull <path on local host> <relative path on SecureChange> [--overwrite]

Parameters

Copies files and folders, including sub-directories from the SecureChange node to a local directory.

sudo tos scripts sc push

Description

Upload SecureChange scripts to SecureChange.

The default SecureChange script location is /opt/tufin/data/securechange/scripts/.

Syntax

[<ADMIN> ~]$ sudo tos scripts sc push <path on local host> <relative path on SecureChange> [--overwrite]

Parameters

sudo tos scripts sc remove

Description

Deletes files and folders, including sub-directories in the designated SecureChange script directory.. The aliases rm and delete can be used instead.

If the [--force] parameter is not included, a warning message will appear before files are deleted.

Syntax

[<ADMIN> ~]$ sudo tos scripts sc remove [relative path on SecureChange] [--force]

Parameters