Sensor Management CLI Reference (Docker)

Overview of the climanager Service

Command Line Interface

The commands described in this article are executed in the Command Line Interface (CLI) of Cisco Crosswork Assurance Sensor Management Docker Long-Term Support.

To provide users with a familiar interface and reduce training time, a climanager service (smcli) is installed on the host.

Accessing climanager Service to Manage Cisco Crosswork Assurance Sensor Management

Using an SSH client, log in to your Docker host and execute:

/usr/bin/smcli.sh

On first use, you are asked to confirm the connection to localhost on port 2200. For example:

The authenticity of host '[localhost]:2200 ([127.0.0.1]:2200)'
can't be established.
RSA key fingerprint is SHA256:FYQGJ....
Are you sure you want to continue connecting
(yes/no/[fingerprint])?

Type yes to confirm.
Enter the password of skylight user.

For additional security, idle sessions timeout after 5 minutes of inactivity.

Configuration Commands

config show

Syntax:

config show

Command Description
This command displays appliance configuration information.

Example:

sm-cli: config show

network subnet = ["172.18.0.0/16" ] - ipv6enabled = "false"
network core-ip =
network core-http-port = 80
network core-https-port = 443
network medn1-ip =
network med-snmp-port = 1163
volume-location so-config = /home/skylight/so/config
volume-location so-mysql = /home/skylight/so/mysql
volume-location so-data = /home/skylight/so/data
volume-location so-logs = /home/skylight/so/logs

Input Parameters
None

Output Attributes
None

config set

Network

Syntax:

config set network <parameter> <value>

Command Description
This command sets the network for Cisco Crosswork Assurance Sensor Management Docker.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be stopped.

Example:

sm-cli: config set network core-https-port 8081

Removing existing Cisco Crosswork Assurance Sensor Management containers ...
so-mysql-25.07-SQA_PRODUCT
so-nbin1-25.07-SQA_PRODUCT
so-medn1-25.07-SQA_PRODUCT
so-core-25.07-SQA_PRODUCT

Removing existing Skylight syslog container ...
[+] Running 1/1
 ✔ Container so-syslog-25.07-SQA_PRODUCT  Removed 1.8s

Port has been set to: [8081]
Re-creating Skylight syslog container by default...
[+] Running 1/1
 ✔ Container so-syslog-25.07-SQA_PRODUCT  Started 0.5s

Input Parameters

Parameter	Value	Description
core-http-port	A numeric value between 1 and 65535	HTTP port for Cisco Crosswork Assurance Sensor Management business service. Default: port 80
core-https-port	A numeric value between 1 and 65535	HTTPS port for Cisco Crosswork Assurance Sensor Management business service. Default: port 443
core-ip	IP address V4 or V6 format	IP address for Cisco Crosswork Assurance Sensor Management business and NB API service
med-ip	IP address V4 or V6 format	IP address for Cisco Crosswork Assurance Sensor Management mediation service. Note: Two configured interfaces with the same subnet is not supported on Cisco Crosswork Assurance Sensor Management Docker because the IP stack will receive packets but will respond from either interface. Consequently, responses will not always get to their intended destinations.
med-snmp-port	A numeric value between 1024 and 49151	SNMP trap port for Cisco Crosswork Assurance Sensor Management. Default: port 1163. Note: This port should be set to the same value as the one set in UI, screen Admin/SNMP/SNMP fault receiver configuration.
subnet	IPv4 and IPv6 subnet address in CIDR format	Subnet for private network. Note: IPv4 is mandatory, IPv6 is optional.

Output Attributes
None

Volume Location

Syntax:

config set volume-location <parameter> <value>

Command Description
This command sets location for Crosswork Assurance Sensor Management container volume.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be stopped.

Example:

sm-cli: config set volume-location logs /home/skylight/so/latestlog

Removing existing syslog container ...
 ✔ Container so-syslog-25.07.1-LTS-GA Removed                               0.4s

Removing existing Cisco Crosswork Assurance Sensor Management containers ...
so-mysql-25.07.1-LTS-GA
so-nbin1-25.07.1-LTS-GA
so-medn1-25.07.1-LTS-GA
so-core-25.07.1-LTS-GA

Removing current volume ...
so-logs
Creating volume so-logs mounted on /home/skylight/so/latestlog ...
so-logs
Volume so-logs created:
[
    {
        "CreatedAt": "2026-06-25T03:26:27Z",
        "Driver": "local",
        "Labels": null,
        "Mountpoint": "/var/lib/docker/volumes/so-logs/_data",
        "Name": "so-logs",
        "Options": {
            "device": "/home/skylight/so/latestlog",
            "o": "bind",
            "type": "none"
        },
        "Scope": "local"
    }
]

Re-creating syslog container by default...
 ✔ Container so-syslog-25.07.1-LTS-GA Started                               0.3s

Input Parameters

Parameter	Value	Description
logs	String	Location for Cisco Crosswork Assurance Sensor Management logs volume. Default: /home/skylight/so/logs
mysql	String	Location for Cisco Crosswork Assurance Sensor Management mysql volume. Default: /home/skylight/so/mysql
data mediation	String	Location for Cisco Crosswork Assurance Sensor Management mediation volume
data so-data	String	Location for Cisco Crosswork Assurance Sensor Management data volume. Default: /home/skylight/so/data

Output Attributes
None

config reset

Reset Network

Syntax:

config reset network <parameter>

Command Description
This command resets network parameter back to default.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be stopped.

Example:

sm-cli: config reset network med-ip mediation 1

Removing existing Cisco Crosswork Assurance Sensor Management containers ...

Removing existing syslog container ...
 ✔ Container so-syslog-25.07.1-LTS-GA Removed                               0.3s

IP address has been set to: []
Re-creating syslog container by default...
 ✔ Container so-syslog-25.07.1-LTS-GA Started                               0.3s

Input Parameters

Parameter	Description
core-http-port	Revert the Cisco Crosswork Assurance Sensor Management HTTP port to default (80)
core-https-port	Revert the Cisco Crosswork Assurance Sensor Management HTTPS port to default (443)
core-ip	Revert IP address for Cisco Crosswork Assurance Sensor Management business and NBAPI service to default (all host interface)
med-ip	Revert IP address for Cisco Crosswork Assurance Sensor Management mediation service to default (all host interface)
med-snmp-port	Revert the Cisco Crosswork Assurance Sensor Management SNMP trap receiver port to default (1163). Note: This port should be set to the same value as the one set in UI, screen Admin/SNMP/SNMP fault receiver configuration.

Output Attributes
None

Reset Volume Location

Syntax:

config reset volume-location <parameter>

Command Description
This command resets the volumes location to the default folder.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be stopped.

Example:

sm-cli: config reset volume-location logs

Removing existing syslog container ...
 ✔ Container so-syslog-25.07.1-LTS-GA Removed                               0.2s

Removing existing Cisco Crosswork Assurance Sensor Management containers ...

Removing current volume ...
so-logs
Creating volume so-logs mounted on /home/skylight/so/logs ...
so-logs
Volume so-logs created:
[
    {
        "CreatedAt": "2026-06-25T03:33:59Z",
        "Driver": "local",
        "Labels": null,
        "Mountpoint": "/var/lib/docker/volumes/so-logs/_data",
        "Name": "so-logs",
        "Options": {
            "device": "/home/skylight/so/logs",
            "o": "bind",
            "type": "none"
        },
        "Scope": "local"
    }
]

Re-creating syslog container by default...
 ✔ Container so-syslog-25.07.1-LTS-GA Started                               0.3s

Input Parameters

Parameter	Description
mysql	Revert data volume of mysql to the /home/skylight/so/mysql
logs	Revert data volume of the log to the /home/skylight/so/logs
data	Revert data volume of so-data to the /home/skylight/so/data

Output Attributes
None

Service Control Commands

Services Status

Syntax:

services status

Command Description
This command displays a list of services on the Cisco Crosswork Assurance Sensor Management Docker and indicates the state of each service.

Example:

sm-cli: services status

so-mysql - service is running | Up 3 minutes (healthy)
so-nbin1 - service is running | Up 3 minutes (healthy)
so-medn1 - service is running | Up 3 minutes (healthy)
so-core - service is running | Up 3 minutes (healthy)
so-syslog - service is running | Up 4 minutes (healthy)
so-medn2 - service is running | Up 3 minutes (healthy)
so-medn3 - service is running | Up 3 minutes (healthy)
=================
7/7 service(s) are running

Input Parameters
None

Output Attributes
None

Services Start

Syntax:

services start

Command Description
This command starts the services on the Cisco Crosswork Assurance Sensor Management Docker.

Example:

sm-cli: services start

Proceed ? (y/N)
y
Starting Cisco Crosswork Assurance Sensor Management services ...
[+] up 6/6
 ✔ Container so-mysql-25.07.1-LTS-GA Started 0.7s
 ✔ Container so-core-25.07.1-LTS-GA Started 0.9s
 ✔ Container so-medn1-25.07.1-LTS-GA Started 1.5s
 ✔ Container so-nbin1-25.07.1-LTS-GA Started 1.6s
 ✔ Container so-medn2-25.07.1-LTS-GA Started 1.8s
 ✔ Container so-medn3-25.07.1-LTS-GA Started 1.3s
Cisco Crosswork Assurance Sensor Management services are started

Input Parameters
None

Output Attributes
None

Services Stop

Syntax:

services stop

Command Description
This command stops services on the Cisco Crosswork Assurance Sensor Management Docker.

Example:

sm-cli: services stop

Proceed ? (y/N)
y
Stopping Cisco Crosswork Assurance Sensor Management services ...
[+] stop 6/6
 ✔ Container so-medn2-25.07.1-LTS-GA Stopped 1.4s
 ✔ Container so-nbin1-25.07.1-LTS-GA Stopped 0.8s
 ✔ Container so-medn1-25.07.1-LTS-GA Stopped 1.1s
 ✔ Container so-medn3-25.07.1-LTS-GA Stopped 1.7s
 ✔ Container so-core-25.07.1-LTS-GA Stopped 0.7s
 ✔ Container so-mysql-25.07.1-LTS-GA Stopped 1.0s
Cisco Crosswork Assurance Sensor Management services are stopped

Input Parameters
None

Output Attributes
None

Utility Commands

Version

Syntax:

version

Command Description
This command displays the current version of the Cisco Crosswork Assurance Sensor Management Docker.

Example:

sm-cli: version

Cisco Crosswork Assurance Sensor Management version: 25.07.1-LTS-GA (build: xxxx)

Input Parameters
None

Output Attributes
None

Exit

Syntax:

exit

Command Description
This command exits the Climanager Service session.

Example:

sm-cli: exit

Input Parameters
None

Output Attributes
None

Transport Layer Security Commands

TLS Configuration

Syntax:

tls <enable|disable> <parameter> <value>

Command Description
This command enables or disables ciphers, named_groups and Transport Layer Security (TLS) 1.0 or 1.1 configuration for reverse proxy.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Example with cipher:

sm-cli: tls disable cipher TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

Command executed successfully.
Please restart Cisco Crosswork Assurance Sensor Management services to apply this configuration.

Example with named_group:

sm-cli: tls disable named_group X25519

Command executed successfully.
Please restart Cisco Crosswork Assurance Sensor Management services to apply this configuration.

Example with version:

sm-cli: tls enable version TLSv1

Command executed successfully.
Please restart Cisco Crosswork Assurance Sensor Management to apply this configuration.

Note: After running this command, you must restart Sensor Management services to apply the new configuration.

Input Parameters

Parameter	Value	Description
cipher	string	Name of ciphers to disable or enable
named_group	string	Name of named_group to disable or enable
version	TLSv1 or TLSv1.1	TLS version to be enabled or disabled. Note: TLSv1 value: TLS v1.0 and later. TLSv1.1 value: TLS v1.1 and later.

Output Attributes
None

TLS Show

Syntax:

tls show <parameter>

Command Description
This command displays list of enabled TLS ciphers, TLS named group and TLS version.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: tls show version

The supported TLS versions for reverse proxy: TLSv1.0 and later

Input Parameters

Parameter	Description
cipher	Show list of enabled ciphers
named_group	Show list of enabled named groups
version	Show enabled TLS versions

Output Attributes
None

Usage-Data

Syntax:

usage-data <user> <password> [unit <day|month|year|hour>]

Command Description
This command retrieves usage data count from the NBAPI.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: usage-data admin password unit hour

{
   "features" : [
      {
         "count" : 6,
         "name" : "session",
         "type" : "TWAMP"
      },
      {
         "count" : 0,
         "name" : "session",
         "type" : "ECHO-UDP"
      },
      {
         "count" : 0,
         "name" : "session",
         "type" : "ECHO-ICMP"
      },
      {
         "count" : 0,
         "name" : "session",
         "type" : "ETH-DM"
      },
      {
         "count" : 0,
         "name" : "session",
         "type" : "ETH-VS"
      },
      {
         "count" : 0,
         "name" : "session",
         "type" : "ETH-LB"
      },
      {
         "count" : 0,
         "name" : "session",
         "type" : "2xOneWay"
      },
      {
         "count" : 0,
         "name" : "sat",
         "type" : "Y1564/RFC2544"
      }
   ],
   "time" : "2026-06-25 03:00 +00:00",
   "unit" : "hour"
}

Input Parameters

Parameter	Mandatory	Value	Description
unit	N	day, month, year, hour	Specifies the time unit for retrieving usage data count. Default value is hour unit.
user	Y	String	The username is used for authentication when accessing the NBAPI.
password	Y	String	The corresponding password for the provided username.

Output Attributes
None

Shell Commands

shell host

Syntax:

shell host

Command Description
This command will grant access to the Docker host by "skylight" user.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: shell host

Input Parameters
None

Output Attributes
None

shell container

Syntax:

shell container <parameter/container-name>

Command Description
This command will grant access to containers in the Cisco Crosswork Assurance Sensor Management Docker.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: shell container so-core

Input Parameters

Parameter	Description
so-core	Access the core container
so-mysql	Access the mysql container
so-medn1	Access the mediation 1 container
so-medn2	Access the mediation 2 container
so-medn3	Access the mediation 3 container
so-nbin1	Access the NBI container
so-syslog	Access the syslog container

Output Attributes
None

Syslog Commands

syslog edit

Syntax:

syslog edit <parameter> <value>

Command Description
This command configures syslog settings.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: syslog edit transfer-status enable

Input Parameters

Parameter	Value	Description
disk-space	String (e.g., 5g)	Configure disk space for syslog storage
transfer-status	enable or disable	Enable or disable process transfer log to server. Default value is disable
transfer-protocol	TCP or TLS	Configuring the transfer protocol. Default value is TLS

Output Attributes
None

Configure send logs to Server

Syntax:

syslog edit <server1|server2> <parameter> <value>

Command Description
Configure primary (server1) and secondary (server2) server attributes.

Example:

sm-cli: syslog edit server1 host visionems

Input Parameters

Parameter	Value	Description
host	string	Configure the domain name or IP address of the remote server
none		Clear the configuration of the remote server
permitted-peer	string	Configure the Common Name (CN) of the remote server's certificate
port	A numeric value between 1 and 65535	Configure the network port of the remote server

Output Attributes
None

syslog import

Syntax:

syslog import <parameter> <value>

Command Description
This command is used to import certificate files to be able to use TLS transfer.

Example:

sm-cli: syslog import ca-file /home/skylight/so/ca-file.pem

Input Parameters

Parameter	Value	Description
ca-file	string	Import CA file
cert-file	string	Import cert file
key-file	string	Import key file

Output Attributes
None

syslog show configuration

Syntax:

syslog show configuration

Command Description
This command shows the syslog configuration.

Example:

sm-cli: syslog show configuration

[ Syslog configuration ]

Syslog transfer status : Disabled

Remote server configurations :
Primary server :
  Host : 10.220.0.40
  Port : 514
  Permitted peer : external.example.com
  Disk space : 5g
Secondary server :
  Host : 10.220.0.41
  Port : 10514
  Permitted peer : internal.example.com

Input Parameters
None

Output Attributes
None

syslog show status

Syntax:

syslog show status

Command Description
This command shows the syslog service status.

Example:

sm-cli: syslog show status

Syslog service status: running

Input Parameters
None

Output Attributes
None

FIPS Mode Configuration

fips edit

Syntax:

fips edit <enable|disable>

Command Description
This command enables or disables FIPS mode.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be stopped.

Example:

sm-cli: fips edit enable

FIPS mode has been enabled.
Please restart Cisco Crosswork Assurance Sensor Management services to apply this configuration.

Input Parameters

Parameter	Description
enable	Enable FIPS mode
disable	Disable FIPS mode

Output Attributes
None

fips show

Syntax:

fips show

Command Description
This command shows the current FIPS mode status.

Example:

sm-cli: fips show

FIPS mode: enabled

Input Parameters
None

Output Attributes
None

Deployment Commands

Deployment Show Status

Syntax:

deployment show status

Command Description
This command shows deployment status.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: deployment show status

[ Deployment configuration status ]

[ Node: bizn1 ]
Name            Host   Port  Pid   Cluster     State
bizn1instance   bizn1  6048  3944  bizcluster  running

[ Node: medn1 ]
Name            Host   Port  Pid   Cluster     State
medn1instance   medn1  7048  240   medcluster  running

[ Node: nbin1 ]
Name            Host   Port  Pid   Cluster     State
nbin1instance   nbin1  9048  179   nbicluster  running

Input Parameters
None

Output Attributes
None

Deployment Show Configuration

Syntax:

deployment show configuration

Command Description
This command shows the deployment configuration.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: deployment show configuration

[ Deployment configuration ]

  Deployment type : single-node
  Profile name : 5K

  User profile name : user-20
    Max user session : 20

  Session profile name : 52K

  Cluster configuration :
    Cluster type : medcluster
    Node Configuration :
       Node name : medn1
       Total instances : 1

Input Parameters
None

Output Attributes
None

Deployment Edit Command

Syntax:

deployment edit profile <profile> user-profile <number of user> session-profile <number of session>

Command Description
This command edits the deployment configuration.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: deployment edit profile 30K user-profile user-20 session-profile 52K

Proceed ? (y/N)
y
Configuring deployment profile...

Stopping current Cisco Crosswork Assurance Sensor Management services ...
Container so-medn3-25.07.1-LTS-GA Stopping
Container so-medn2-25.07.1-LTS-GA Stopping
Container so-medn1-25.07.1-LTS-GA Stopping
Container so-nbin1-25.07.1-LTS-GA Stopping
Container so-medn2-25.07.1-LTS-GA Stopped
Container so-medn1-25.07.1-LTS-GA Stopped
Container so-nbin1-25.07.1-LTS-GA Stopped
Container so-medn3-25.07.1-LTS-GA Stopped
Container so-core-25.07.1-LTS-GA Stopping
Container so-core-25.07.1-LTS-GA Stopped
Container so-mysql-25.07.1-LTS-GA Stopping
Container so-mysql-25.07.1-LTS-GA Stopped
Deployment configuration is done. Start Cisco Crosswork Assurance Sensor Management services to take effect.

Input Parameters

Parameter	Value	Description
Profile	5K, 15K, 30K, 60K	The type of profile
user-profile	user-20, user-250	The number of users
session-profile	52K, 125K	The number of sessions

Output Attributes
None

System Alarm Commands

Syntax:

alarm show status more

Command Description
This command displays the current alarms on the Climanager (smcli).

Note: Only supports alarms related to Hot Standby feature. See Alarms Related to Redundancy for details.

Example:

sm-cli: alarm show status more

Codes: S - Severity, SA - Service affecting

Number    S     SA  Last Change               Condition Type        Description
--------- ----- --- ------------------------- ------------------- -----------------------------------------
10.5.8    MJ    NSA 2022-10-03 04:30:30-04:00 SITE-B-OFFLINE      Site-B is offline "REDUNDANCY

Output Attributes

Attributes	Description
Numbers	The alarming number from the Master Alarm List
S	The severity of the event that triggered the alarm
SA	Service affecting indicator
Last Change	Timestamp of the last change
Condition Type	The type of alarm condition
Description	Description of the alarm

Performance Session Commands

mgr-command

Syntax:

mgr-command <command>

Command Description
This command executes manager commands for performance sessions.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Input Parameters
None

Output Attributes
None

mgr-config

Syntax:

mgr-config <parameter>

Command Description
This command configures manager settings for performance sessions.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Input Parameters
None

Output Attributes
None

sdmm-deploytool

Syntax:

sdmm-deploytool <parameter>

Command Description
This command is used for SDMM deployment operations.

Input Parameters

Parameter	Value	Description
reflectors	String enclosed in quotes	The name of the CSV file containing the list of reflectors. Must be in the required format: NAME, ADDRESS,[ADDRESS],[ADDRESS]
sessions	String enclosed in quotes	The name of the CSV file containing a definition of the sessions to be created. Format for TWAMP sessions: TYPE, NAME, SLANAME, AF, TX, TXIF, SRCPORT, DSTPORT, PPS, INTERVAL, TOS, TTL, VPRIO, PLSIZE. Format for Ethernet-OAM (Y.1731) sessions: TYPE,NAME,SLANAME,TX,TXIF, MEGLEVEL,PPS,INTERVAL,VPRIO,PLSIZE

Output Attributes
None

Backup and Restore Database

Backup Database

Syntax:

database backup

Command Description
This command allows you to backup the MySQL database. The backup is generated as a tar.gz file in the folder 'backups' of the 'so-mysql' volume.

Note:
On the Hot Standby system:

The backup must be taken from the active site.

The backup file is stored at /home/skylight/so/mysql-ha/backups folder.

On the Non-Hot Standby system, the backup is generated as a tar.gz file in the ${volume-location so-mysql}/backups folder.
By default: /home/skylight/so/mysql/backups

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: database backup

Please wait ... This could take several minutes.
Xtrabackup operating ...
Preparing files ...
Synchronised.
Verifying if there is enough space...
Compressing the backup folder ...
Archived in DB_BAK_2026-06-25_04-09-34.tar.gz

*** DATABASE BACKUP LOCAL END TIME 2026-06-25_04:10:21 ***

Input Parameters
None

Output Attributes
None

Restore Database

Syntax:

database restore <filename_of_the_backup_archive> key <key_file>

Command Description
This command allows you to restore MySQL database.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be stopped.

Make sure the skylight user has read access to the archive that was copied in the /tmp folder.

Example:

sm-cli: database restore DB_BAK_2022-09-29_04-00-00.tar.gz

***** RESTORE Orchestrator DATABASE FROM BACKUP *****

WARNING - This process will wipe the current visiondata database

You are about to REPLACE the Orchestrator database (visiondata) with backup /tmp/DB_BAK_2022-09-29_04-00-00.tar.gz.

Continue y/N?
y

Please wait ... This could take several minutes.
Deleting previous ibdata ...
Copying files ...
Restore complete

Input Parameters

Parameter	Mandatory	Value	Description
restore	Y	string	Filename of the backup archive
key	N	string	This is the name or path of the key file required to decrypt or access the backup archive. Note: Ensure the private key file is located in the data folder.

Output Attributes
None

Changing Administrator Password

Syntax:

admin change-admin-pass

Command Description
This command allows you to change the administrator password.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

To change administrator password

Type:

admin change-admin-pass

At the prompt Enter admin username [default: admin]>, type enter for the default.
At the prompt Enter new admin password>, type the new password.
At the prompt Confirm new admin password>, retype the new password.

Input Parameters
None

Output Attributes
None

Generating and Importing SSH Key for Rsync Destination using the Rsync Command

Syntax:

rsync generate-key
rsync import-key <key_file>

Command Description
These commands generate and import SSH keys for rsync operations.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: rsync generate-key

Generating SSH key pair...
SSH key pair generated successfully.
Public key: /home/skylight/.ssh/id_rsa.pub

Input Parameters

Parameter	Description
generate-key	Generate a new SSH key pair
import-key	Import an existing SSH key file

Output Attributes
None

Configuring Rsync for Rsync Destination Using the SSH Key

Syntax:

rsync configure <destination>

Command Description
This command configures rsync destination using SSH key authentication.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Input Parameters

Parameter	Description
destination	The rsync destination path

Output Attributes
None

OAuth Commands for ZITADEL Authentication

Show OAuth Configuration

Syntax:

oauth show

Command Description
This command displays the current OAuth configuration.

Requirement:
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: oauth show

[ OAuth configuration ]

  OAuth enabled            : true
  Registration id          : zitadel
  Client id                : 378666355416694787
  Issuer location          : https://zitadel.local:1443
  Authorization uri        : https://zitadel.local:1443/oauth/v2/authorize
  Token uri                : https://zitadel.local:1443/oauth/v2/token
  User info uri            : https://zitadel.local:1443/oidc/v1/userinfo
  JWK set uri              : https://zitadel.local:1443/oauth/v2/keys
  Remote auth mgmt enabled : true
  Remote auth mgmt location: https://localhost:4431
  OAuth roles claim        : urn:zitadel:iam:org:project:378666157630029827:roles

Input Parameters
None

Output Attributes
None

Note: oauthRolesClaim is not set directly. It is automatically constructed from registration-id and project-id. For example, project-id 378666157630029827 with registration-id zitadel produces:
urn:zitadel:iam:org:project:378666157630029827:roles

OAuth Edit Commands

Syntax:

oauth edit enabled true client-id <client-id> issuer-location <issuer-location> authorization-uri <authorization-uri> token-uri <token-uri> user-info-uri <user-info-uri> jwk-set-uri <jwk-set-uri> project-id <project-id>

Command Description
Updates one or more OAuth configuration fields.

Note: Changes are not applied until the service is restarted.

Example:

sm-cli: oauth edit enabled true client-id 378666355416694787 registration-id zitadel issuer-location https://zitadel.local:1443 authorization-uri https://zitadel.local:1443/oauth/v2/authorize token-uri https://zitadel.local:1443/oauth/v2/token user-info-uri https://zitadel.local:1443/oidc/v1/userinfo jwk-set-uri https://zitadel.local:1443/oauth/v2/keys auth-mgmt-enabled true auth-mgmt-location https://localhost:4431 project-id 378666157630029827

OAuth configuration updated successfully.
Please restart application services to take effect.

Input Parameters

Parameter	Value	Description
enable	true or false	Turns OAuth authentication on or off
client-id	String	The Client ID of the application registered in ZITADEL. This identifier is used by the application when communicating with the ZITADEL authorization server
authorization-uri	URI	The authorization endpoint where users are redirected to authenticate
issuer-location	URL	The issuer URL of the ZITADEL OIDC provider. This value is used to validate tokens and verify the identity provider
token-uri	URI	The token endpoint used to exchange an authorization code for access tokens, ID tokens, and refresh tokens
user-info-uri	URI	The UserInfo endpoint used to retrieve authenticated user information such as username, email address, and profile attributes
jwk-set-uri	URI	The JSON Web Key Set (JWKS) endpoint containing the public keys used to validate JWT signatures issued by ZITADEL
project-id	String	This value is required so that the system can reference the correct ZITADEL project during authentication setup and related management operations

Output Attributes
None

Generate a File Logs Folder

Syntax:

tech-support generate

Command Description
This command generates a compressed file for the application logs folder.

Example:

sm-cli: tech-support generate

Compressing /home/skylight/so/logs and /home/skylight/so/bin/logs to /home/skylight/so/data/tech_support/sm_logs_20260625_071256.tar.gz ...

Logs compressed to /home/skylight/so/data/tech_support/sm_logs_20260625_071256.tar.gz

Input Parameters
None

Output Attributes
Logs compressed to /home/skylight/so/data/tech_support/

Import a Trusted Certificate

Syntax:

certificate import trusted-cert-file <full_file_path>

Command Description
This command imports the trusted certificate file into the application.

Requirements:

Make sure the skylight user has read access to the folder containing the copied certificate so it can be imported.
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: certificate import trusted-file server.crt

Proceed ? (y/N)
y
Defaulted container "bizn1" out of: bizn1, init (init)
Certificate was added to keystore
[Storing /volume/config/domain/cacerts.jks]
Certificate was added to keystore
[Storing /volume/config/domain/cacerts.bcfks]
Import Done.
Please restart application services to take effect.

Input Parameters

Parameter	Value	Description
trusted-file	File path	The path of the Certificate file name

Output Attributes
None

Import Application Server Certificate

Syntax:

certificate import server-cert-file <cert_file_name> [storepass <storepass>]

Command Description
This command imports an application server certificate into the keystore.

Requirements:

Ensure the application server certificate is in p12 format or follow the Obtain a Signed Certificate for Legacy Orchestrator procedure to create a standard JKS file.
Make sure the skylight user has read access to the folder containing the copied certificate so it can be imported.
Cisco Crosswork Assurance Sensor Management services must be started.

Example:

sm-cli: certificate import server-cert-file /home/skylight/so/server.p12 storepass changeit

Input Parameters

Parameter	Value	Description
server-cert-file	File path	The path of the Certificate file name
storepass	changeit	Password for the keystore certificate. If not provided, the default password is used.

Output Attributes
None

Export Trusted Certificate File

Syntax:

certificate export trusted-cert-file alias <alias> [format <pem|der>]

Command Description
Exports a trusted certificate from the trust store using its alias, in the specified format.

Example:

sm-cli: certificate export trusted-cert-file alias skylight format pem

Certificate exported to pem format: /home/skylight/so/config/domain/skylight.pem

Note: The certificate is generated in the /home/skylight/so/config/domain directory in either PEM or DER format, with the filename format .pem or .der

Input Parameters

Parameter	Value	Description
alias	alias	The alias of the certificate to export
format	pem/der	Defaults to PEM if not specified.

Output Attributes
None

Export Application Server Certificate File

Syntax:

certificate export server-cert-file [format <pem|der>]

Command Description
Exports the application server certificate in the desired format.

Example:

sm-cli: certificate export server-cert-file format der

Certificate exported to der format: /home/skylight/so/config/domain/skylight.der

Note: The certificate is generated in the /home/skylight/so/config/domain directory in either PEM or DER format, with the filename format skylight.pem or skylight.der

Input Parameters

Parameter	Value	Description
format	pem/der	Defaults to PEM if not specified.

Output Attributes
None

Renew Local Certificate

Syntax:

certificate renew-local

Command Description
Renews the local self-signed certificate for the application, extending its validity and updating the keystore.

Example:

sm-cli: certificate renew-local

Notes:

The certificate renew-local command only supports renewal of self-signed certificates.

If the certificate is signed by a Certificate Authority (CA), renewal is not supported via CLI. You must renew through your CA.

If the certificate is self-signed, the renewal proceeds. If the certificate is CA-signed, an error message is shown and the process stops.

Input Parameters
None

Output Attributes
None

Generate Local Self-Signed Certificate

Syntax:

certificate generate-local country-name <country> state <state> locality <locality> organization <org> organizational-unit <org-unit> common-name <common-name> subject-alternative-names <san>

Command Description
Creates a new self-signed certificate for the application, suitable for development, testing, or internal use. This certificate is stored in the keystore and can be used for secure communications.

Example:

sm-cli: certificate generate-local country-name US state California locality "San Jose" organization "Cisco" organizational-unit "IT" common-name "myapp.cisco.com" subject-alternative-names "myapp.cisco.com,comtest.example.com"

Input Parameters

Parameter	Value	Description
country-name	country	Two-letter country code (e.g., US, FR).
state	state	State or province name
locality	locality	City or locality name
organization	org	Organization name
organizational-unit	org-unit	Organizational unit
common-name	common-name	Fully qualified domain name (FQDN) or application name
subject-alternative-names	san	Comma-separated list of SANs. e.g., myapp.cisco.com, test.example.com

Output Attributes
None

Show Trusted Certificate File

Syntax:

certificate show trusted-cert-file alias <alias>

Command Description
Displays detailed information about a trusted certificate, including subject, issuer, validity period, and SANs.

Example:

sm-cli: certificate show trusted-cert-file alias zitadel

Input Parameters

Parameter	Value	Description
alias	alias	The alias of the certificate to inspect.

Output Attributes
None

Show Application Server Certificate File

Syntax:

certificate show server-cert-file

Command Description
Shows information about the current application server certificate, including subject, issuer, validity, and SANs.

Input Parameters
None

Output Attributes
None

© 2026 Cisco and/or its affiliates. All rights reserved.

For more information about trademarks, please visit: Cisco trademarks
For more information about legal terms, please visit: Cisco legal terms