Smarter by Design.Simpler for Business
System Commands
System Commands is the command branch that begins with sys-cmd in WEB-CLI. It runs a predefined set of tools on the device: network diagnostic tools such as ping, dig, tcpdump and curl; memory, data disk and management access service maintenance; support bundle generation and the management of the temporary files that these commands produce. It is not a free shell: only the commands that appear in the Tab list run.
superAdmin
Only the fully authorized user
The branch counts as shell access; the commands run only for superAdmin users.
vDevice / Route table
The working context
The network tools run from within the selected v-device and route table.
User Logs
Every command is recorded
The command line that is run and the temporary files that are downloaded are written to the user logs.
Pipe
Processing the output
The output is filtered or sorted with
|, or written to a file with to-file. Short syntax:
sys-cmd <command> [parameters] [ | <pipe-command> … ]Command Summary
# type sys-cmd and press Tab: all the commands of the branch
admin@TR7LBWAF01> sys-cmd
curl debug dig extend-data-disk
file fping h1load ip
ipcalc management-access memory netstat
nmap nslookup ping ping6
route-table ss ssldump sslscan
support tcpdump telnet traceroute
wget wrk
admin@TR7LBWAF01>
frr-console appears in this list only while dynamic routing is enabled on the selected route table. The debug command opens the debugging mode that the TR7 support team uses and additionally asks for a debugging password; it is not used in daily operation.
Command Groups
Network Diagnostics
ping · ping6 · traceroute · fping
→
DNS & IP Calculation
dig · nslookup · ipcalc
→
Connection, Port & Scan
ss · netstat · nmap · telnet
→
Packet & TLS Analysis
tcpdump · ssldump · sslscan
→
HTTP & Load Testing
curl · wget · h1load · wrk
→
IP & Interface Status
ip show address · ip show link · ip show route
→
Maintenance & Interactive
memory · extend-data-disk · frr-console · management-access · support
→
Files & Context
file · route-table
→
Two Types of Commands
There are two different syntaxes in the branch. The type of a command is seen when Tab is pressed after the command name.
| Type | Commands | Syntax |
|---|---|---|
| Tools with free parameters | curl · dig · fping · h1load · ipcalc · netstat · nmap · nslookup · ping · ping6 · ss · ssldump · sslscan · tcpdump · telnet · traceroute · wget · wrk | Everything written after the command name is passed to the tool as it is. The CLI does not check the parameters; Tab only shows the place of the next parameter in the <ping-parameter-1> form. The supported parameters depend on the version of the tool on the device. |
| Commands with fixed subcommands | extend-data-disk · file · frr-console · ip · management-access · memory · route-table · support | Only the subcommands and the fields that Tab lists are written. A word that is not in the list gives a Command not found error. |
The API Commands options do not exist in this branch
The --info, --output and --filter options in the API Commands branch do not work in the sys-cmd commands. In a tool with free parameters these words are passed to the tool as parameters; in a command with fixed subcommands it gives a Command not found error. In order to filter, count or write the output to a file, Pipe Commands is used.
The Working Context
The network tools always run from within a v-device and a route table that belongs to that v-device. The indicator with the gear icon in the title bar of the WEB-CLI window writes this context like Host device / DEFAULT_ROUTE (on the command line the device itself is written as Host); when it is clicked, a small window with the vDevice and Route table fields opens. The same selection is also made from the command line:
# show the current context
admin@TR7LBWAF01> sys-cmd route-table show
# the device itself and the default route table; the name is taken from the Tab list
admin@TR7LBWAF01> sys-cmd route-table set v-device Host route-table <default-route-table>
# an isolated route table
admin@TR7LBWAF01> sys-cmd route-table set v-device Host route-table <route-table>
admin@TR7LBWAF01>
| Command | Is it affected by the context? |
|---|---|
The tools with free parameters, ip show address, frr-console, extend-data-disk | Yes. They run from within the selected route table; if the selected v-device is not Host, the command runs on that v-device. |
memory, management-access, support | No. They always run on the device itself. |
file, route-table | No. They manage the temporary file area of the device and the context setting of the session. |
Details: route-table.
Running and Stopping
| Subject | Behavior |
|---|---|
| Output | The output of the tool flows to the screen as it arrives; the error output of the tool is shown in red. When the command is connected to a pipe, only the normal output is passed to the pipe and the error output of the tool does not come to the screen. |
| Stopping | Ctrl+C stops the running tool. If the tool does not close within 10 seconds, it is terminated by force. The tools that run indefinitely (such as ping and tcpdump) are either limited with their own count or duration parameter or stopped with this key. |
| Interactive commands | telnet, frr-console and extend-data-disk open a full terminal session. The Ctrl+C, Ctrl+Z, Ctrl+D, Ctrl+L and Esc keys go to the tool, not to the CLI; the session is exited by the tool's own exit method. |
| A pipe in an interactive command | | cannot be written after these three commands: "Pipe" operator is not allowed after interactive commands. |
| The pipe limit | At most 8 pipes are used on one line; to-file is always in the last position. |
| Connection loss | When the WEB-CLI connection is closed, the command running in that session is terminated. |
Commands That Ask for Confirmation
The following commands show a warning and a confirmation line before they run. For the confirmation, evet is written in the Turkish interface and yes in the English interface. If anything else is written, the Invalid confirmation. Operation cancelled. message appears; Esc closes the confirmation screen.
| Command | Confirmation title |
|---|---|
memory drop-page-cache | You are about to drop the page cache |
memory drop-all-caches | You are about to drop all caches |
memory free-swap | You are about to clear swap space |
management-access restart | You are about to restart the management access service |
file disk change-size | You are about to grow / shrink the temporary disk to … |
support collect --escrow-map | You are about to include the pseudonym resolution table in the bundle |
extend-data-disk | The wizard's own question: Proceed? (y/N): |
admin@TR7LBWAF01> sys-cmd memory drop-page-cache
⚠ You are about to drop the page cache
This will clear the page cache. A temporary performance degradation may occur.
Type "yes" to confirm: yes
Page cache dropped successfully.
admin@TR7LBWAF01>
Irreversible commands that do not ask for confirmation
file delete and file clean run without asking for confirmation; deleted temporary files cannot be brought back.
Writing Rules and Limits
The command line is split into words not by a shell but by the CLI's own parser. For this reason, some notations that are familiar from the shell give a different result.
| Rule | Description | Example |
|---|---|---|
| A value with a space | It is put in quotation marks. | -H "Host: shop.example.com" |
The $ sign | $name written without quotation marks or inside double quotation marks turns into an empty value. A value that contains $ is written with single quotation marks. | -H 'X-Token: $abc' |
The & sign | If it is written without quotation marks, the line gives an Invalid command error; addresses with a query string are written with single quotation marks. | 'http://10.20.0.15/?a=1&b=2' |
The | sign | Even if it is inside quotation marks, it counts as a pipe separator; it cannot be used inside a value. | — |
| Shell operators | >, <, ;, &&, 2>&1 and $( ) are not supported; the line gives an Invalid command error. In order to write the output to a file, | to-file is used. | | to-file output.txt |
The tcpdump restriction | A parameter that begins with -w or -r is rejected: -w not allowed for tcpdump. The capture file is taken with | to-file. | | to-file capture.pcap |
The ss restriction | -F, --filter, -D, --diag (and their spellings with =) are rejected: -F is not allowed for ss. | — |
| The pipe parameters | In the pipe commands, a parameter that contains / or .. or that begins with ~ or . is rejected: File path arguments are not allowed in pipe commands. | — |
| The file name | The name of the file written with to-file contains only letters, digits, -, _ and .; it cannot contain .. or a directory: Invalid filename. | waf-443.pcap |
Sample Scenarios
# take the context to the route table on which the backend is located
admin@TR7LBWAF01> sys-cmd route-table set v-device Host route-table <route-table>
admin@TR7LBWAF01> sys-cmd ping -c 4 10.20.0.15
admin@TR7LBWAF01> sys-cmd curl -I -k https://10.20.0.15/health
admin@TR7LBWAF01>
# is the VIP on the correct interface, is the interface up
admin@TR7LBWAF01> sys-cmd ip show address
# the routes of the route table
admin@TR7LBWAF01> sys-cmd netstat -rn
# is 443 open, is it being filtered
admin@TR7LBWAF01> sys-cmd nmap -Pn -p 443 10.0.7.20
admin@TR7LBWAF01>
admin@TR7LBWAF01> sys-cmd sslscan 10.0.7.20:443
admin@TR7LBWAF01> sys-cmd ssldump -n -i any host 10.0.7.20 and port 443
admin@TR7LBWAF01>
admin@TR7LBWAF01> sys-cmd tcpdump -n -i any -c 500 port 443 | to-file waf-443.pcap
# it is downloaded from the address in the Link column
admin@TR7LBWAF01> sys-cmd file list
admin@TR7LBWAF01> sys-cmd file delete waf-443.pcap
admin@TR7LBWAF01>
admin@TR7LBWAF01> sys-cmd wrk -t2 -c50 -d15s http://10.0.7.20/
admin@TR7LBWAF01>
admin@TR7LBWAF01> sys-cmd support collect --since 24h
admin@TR7LBWAF01> sys-cmd support list
admin@TR7LBWAF01>
Things to Know
- Authorization. Only superAdmin users can run the
sys-cmdcommands; the readOnly and the field roles cannot access this branch. Details: Web CLI. - Recording. Every command that is run is written to the User Logs page as System command executed:
<command line>, and the temporary file downloads as "<file>" name CLI file downloaded. - Tool versions. The parameter tables on the pages of the tools with free parameters summarize the frequently used parameters; the full list and the behavior depend on the version of the tool on the device.
- Temporary files. The files written with a pipe, the captures and the support bundles are kept in the same temporary disk area; when the area becomes full, it is cleaned or enlarged with the
filecommands.
