rConfig V8 CLI Commands Reference

rConfig V8 CLI Commands Reference - Complete Network Automation Guide

rConfig V8 includes a comprehensive set of command-line interface (CLI) commands for managing your network configuration platform. In V8, a number of commands have been added, some have been changed, and others removed to streamline operations and align with modern workflows.

Why Use CLI Commands?

CLI commands are essential for several key use cases:

Automation & Orchestration: Integrate rConfig operations into Infrastructure as Code platforms like Ansible, Terraform, or Chef
Custom Scripting: Build your own automation workflows and scheduled tasks that interact with rConfig
System Administration: Perform maintenance tasks, clear caches, and troubleshoot issues directly from the command line
CI/CD Pipelines: Incorporate network configuration management into your DevOps workflows
Remote Management: Execute operations on rConfig without requiring access to the web interface
Performance: Bypass UI overhead for bulk operations and scheduled tasks

Getting Started with CLI Commands

All rConfig CLI commands must be run from the rConfig installation directory. Most commands run as the web server user (apache on RHEL family systems, www-data on Ubuntu). Commands that change system files or services, such as rconfig:snmp-trap-service install, rconfig:xftp-toggle and the helper installers, must run as root and say so if you forget sudo.

Prerequisites

SSH access to your rConfig server
sudo rights, for the commands that change system files or services
Navigate to the rConfig installation directory:

cd /var/www/html/rconfig8/current

Discovering Available Commands

To view all available rConfig-specific commands:

php artisan rconfig:list

This command brings up a search box where you can type the partial name of the command you are looking for. Or hit enter to see the full list of commands.

Tip: Use the documentation search feature to quickly find detailed information about any command by searching for its name (e.g., “rconfig:download-device”).

  rconfig:api-docs:build                        Generate AI-agent-friendly Markdown docs for the REST API under storage/app/api-docs. Uses Scribe as the upstream extractor.
  rconfig:append-compliance-report-data         Append report result summary data to a saved compliance report
  rconfig:archive-logs                          Deprecated in 8.1 - Replaced with the Data Purge Tool in System Settings
  rconfig:backup-env                            Backup the .env file to the storage backups directory
  rconfig:check-worker-user                     Check that Horizon, the scheduler and the SNMP trap receiver run nothing as root
  rconfig:cleanup-temp-snippets                 Clean up expired temporary snippets
  rconfig:clear-all                             Clear all cache and config elements for Laravel, NPM and other dependencies
  rconfig:clear-horizon                         Clear Horizon Queue History
  rconfig:config-encryption-manager             Manage configuration encryption, including encrypting, decrypting, and rotating keys
  rconfig:config-history:audit                  Audit config history invariants (latest flags, config change versions)
  rconfig:config-history:repair                 Audit & repair config history invariants (versions, latest flags, consistency)
  rconfig:config-summaries-sync                 Sync Config Summaries
  rconfig:connectivity-check                    Check rConfig portal connectivity
  rconfig:data-purge                            Purge old data based on settings_purge configuration with hybrid queue support
  rconfig:digest-cleanup                        Cleanup old digest data via job queue
  rconfig:digest-send                           Send digest emails to users via job queue
  rconfig:download-api                          Download api configurations for one or multiple api connections via the CLI
  rconfig:download-api-category                 Download api configurations for every API Collection in one or multiple categories
  rconfig:download-api-tag                      Download api configurations for every API Collection with one or multiple tags
  rconfig:download-category                     Download configurations for one or multiple categories of devices
  rconfig:download-device                       Download configurations for one or multiple devices via the CLI
  rconfig:download-tag                          Download configurations for devices with one or multiple tags
  rconfig:download-task                         Download configurations for devices with one or multiple tasks
  rconfig:ensure-device-admin-role              Ensure every device has at least one role assignment that includes the System Admin role (ID:1)
  rconfig:integration-nautobot                  In Development: Command to sync Nautobot devices to rConfig via API integration.
  rconfig:integration-nautobot-single-device    Process a single Nautobot device through ETL workflow, requires a Nautobot Device ID.
  rconfig:integration-netbox                    In Development: Command to sync Netbox devices to rConfig via API integration.
  rconfig:integration-netbox-single-device      Process a single Netbox device through ETL workflow, requires a Netbox Device ID.
  rconfig:integration-v2-run                    Queue a V2 integration run for a specific integration instance.
  rconfig:integration-v2-sync-definitions       Sync integration_definitions for V2 drivers from the registered source drivers and schema metadata
  rconfig:integration-zabbix                    In Development: Command to sync Zabbix devices to rConfig via API integration.
  rconfig:integration-zabbix-single-device      Process a single Zabbix device through ETL workflow, requires a Zabbix Host ID.
  rconfig:list                                  List all rconfig:* commands with their descriptions
  rconfig:netmri-connection                     Manage NetMRI API connection configuration
  rconfig:netmri-device-mappings                Manage device type mappings for NetMRI import
  rconfig:netmri-import-devices                 Import devices from NetMRI JSON file to rConfig database
  rconfig:netmri-load-devices                   Load devices from NetMRI API to create rConfig import JSON
  rconfig:notify-on-config-change               Notify about configuration changes that occurred today
  rconfig:oxidized-device-mappings              Manage device type mappings for Oxidized import
  rconfig:oxidized-import-devices               Import devices from JSON file to rConfig database
  rconfig:oxidized-load-devices                 Import devices from Oxidized to rConfig
  rconfig:policy-definition-validation          A command to validate a given policy definition against a specific config
  rconfig:purge-configs                         Deprecated in 8.1 - Replaced with the Config Retention & History Repair Tool
  rconfig:purge-configs-v2                      Deprecated in 8.1 - Replaced with the Config Retention & History Repair Tool
  rconfig:purge-failedconfigs                   Purge failed configs for some or all devices
  rconfig:rancid-device-mappings                Manage device type mappings for RANCID import
  rconfig:rancid-import-devices                 Import devices from RANCID JSON file to rConfig database
  rconfig:rancid-load-devices                   Load devices from RANCID to create rConfig import JSON
  rconfig:report-lastDownload                   Output report of all devices latest downloaded configs
  rconfig:run-policy-compliance                 Send a policy assignment job to the queue
  rconfig:seed-initial                          Seed initial data after migrations
  rconfig:seed-purge-defaults                   Seed default purge settings for all tables
  rconfig:send-snippet                          Send a snippet to one or multiple devices via the CLI
  rconfig:set-config-permissions                Set secure permissions on device configs already on disk
  rconfig:slacktest                             Test Slack integration
  rconfig:snippet-task                          Send snippets to devices with one or multiple tasks
  rconfig:snmp-poll-device                      Poll SNMP data for a specific device or all devices with optional walk functionality
  rconfig:snmp-registry                         Manage SNMP trap registry from GitHub
  rconfig:snmp-trap-handler                     Handle incoming SNMP traps and process them
  rconfig:snmp-trap-service                     [rconfig:snmp-trap-supervisor] Install and manage the SNMP trap receiver as a systemd service running as the web user
  rconfig:solarwinds-connection                 Manage SolarWinds SWIS API connection configuration
  rconfig:solarwinds-device-mappings            Manage device type mappings for SolarWinds import
  rconfig:solarwinds-import-devices             Import devices from SolarWinds JSON file to rConfig database
  rconfig:solarwinds-load-devices               Load devices from SolarWinds SWIS API to create rConfig import JSON
  rconfig:ssl-self-signed                       Serve rConfig over HTTPS with a self-signed certificate
  rconfig:sweep-xftp-dir                        Sweeps the xFTP directory for files, attempts to match filename to device ID and uploads them to the correct device directory
  rconfig:sync-tasks                            Sync the schedule of the app with the schedule monitor
  rconfig:test-notifications-recipients         Test the getNotificationRecipients method with different notification types and channels
  rconfig:transform-eoc-definitions             Transform legacy EOC definitions JSON to CIC policy format and update the database
  rconfig:transform-policy-definitions          Transform policy definitions JSON and update the database
  rconfig:update-device-roles                   Update all devices to ensure they at least have admin have roles attached to them.
  rconfig:update-rbac-data                      Command to update or refresh permissions table with new permissions
  rconfig:update-snippet-roles                  Update all snippets to ensure they at least have admin have roles attached to them.
  rconfig:update-tag-roles                      Update all tags to ensure they at least have admin have roles attached to them.
  rconfig:vector-hub-install-helper             Install the root-owned Vector Hub helper, its sudoers rule and the web user's vector-hub group membership (run as root)
  rconfig:vector-cm-accept-proposed             Simulate Central Manager accepting the latest proposed device (local dev only)
  rconfig:vector-cm-messages                    Consume messages from rConfig Vector Central Manager RabbitMQ queue
  rconfig:vector:cm-outbox-list                 List sync_outbox rows with optional filters
  rconfig:vector:cm-outbox-republish            Dispatch PublishOutboxRowJob for sync_outbox rows
  rconfig:xftp-backfill-uploads                 Backfill xFTP uploads tracking table from existing filesystem data (root xFTP dir and per-device xftpuploads dirs)
  rconfig:xftp-install-helper                   Install the root-owned xFTP Docker helper, container entrypoints and shared group, and reset Docker socket and legacy TFTP folder permissions (run as root)
  rconfig:xftp-toggle                           Toggle FTP/ TFTP or SFTP(SCP) servers on or off

All above commands must be run from within the rconfig8 directory, and must be run in the following format.

Command Reference

rconfig:api-docs:build

Generates AI-agent-friendly Markdown documentation for the REST API under storage/app/api-docs. Uses Scribe as the upstream extractor.

# Build markdown docs for all API versions (default)
php artisan rconfig:api-docs:build

# Build for a specific API version (v1, v2, or all)
php artisan rconfig:api-docs:build --api-version=v2

# Skip Scribe regeneration and re-render markdown from existing openapi.yaml
php artisan rconfig:api-docs:build --no-generate

rconfig:append-compliance-report-data

Appends report result summary data to a saved compliance report. Runs automatically for compliance jobs post V7.2.6, but can be run manually to update reports or fix missing data.

# Append data to specific report
php artisan rconfig:append-compliance-report-data 123

# Append data to all reports
php artisan rconfig:append-compliance-report-data

rconfig:archive-logs

Deprecated in rConfig V8.1 and replaced with the Data Purge Tool in System Settings. The command remains as a stub for backward compatibility but should not be used. Use the Data Purge Tool to archive or delete old logs based on your retention policies.

rconfig:backup-env

Backs up the .env file to the storage backups directory. Useful prior to upgrades or before making environment changes.

php artisan rconfig:backup-env

rconfig:check-worker-user

Checks that rConfig runs nothing as root: Horizon, the Horizon Supervisor config, the scheduler line in the web user’s crontab, root’s crontab, and the SNMP trap receiver. The deploy script runs it as its last step, and the dashboard Worker Privilege check reads the same report. (V8.4.1)

# Full check, including root's crontab
sudo php artisan rconfig:check-worker-user

# Machine-readable report for scripts and monitoring
sudo php artisan rconfig:check-worker-user --json

Options:

--json: Print the report as JSON

Exit codes:

Code	Meaning
`0`	No check failed. WARN and SKIP lines still exit `0`, and so does a Docker install, where the checks are skipped
`1`	At least one check failed: part of rConfig runs as root or is set up unsafely

Without sudo, root’s crontab is not read and that line shows SKIP. See Worker Privilege for every message and its fix.

rconfig:cleanup-temp-snippets

Removes expired temporary snippets from the system. This command is run automatically daily via the scheduler.

php artisan rconfig:cleanup-temp-snippets

rconfig:clear-all ⭐

Clears all cache and config elements for Laravel, NPM, and other dependencies. Use this to resolve many application issues. This is an important command to run after updates or configuration changes.

php artisan rconfig:clear-all

From V8.4.1 it checks a sample of saved device configs at the end. If any are readable by other local users, it prints a warning telling you to run rconfig:set-config-permissions.

rconfig:clear-horizon

Clears Horizon queue history and failed jobs.

php artisan rconfig:clear-horizon

rconfig:config-encryption-manager

Manages configuration file encryption, including encrypting, decrypting, and rotating encryption keys.

php artisan rconfig:config-encryption-manager

rconfig:config-history:audit

Audits configuration history invariants such as latest flags and config change versions to identify inconsistencies. See Config Retention & Repair for more details.

php artisan rconfig:config-history:audit

rconfig:config-history:repair

Audits and repairs configuration history invariants including versions, latest flags, and consistency. See Config Retention & Repair for more details.

php artisan rconfig:config-history:repair

rconfig:config-summaries-sync

Syncs configuration count summaries to the database for faster UI load times. Runs automatically daily at 3AM.

php artisan rconfig:config-summaries-sync

rconfig:connectivity-check

Tests rConfig portal connectivity.

php artisan rconfig:connectivity-check

rconfig:data-purge

Purges old data based on settings_purge configuration with hybrid queue support.

php artisan rconfig:data-purge

rconfig:digest-cleanup

Cleans up old email digest data via job queue. This command is run automatically daily via the scheduler.

php artisan rconfig:digest-cleanup

rconfig:digest-send

Sends digest emails to users via job queue.

php artisan rconfig:digest-send

rconfig:download-api

Downloads API configurations for one or multiple API connections.

# Download from specific API collections
php artisan rconfig:download-api 500000 500001

# Enable debug output
php artisan rconfig:download-api 500000 -d

From V8.4.2, the command exits with an error when any collection fails. The output names the reason, such as Authentication failed: HTTP 401 Unauthorized from /config. Disabled collections are skipped.

rconfig:download-api-category and rconfig:download-api-tag

From V8.4.2, these commands download every enabled API collection in the given Command Groups or with the given tags. They run the same download as rconfig:download-api.

# All API collections in Command Groups 3 and 4
php artisan rconfig:download-api-category 3 4

# All API collections tagged 7, with debug output
php artisan rconfig:download-api-tag 7 -d

rconfig:download-category

Downloads configurations for all devices in specified categories (Command Groups).

# Download from one or more categories
php artisan rconfig:download-category 1 2

rconfig:download-device ⭐

Downloads configurations for specified devices. This command is essential for on-demand config retrieval and debugging.

# Download from specific devices
php artisan rconfig:download-device 1002 1003

# Enable debug output
php artisan rconfig:download-device 1002 -d

# Search by integration host ID
php artisan rconfig:download-device 1002 -i

rconfig:download-tag

Downloads configurations for all devices with specified tags.

php artisan rconfig:download-tag 1001

rconfig:download-task

Downloads configurations for all devices associated with specified tasks.

php artisan rconfig:download-task 555555 666666

rconfig:ensure-device-admin-role

Ensures every device has at least one role assignment that includes the System Admin role (ID:1). Useful for repairing role assignments after bulk imports or upgrades.

php artisan rconfig:ensure-device-admin-role

rconfig:integration-nautobot

Syncs Nautobot devices to rConfig via API integration. See Nautobot Integration documentation for details.

php artisan rconfig:integration-nautobot

rconfig:integration-nautobot-single-device

Processes a single Nautobot device through ETL workflow. Requires Nautobot Device ID.

php artisan rconfig:integration-nautobot-single-device {device-id}

rconfig:integration-netbox

Syncs Netbox devices to rConfig via API integration. See Netbox Integration documentation for details.

php artisan rconfig:integration-netbox

rconfig:integration-netbox-single-device

Processes a single Netbox device through ETL workflow. Requires Netbox Device ID.

php artisan rconfig:integration-netbox-single-device {device-id}

rconfig:integration-v2-run

Queues a V2 integration run for a specific integration instance. Supports preview/apply modes and inline or queued execution.

# Preview run for instance ID 5 (default mode is preview)
php artisan rconfig:integration-v2-run 5

# Apply run for instance ID 5
php artisan rconfig:integration-v2-run 5 --mode=apply

# Run by driver key instead of instance ID
php artisan rconfig:integration-v2-run --driver=zabbix

# Dispatch asynchronously to the queue
php artisan rconfig:integration-v2-run 5 --queue

# Verbose debug output
php artisan rconfig:integration-v2-run 5 -d

rconfig:integration-v2-sync-definitions

Syncs integration_definitions for V2 drivers from the registered source drivers and schema metadata.

# Sync definitions
php artisan rconfig:integration-v2-sync-definitions

# Also deactivate definitions no longer present in the source registry
php artisan rconfig:integration-v2-sync-definitions --cleanup

rconfig:integration-zabbix

Syncs Zabbix devices to rConfig via API integration. See Zabbix Integration documentation for details.

php artisan rconfig:integration-zabbix

rconfig:integration-zabbix-single-device

Processes a single Zabbix device through ETL workflow. Requires Zabbix Host ID.

php artisan rconfig:integration-zabbix-single-device {host-id}

rconfig:list

Lists all rconfig:* commands with their descriptions.

php artisan rconfig:list

rconfig:netmri-connection

Manages the NetMRI API connection configuration used to import devices from Infoblox NetMRI.

# Set up NetMRI connection interactively
php artisan rconfig:netmri-connection --setup

# Test the existing connection
php artisan rconfig:netmri-connection --test

# Show current connection info
php artisan rconfig:netmri-connection --show

# Edit device filters
php artisan rconfig:netmri-connection --edit-filters

# Update the API URL
php artisan rconfig:netmri-connection --set-url=https://netmri.example.com

# Clear stored connection info
php artisan rconfig:netmri-connection --clear

rconfig:netmri-device-mappings

Manages device type mappings used when importing from NetMRI.

# List all current mappings
php artisan rconfig:netmri-device-mappings --list

# Add a new mapping interactively
php artisan rconfig:netmri-device-mappings --add

# Edit a mapping by NetMRI device type
php artisan rconfig:netmri-device-mappings --edit="Cisco IOS"

# Delete a mapping by NetMRI device type
php artisan rconfig:netmri-device-mappings --delete="Cisco IOS"

rconfig:netmri-import-devices

Imports devices from a NetMRI JSON file into the rConfig database.

# Import devices from a JSON file
php artisan rconfig:netmri-import-devices /path/to/netmri-export.json

# Assign imported devices to a specific device group
php artisan rconfig:netmri-import-devices /path/to/netmri-export.json --group=2

# Validate without writing to the database
php artisan rconfig:netmri-import-devices /path/to/netmri-export.json --dry-run

rconfig:netmri-load-devices

Loads devices from the NetMRI API and creates a JSON file for use with rconfig:netmri-import-devices.

# Load devices using default batch size
php artisan rconfig:netmri-load-devices

# Override the batch size
php artisan rconfig:netmri-load-devices --batch-size=200

# Cap the number of devices fetched (useful for testing)
php artisan rconfig:netmri-load-devices --max-devices=50

rconfig:notify-on-config-change

Sends notifications about configuration changes that occurred today. Typically driven by the scheduler.

php artisan rconfig:notify-on-config-change

rconfig:oxidized-device-mappings

Manages device type mappings for Oxidized import.

php artisan rconfig:oxidized-device-mappings

rconfig:oxidized-import-devices

Imports devices from JSON file to rConfig database.

php artisan rconfig:oxidized-import-devices

rconfig:oxidized-load-devices

Imports devices from Oxidized to rConfig.

php artisan rconfig:oxidized-load-devices

rconfig:policy-definition-validation

Validates a given policy definition against a specific configuration.

php artisan rconfig:policy-definition-validation

rconfig:purge-configs

Deprecated in rConfig V8.1 and replaced with the Config Retention & History Repair Tool. The command remains as a stub for backward compatibility but should not be used. Use the Config Retention & History Repair Tool in System Settings to manage configuration retention policies and repair configuration history.

rconfig:purge-configs-v2

rconfig:purge-failedconfigs

Purges failed configurations for specified or all devices.

# Purge failed configs for specific devices
php artisan rconfig:purge-failedconfigs 1001 1002

# Purge all failed configs
php artisan rconfig:purge-failedconfigs --all

rconfig:rancid-device-mappings

Manages device type mappings used when importing from RANCID.

# List all current mappings
php artisan rconfig:rancid-device-mappings --list

# Add a new mapping interactively
php artisan rconfig:rancid-device-mappings --add

# Edit a mapping by RANCID device type
php artisan rconfig:rancid-device-mappings --edit=cisco

# Delete a mapping by RANCID device type
php artisan rconfig:rancid-device-mappings --delete=cisco

rconfig:rancid-import-devices

Imports devices from a RANCID JSON file into the rConfig database.

# Import devices from a JSON file
php artisan rconfig:rancid-import-devices /path/to/rancid-export.json

# Assign imported devices to a specific device group
php artisan rconfig:rancid-import-devices /path/to/rancid-export.json --group=2

# Validate without writing to the database
php artisan rconfig:rancid-import-devices /path/to/rancid-export.json --dry-run

rconfig:rancid-load-devices

Loads devices from a RANCID installation and creates a JSON file for use with rconfig:rancid-import-devices.

# Load using auto-detected RANCID base path
php artisan rconfig:rancid-load-devices

# Specify a custom RANCID base path
php artisan rconfig:rancid-load-devices --rancid-base=/usr/local/rancid

# Import only a specific RANCID group
php artisan rconfig:rancid-load-devices --group=networking

rconfig:redis-secure

Generates a strong Redis password, writes it to REDIS_PASSWORD in .env, requires it on the running Redis instance, and saves it to the Redis config file so it survives a Redis restart. It then restarts the queue workers, Horizon, and the SNMP trap handler so they reconnect with the new password. (V8.4.1)

# Preview what would change without altering anything
php artisan rconfig:redis-secure --dry-run

# Secure Redis and restart the queue consumers
php artisan rconfig:redis-secure

# Replace an existing password with a new one
php artisan rconfig:redis-secure --force

Options:

--dry-run: Report what would change without modifying .env or Redis. Also prints the shared-Redis warning if other nodes appear to use this Redis
--force: Generate and apply a new password even when REDIS_PASSWORD is already set. Use it to rotate the password. Redis must accept the current value in .env
--no-restart: Apply the password but do not restart the queue workers, Horizon, or the SNMP trap handler. Restart them yourself afterwards

Exit codes:

Code	Meaning
`0`	Redis is secured, or was already secured with the password in `.env`. Dry runs always exit `0`
`1`	Redis rejected the change (`.env` rolled back), `.env` and Redis disagree without `--force`, or the new password could not be verified

Behaviour:

Safe to re-run. If Redis already accepts the password in .env, the command reports that Redis is already secured and changes nothing.
Fails closed. If Redis rejects the change, the command restores the previous .env value so the queue keeps working.
If REDIS_PASSWORD is set but Redis does not accept it, the command stops and asks for --force rather than overwriting it.
If Redis cannot save the password to its config file, the password stays live and the command warns that it will be lost when Redis restarts.
Restarts consumers through Redis itself: queue:restart, horizon:terminate, and a restart signal the SNMP trap handler watches for. Supervisor relaunches Horizon and systemd relaunches the SNMP trap receiver, so no sudo supervisorctl or systemctl call is needed.
When run as root, the rebuilt config cache is handed back to the web server user.
If REDIS_HOST is not a local address, or clients are connected from other hosts, it prints a THIS REDIS MAY BE SHARED BY OTHER APP NODES banner. Those nodes are locked out until REDIS_PASSWORD is copied to their .env and they are restarted.

Use cases:

Once, after upgrading an existing install whose Redis has no password
Rotating the Redis password
Clearing the Redis Auth health check and the redis_auth row on System Optimization. See Redis Authentication for the full walkthrough, including multi-node setups

rconfig:redis-security-check

Read-only check of the Redis authentication state. Reports whether Redis requires a password and whether the application can authenticate with the password in .env. The listener bind address and protected mode are shown for context only. (V8.4.1)

# Human-readable report
php artisan rconfig:redis-security-check

# Machine-readable output for scripts and monitoring
php artisan rconfig:redis-security-check --json

Options:

--json: Emit the status as JSON

Exit codes:

Code	Meaning
`0`	Redis requires a password
`1`	Redis is reachable but requires no password. Run `rconfig:redis-secure`
`2`	Redis could not be reached, so the state is unknown

Use cases:

Verifying an install after running rconfig:redis-secure, or after a Docker image update
Monitoring and compliance checks, using the exit code
Troubleshooting NOAUTH errors: if “App can authenticate” reports no, .env and Redis disagree

A Redis listening only on 127.0.0.1 is still reachable by local processes, so the check never treats the bind address as secure. Only a required password passes.

rconfig:report-lastDownload

Generates CLI report of all devices’ latest downloaded configurations.

php artisan rconfig:report-lastDownload

rconfig:run-policy-compliance

Sends a policy assignment job to the queue for compliance checking.

# Run compliance for specific policy assignment
php artisan rconfig:run-policy-compliance 1

rconfig:seed-initial

Seeds initial data after migrations. Typically used during installation. Do not run on production systems unless directed by support.

php artisan rconfig:seed-initial

rconfig:seed-purge-defaults

Seeds default purge settings for all tables. Use this to reset purge settings to defaults. This command is run automatically during setup and updates in V8 installations.

php artisan rconfig:seed-purge-defaults

rconfig:send-snippet

Sends a command snippet to specified devices.

# Send snippet ID 5 to devices 21 and 22
php artisan rconfig:send-snippet 5 21 22

rconfig:set-config-permissions

Sets saved device configs to 0440 and the folders that hold them to 0750, so other local users cannot read them. Configs saved by V8.4.1 and later already have these modes. Configs saved by earlier versions are usually 0444 in 0755 folders, readable by every account on the host, and keep those modes until you run this command. (V8.4.1)

cd /var/www/html/rconfig8/current

# Preview what would change without altering anything
sudo php artisan rconfig:set-config-permissions --dry-run

# List every path that would change, with its old and new mode
sudo php artisan rconfig:set-config-permissions --dry-run -v

# Set the permissions
sudo php artisan rconfig:set-config-permissions

Options:

--dry-run: Report how many files and folders would change, without changing them
-v: Print each changed path as 0444 -> 0440 <path>

What it changes:

Folder	Holds
`storage/app/rconfig/data`	Saved device configs, including each device’s `xftpuploads` folder
`storage/app/rconfig/tempdir`	Cleaned copies made during config compares
`storage/app/rconfig/policy_reports`	Compliance report output

A folder that does not exist is skipped. Symlinks are skipped and never followed. The xFTP folder (/srv/xftp) is not touched; use rconfig:xftp-toggle --fix-permissions for that.

Exit codes:

Code	Meaning
`0`	Every path has the right mode, or a dry run finished
`1`	At least one path could not be changed. Run it again with `sudo`, or as the owner of the config data

Behaviour:

Safe to re-run. A path that already has the right mode is left alone, so a second run reports 0 file(s) and 0 folder(s) changed.
It changes modes only, never owners or file contents.
The first run on an older install can change thousands of files. Run --dry-run first to see the count.

Run it once after upgrading to V8.4.1, and again whenever the Config folder row on Settings > System Management > System Optimization warns. See Storage Permissions.

rconfig:slacktest

Tests Slack integration configuration. Sends a test message to the configured Slack channel.

php artisan rconfig:slacktest

rconfig:snippet-task

Sends snippets to all devices associated with specified tasks.

# Send snippets for task 123456
php artisan rconfig:snippet-task 123456

# Enable debug output
php artisan rconfig:snippet-task 123456 -d

rconfig:snmp-poll-device

Polls SNMP data for specific device or all devices with optional walk functionality.

php artisan rconfig:snmp-poll-device

rconfig:snmp-registry

Manages SNMP trap registry from GitHub.

php artisan rconfig:snmp-registry

rconfig:snmp-trap-handler

Handles incoming SNMP traps and processes them. The rconfig-snmptrap systemd service runs it with --daemon; you only run it by hand to test, as the web server user and on a port above 1024. From V8.4.0, --community is deprecated: accepted SNMP versions, the community and SNMPv3 users are set in the UI. See SNMP Trap Receiver Service.

# Test on a high port as the web user (www-data on Ubuntu), without --daemon so output is printed
sudo -u apache php artisan rconfig:snmp-trap-handler --host=0.0.0.0 --port=10162

rconfig:snmp-trap-service

Installs and manages the SNMP trap receiver as the systemd service rconfig-snmptrap, running as the web server user. It binds UDP 162 through CAP_NET_BIND_SERVICE, so it never runs as root. rconfig:snmp-trap-supervisor is kept as an alias. (V8.4.1)

# Install or update the service (as root)
sudo php artisan rconfig:snmp-trap-service install

# Install with non-default settings
sudo php artisan rconfig:snmp-trap-service install --host=0.0.0.0 --port=162 --timeout=5 --memory-limit=512

# Check, restart or remove it
php artisan rconfig:snmp-trap-service status
sudo php artisan rconfig:snmp-trap-service restart
sudo php artisan rconfig:snmp-trap-service uninstall

Actions: install, uninstall, status, restart. Without an action it shows a menu. install, uninstall and restart need root; status runs as any user.

Options:

--host=: Address to listen on (default 0.0.0.0)
--port=: UDP port (default 162, 1 to 65535)
--timeout=: Socket timeout in seconds (default 5, 1 to 300)
--memory-limit=: Memory limit in MB (default 512, 64 to 4096)
--if-installed: Used by the deploy script. Updates the service only if the receiver is already set up for this install
--force: Uninstall without asking
--community=: Deprecated. Only fills an empty community in the UI and is never written to the service

Re-running install keeps the current settings unless you pass new ones. It also moves a receiver set up under Supervisor in an earlier version over to systemd. See SNMP Trap Receiver Service.

Exit codes: status exits 1 when the receiver is not installed or not running. The other actions exit 1 on any failure, and print what to fix.

rconfig:solarwinds-connection

Manages the SolarWinds SWIS API connection configuration used to import nodes from SolarWinds NPM.

# Set up the SWIS connection interactively
php artisan rconfig:solarwinds-connection --setup

# Test the existing connection
php artisan rconfig:solarwinds-connection --test

# Show current connection info
php artisan rconfig:solarwinds-connection --show

# Edit node filters
php artisan rconfig:solarwinds-connection --edit-filters

# Update the SWIS URL
php artisan rconfig:solarwinds-connection --set-url=https://solarwinds.example.com:17778

# Clear stored connection info
php artisan rconfig:solarwinds-connection --clear

rconfig:solarwinds-device-mappings

Manages device type mappings used when importing from SolarWinds.

# List all current mappings
php artisan rconfig:solarwinds-device-mappings --list

# Add a new mapping interactively
php artisan rconfig:solarwinds-device-mappings --add

# Edit a mapping by SolarWinds machine type
php artisan rconfig:solarwinds-device-mappings --edit="Cisco IOS"

# Delete a mapping by SolarWinds machine type
php artisan rconfig:solarwinds-device-mappings --delete="Cisco IOS"

rconfig:solarwinds-import-devices

Imports devices from a SolarWinds JSON file into the rConfig database.

# Import devices from a JSON file
php artisan rconfig:solarwinds-import-devices /path/to/solarwinds-export.json

# Assign imported devices to a specific device group
php artisan rconfig:solarwinds-import-devices /path/to/solarwinds-export.json --group=2

# Validate without writing to the database
php artisan rconfig:solarwinds-import-devices /path/to/solarwinds-export.json --dry-run

rconfig:solarwinds-load-devices

Loads nodes from the SolarWinds SWIS API and creates a JSON file for use with rconfig:solarwinds-import-devices.

# Load nodes using default batch size
php artisan rconfig:solarwinds-load-devices

# Override the batch size
php artisan rconfig:solarwinds-load-devices --batch-size=200

# Cap the number of nodes fetched (useful for testing)
php artisan rconfig:solarwinds-load-devices --max-nodes=50

rconfig:ssl-self-signed

Moves a new install from HTTP to HTTPS in one step. It creates a self-signed certificate, adds an HTTPS virtual host next to your existing Apache one, redirects HTTP to HTTPS, opens port 443 in firewalld or ufw, restarts Apache, and sets APP_URL to the new https:// address. Must run as root. (V8.4.1)

# Preview what would change without altering anything
sudo php artisan rconfig:ssl-self-signed --dry-run

# Set up HTTPS for the name in your Apache ServerName
sudo php artisan rconfig:ssl-self-signed

# Issue the certificate for a specific name or IP address
sudo php artisan rconfig:ssl-self-signed --hostname=rconfig.example.com

# Replace a certificate this command created earlier
sudo php artisan rconfig:ssl-self-signed --force

Options:

--hostname=: Name or IP address for the certificate and the HTTPS virtual host. Defaults to the ServerName of your rConfig virtual host, then the host in APP_URL, then the server hostname
--days=825: How long the certificate is valid, from 1 to 3650 days
--no-redirect: Leave HTTP working as it is instead of redirecting it to HTTPS
--force: Issue a new certificate and rewrite the HTTPS virtual host this command created earlier
--dry-run: List the steps it would take without changing anything

Exit codes:

Code	Meaning
`0`	HTTPS is set up, was already set up, or a dry run finished
`1`	It could not run (not root, Docker, Apache not found, bad `--hostname` or `--days`), or Apache rejected the new config and every change was rolled back

Behaviour:

Writes its own files only: rconfig-ssl.conf in /etc/httpd/conf.d/ (Rocky/RHEL) or /etc/apache2/sites-available/ (Ubuntu), and rconfig-selfsigned.crt / .key in /etc/pki/tls/ or /etc/ssl/. The redirect goes inside your existing port 80 virtual host between # BEGIN rconfig-ssl and # END rconfig-ssl, and a copy of the original is saved next to it with a .rconfig-ssl.bak suffix.
Runs apachectl configtest before restarting Apache. If Apache rejects the config, the command puts every file back as it was.
Safe to re-run. A second run reports that HTTPS is already set up and changes nothing.
Leaves a hand-built HTTPS setup alone. If another port 443 virtual host already serves rConfig, the command stops without changing anything.
Installs mod_ssl with dnf on Rocky/RHEL when it is missing, and runs a2enmod ssl rewrite and a2ensite rconfig-ssl on Ubuntu.
Does not run in Docker. Terminate TLS on your reverse proxy instead.

Use cases:

Right after a fresh install, to stop logins and device credentials crossing the network in clear text
Clearing the HTTPS dashboard alert, the Secure rConfig with HTTPS onboarding step, and the app_url row on System Optimization. See SSL Configuration for the full walkthrough and for replacing the certificate with a trusted one

rconfig:sweep-xftp-dir

Sweeps the xFTP directory for files, matches filenames to device IDs, and uploads them to the correct device directory.

php artisan rconfig:sweep-xftp-dir

rconfig:sync-tasks

Syncs the application schedule with the schedule monitor.

php artisan rconfig:sync-tasks

rconfig:test-notifications-recipients

Tests the notification recipients method with different notification types and channels.

php artisan rconfig:test-notifications-recipients

rconfig:transform-eoc-definitions

Transforms legacy EOC definitions JSON to CIC policy format and updates the database.

php artisan rconfig:transform-eoc-definitions

rconfig:transform-policy-definitions

Transforms policy definitions JSON and updates the database.

php artisan rconfig:transform-policy-definitions

rconfig:update-device-roles

Updates all devices to ensure they have at least admin roles attached.

php artisan rconfig:update-device-roles

rconfig:update-rbac-data ⭐

Updates or refreshes permissions table with new permissions. Essential command if you have added new roles or permissions via updates or you get 403 errors in the UI.

php artisan rconfig:update-rbac-data

From V8.3.1 the command is interactive and reports every change before making it:

Safety check. The seeded Admin and User roles, and Guest where it exists, are verified first. If they no longer hold their expected identifiers, the command prints the mismatch, writes nothing, and exits. Contact support rather than re-running it. Installations set up from V8.4.2 have no Guest role, and that’s expected.
New permissions. Permissions for entities added by the release are inserted into the permissions table.
Admin role. The command lists the wildcard permissions it will add and any non-wildcard permissions it will remove from the Admin role, then prompts before applying. If Admin already holds every wildcard, nothing changes.
Permissions split out of existing ones. When a release adds a permission carved out of an existing one (for example aicenter.mcptoken from aicenter.update in V8.4.2), the command lists the roles that hold the original and asks before granting the new one to them.
Preset role permissions. Installations set up between V8.3.1 and V8.4.1 have three preset roles. A preset role with no permissions receives its full set. One that already has permissions is only offered permissions created during this run, so anything you deliberately detached stays detached. Each role’s additions are listed and confirmed separately. From V8.4.2 the command no longer creates missing preset roles; new roles start from a role template instead.
Cache clear. Permission caches are cleared for every user.

Declining any prompt skips that role and moves on. The command is safe to re-run: with nothing to change it reports that and exits.

rconfig:update-snippet-roles

Updates all snippets to ensure they have at least admin roles attached.

php artisan rconfig:update-snippet-roles

rconfig:update-tag-roles

Updates all tags to ensure they have at least admin roles attached.

php artisan rconfig:update-tag-roles

rconfig:vector-cm-accept-proposed

Simulates the Central Manager accepting the latest proposed device. Intended for local development only.

# Accept the latest proposed device
php artisan rconfig:vector-cm-accept-proposed

# Accept a specific event ID
php artisan rconfig:vector-cm-accept-proposed --event-id=abc123

rconfig:vector-cm-messages

Consumes messages from rConfig Vector Central Manager RabbitMQ queue.

php artisan rconfig:vector-cm-messages

rconfig:vector:cm-outbox-list

Lists sync_outbox rows with optional filters. Useful for inspecting what the Central Manager outbox has produced.

# List the most recent 10 rows (default)
php artisan rconfig:vector:cm-outbox-list

# Filter by status
php artisan rconfig:vector:cm-outbox-list --status=pending

# Filter by event type and aggregate
php artisan rconfig:vector:cm-outbox-list --event-type=device.updated --aggregate-type=device --aggregate-id=1002

# Show only rows accepted (or not) by Central Manager
php artisan rconfig:vector:cm-outbox-list --accepted=yes --limit=50

rconfig:vector:cm-outbox-republish

Dispatches PublishOutboxRowJob for sync_outbox rows. Useful for replaying or recovering Central Manager events.

# Republish a specific outbox row by ID
php artisan rconfig:vector:cm-outbox-republish --id=42

# Republish rows by status (default limit 100)
php artisan rconfig:vector:cm-outbox-republish --status=failed --limit=25

# Override the queue name
php artisan rconfig:vector:cm-outbox-republish --status=pending --queue=rConfigDefault

# Force-publish, ignoring CM guard, timing, and acceptance checks
php artisan rconfig:vector:cm-outbox-republish --id=42 --force

rconfig:vector-hub-install-helper

Installs the root-owned Vector Hub helper /usr/local/libexec/rconfig/rconfig-vector-hub, its install script, the sudoers rule /etc/sudoers.d/rconfig-vector-hub, and adds the web user to the vector-hub group so it can read the hub’s client certificates. Vector installs only. The Vector deploy scripts run it; run it by hand after a manual upgrade. (V8.4.1)

sudo php artisan rconfig:vector-hub-install-helper

It must run as root, and refuses if the web user is missing or is root. Restart Horizon afterwards so its workers pick up the new group. See Vector Hub.

rconfig:xftp-backfill-uploads

Backfills the xFTP uploads tracking table from existing filesystem data (root xFTP directory and per-device xftpuploads directories).

# Backfill all files
php artisan rconfig:xftp-backfill-uploads

# Dry run (no DB writes)
php artisan rconfig:xftp-backfill-uploads --dry-run

# Cap the number of files scanned
php artisan rconfig:xftp-backfill-uploads --limit=1000

rconfig:xftp-install-helper

Installs the root-owned pieces xFTP needs: the Docker helper /usr/local/libexec/rconfig/rconfig-xftp-docker and its sudoers rule /etc/sudoers.d/rconfig-xftp, the container entrypoints in /usr/local/libexec/rconfig/xftp/, and the shared group with gid 2000 (rconfigxftp) that the web user joins. It also resets a world-accessible Docker socket to 0660 and removes world-write from the legacy TFTP folders. The deploy script runs it, and it is safe to run again. (V8.4.1)

sudo php artisan rconfig:xftp-install-helper

It must run as root. If Docker is not installed it skips the helper and exits 0. It exits 1 if the helper, entrypoints, sudoers rule or group could not be set up, for example when gid 2000 already belongs to another group. Restart the web server, php-fpm and Horizon after it adds the web user to the group. See xFTP Docker helper.

rconfig:xftp-toggle

Starts and stops the FTP, SFTP/SCP and TFTP containers through an interactive menu. It manages Docker, so it must run as root. (V8.4.1 adds --fix-permissions and the root requirement.)

# Start or stop a service (interactive menu)
sudo php artisan rconfig:xftp-toggle

# Show the xFTP containers and make sure the sweep task exists
sudo php artisan rconfig:xftp-toggle --status

# Lock down the xFTP folder and fix existing uploads, after recreating old containers
sudo php artisan rconfig:xftp-toggle --fix-permissions

# Print useful Docker commands (no root needed)
php artisan rconfig:xftp-toggle --dockercommands

Options:

--status: Show all xFTP containers. Creates the xFTP folder and the xFTP Directory Sweep scheduled task if they are missing
--fix-permissions: Set the xFTP folder to root:rconfigxftp mode 2770 and fix the group and modes of existing files. It refuses, exits 1 and lists the containers to recreate while any container from before V8.4.1 remains
--dockercommands: Print a list of Docker commands for xFTP

Without sudo it prints “rconfig:xftp-toggle manages Docker containers and must run as root.” and exits 1. See xFTP Server for the upgrade steps.

Additional Notes

All commands must be run from the rConfig installation directory (/var/www/html/rconfig8/current)
Run commands as the web server user unless they say they need root. Running other artisan commands as root can leave root-owned files in storage that the web server cannot write
Many commands support the -d flag for verbose debug output
For detailed integration documentation, refer to the specific integration sections in the documentation

Config Retention & Repair - Retention policies and automated config repair
Configuration Backups - Scheduling and managing device configuration backups
SNMP Polling Concepts - SNMP poll commands and device property collection