pbdbutil, pbadmin | EPM-UL

• Version 8.5.0 and earlier: pbdbutil not available.
• Version 9.0.0 and later: pbdbutil available.

Starting with version 9, EPM-UL uses database files for the storage of all the normal configuration files and scripts, plus data storage for a range of new facilities. The utility pbdbutil provides a command line tool to maintain all of these databases.

ℹ️

Due to the evolving nature of the pbdbutil command, the name changed to pbadmin. To assist in the transition a symbolic link called pbadmin is now automatically created for your convenience.

The command has global options that are used to carry out maintenance tasks on all databases, and more specific options that allow maintenance of specified databases. Each group of database options have their own usage/help.

Usage

pbdbutil [<options>] [ <file> <file> ...]

Global options

Authentication options

Info options

License maintenance and statistics options

Setting/Configuration/Key options

Role based policy options

Client registration profile options

Management event options

REST keystore options

Sudo policy database options

Registry name service database options

Database synchronization options

Registry name service cache options

File integrity monitor options

Event log cache options

IO log cache options

IO log queue options

Integrated product options

Write queue status options

Global options

Setting/Configuration options

These options provide methods to import, maintain and export the settings, configuration and key files that were traditionally kept in files in EPM-UL. These files can now be imported into a database which provide versioning and change management, methods to retrieve, update, and save settings and configuration across the enterprise in a secure manner using the EPM-UL REST services.

These options need to be specified after the --cfg option.

Usage

pbdbutil --cfg [<options>] [ <file> <file> ...]

Descriptions

License management options

ℹ️

These options are not available on EPM-L clients.

As of version 10.0, License Management is centralized and can be carried out on the primary license server using the command pbadmin.

This command line administration tool provides methods to update the license string, to list summary statistics and to retire clients to free up licenses.

All of the commands that list statistics can be run from any server that provides a service. All commands that update the database, such as updating the license itself or retiring clients, should be run on the primary license server:

Example

pbadmin --lic -u '{ "PBULPolClnts":200, "SudoPolClnts":200, "RBPClnts":200, "ACAClnts":1, "AKAClnts":0, "FIMClnts":0, "SOLRClnts":1, "Owner":"My Company Corp", "Comment":"Standard License for My Company", "AutoRetire":7, "Recycle":7, "Expires":"2018-03-01 00:00:00", "Terminates":"2019-03-01 00:00:00", "HostId":"7faf7681-4d42-4b69-00bfdad93b4a3dfb", "HMAC":"UtGE3tD6qK2UwutY3GFOqodjdq30pEDAW2cKb5/OaMc="}'

This command updates the installation with the license string provided by BeyondTrust to a standard license.

Usage

pbadmin --lic [<options>] ...

Sample commands

Authentication credential cache options

These options allow users of pbdbutil to cache credentials to facilitate working with remote services.

Usage

pbdbutil --auth [<options>] [ <file> <file> ...]

Auth options

Information options

These options provide various information about the current system configuration or status.

Usage

pbdbutil --info [<options>]

Info options

Role based policy options

ℹ️

These options are not available on EPM-L clients.

The Role Based Policy is held in multiple tables. Each table refers to an individual entity with attributes, and is referenced by unique entity ids. Each entity is then linked together into a role. When retrieving, updating, or deleting entities, either the name or id can be used. The command line utility pbdbutil with the option --rbp can be used to retrieve (-g), update (-u), or delete (-d) entities.

When updating, complete entities including all its attributes need to be defined. The REST API uses the same JSON format and parameters, and use GET, PUT and DELETE respectively. There are also a number pseudo-attributes that allow the retrieval of lists based upon the parent grouping, these are:

• usergrpname: list User Lists which correspond to the specified User Group
• hostgrpname: list Host Lists which correspond to the specified Host Group
• cmdgrpname: list Command Lists which correspond to the specified Command Group
• tmdategrpname: list Time/Date Lists which correspond to the specified Time/Date Group
• rolename: list all lists which correspond to the specified Role Group

Usage

pbdbutil --rbp [<options>] [ <file> <file> ...]

Example

Sample use of the pbdutil --rbp when rbptransactions is set to yes.

pbdbutil --rbp -b -m "<message>"``pbdbutil --rbp -i <file>``pbdbutil --rbp -c

Example

List all of the User Groups whose name matches ug*

pbdbutil --rbp -g '{ "usergrp" : { "name" : "ug*" }}'
[{"id":1,"ug1":"name","description":"desc","disabled":0,"single":0,"type":"I","ext info":null}]

Example

List the User Group whose id=1

pbdbutil -g '{ "usergrp" : { "id" : "1" }}'
[{"id":1,"ug1":"name","description":"desc","disabled":0,"single":0,"type":"I","ext info":null}]

Record entities

usergrp, userlist, hostgrp, hostlist, cmdgrp, cmdlist, tmdategrp, tmdatelist, role, roleusers, roleghost, rolecmds, roletmdates

Entities can be listed by attributes name and id, and entity specific attribute names rolename, usergrpname, hostgrpname, cmdgrpname, tmdategrpname.

Example

-g '{ "role" : { "name" : "*" }} ' Display all Roles
-g '{ "usergrp" : { "name" : "n*" }}' Display all User Groups which match "n*"
-g '{ "userlist" : { "name" : "usergrp1" }} ' Display group membership for usergrp by name
-g '{ "roleusers" : { "rolename" : "role1" }}' Display list of usergrps assigned to role
-g '{ "rolehosts" : { "id" : 1 }} ' Display list of hostgrps assigned to role id 1

Descriptions

User group examples

-g '{ "usergrp" : { "name" : "ug*" }}'
[{"id":1,"ug1":"name","description":"desc","disabled":0,"single":0,"type":"I","extinf o":null}]

-g '{ "userlist" : { "usergrpname" : "ug1" }}' [{"id":1,"user":"root"},{"id":1,"user":"adm*"}]

-u '{ "usergrp" : { "id":1,"name":"ug1","description":"new
description","disabled":0,"single":0,"type":"I","extinfo":null}}'

-u '{ "userlist" : { "usergrpname":"ug1","user":"wheel"}}'

-d '{ "userlist" : { "usergrpname":"ug1"}}'

-d '{ "userlist" : { "usergrpname":"ug1", "user" : "user1"}}'

Host group examples

Command examples

-g '{ "cmdgrp" : { "name" : "cg*" }}'
[{"id":1,"cg1":"name","description":"desc","disabled":0}]

-g '{ "cmdlist" : { "cmdgrpname" : "cg1" }}'
[{"id":1,"cmd":"rm *","rewrite":"echo $*"},{"id":1,"cmd":"/usr/bin/rm
*","rewrite":"echo $*"}]

-u '{ "cmdgrp" : { "id":1,"name":"cg1","description":"new description","disabled":0}}'

-u '{ "cmdlist" : { "cmdgrpname":"cg1","cmd":"/bin/rm *","rewrite":"echo
$*"}}'

-d '{ "cmdlist" : { "cmdgrpname":"cg1"}}'

-d '{ "cmdlist" : { "cmdgrpname":"cg1", "cmd" : "rm *"}}'

Time/Date examples

-g '{ "tmdategrp" : { "name" : "td*" }}'
[{"id":1,"td1":"name","description":"desc","disabled":0}]

-g '{ "tmdatelist" : { "tmdategrpname" : "td1" }}'
    [{"id":1,"tmdate" : "{
    "mon" : [0,0,0,0,0,0,0,15,15,15,15,15,15,15,15,15,15,15,3,0,0,0,0,0,0],
    "tue" : [0,0,0,0,0,0,0,15,15,15,15,15,15,15,15,15,15,15,3,0,0,0,0,0,0],
    "wed" : [0,0,0,0,0,0,0,15,15,15,15,15,15,15,15,15,15,15,3,0,0,0,0,0,0],
    "thu" : [0,0,0,0,0,0,0,15,15,15,15,15,15,15,15,15,15,15,3,0,0,0,0,0,0],
    "fri" : [0,0,0,0,0,0,0,15,15,15,15,15,15,15,15,15,15,15,3,0,0,0,0,0,0],
    "sat" : [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],
    "sun" : [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] }"}]

-u '{ "tmdategrp" : {
"id":1,"name":"td1","description":"new description","disabled":0}}'

-u '{ "tmdatelist" : { "tmdategrpname":"td1","tmdate":"{ "range" : {
"from" : 1415851283, "to": 1415887283 }}"}}'

-d '{ "tmdatelist" : { "tmdategrpname":"td1"}}'

-d '{ "tmdatelist" : { "tmdategrpname":"td1", "tmdate" : "{ "range" : { "from" : 1415851283, "to": 1415887283 }}"}}'

Role examples

-g '{ "role" : { "name" : "Role*" }}'
    [{"id" : 0, "name" : "Role5", "rorder" : 3, "description" : "Desc3",
    "disabled" : 0, "risk" : 1, "action" : "A", "iolog" : "/tmp/iolog_XXXXXX",
    "script" : "accept;"}, {"id" : 1, "name" : "Role6", "rorder" : 2,
    "description" : "Desc3", "disabled" : 0, "risk" : 1, "action" : "A",
    "iolog" : "/tmp/iolog_XXXXXX", "script" : null}, {"id" : 2, "name" :
    "Role7", "rorder" : 1, "description" : "Desc3", "disabled" : 0, "risk" : 1,
"action" : "A", "iolog" : "/tmp/iolog_XXXXXX", "script" : null}]

-g '{ "roleusers" : { "name" : "Role6" }}'
[{"id":1,"users":1,"type":"R"},{"id":1,"users":1,"type":"S"}]

-u '{ "role" :  
{"id":0,"name":"Role5","rorder":3,"description":"Description  
  4","disabled":0,"risk":1,"action":"A","iolog":"/tmp  
/iolog_XXXXXX","script":"accept;"},    {"id":1,"name":"Role6","rorder":2,"description":"Desc3","disabled":0,"risk":1,"action":"A","iolog":"/tm

p/iolog_XXXXXX","script":null},  
{"id":2,"name":"Role7","rorder":1,"description":"Desc3","disabled":0,"risk":1,"action":"A","iolog":"/tmp/io

log_XXXXXX","script":null}'

-u { "rolehosts" : { "name" : "Role5", "hostgrpname" : "hostgrp2" , "type"
    : "S"}}'

-d '{ "roleusers" : { "name":"Role5"}}'

-d '{ "roleusers" : { "name" : "Role5", "usergrpname":"ug1"}}'

ℹ️

For more information on the -b setting in the Endpoint Privilege Management /etc/pb.settings configuration file, see Role Based Policy.

Client registration options

ℹ️

These options are not applicable to EPM-L.

These options provide methods to create, maintain, export, and import role-based policies into EPM-UL, used with the --rbp option.

Usage

pbdbutil --reg [<options>] [ <file> <file> ...]

Client registration database options

These options provide methods to define and maintain Client Registration profiles, used to simplify the registration of hosts within the Endpoint Privilege Management enterprise.

"<-g|--get>" "{ param }"

Example

Retrieve Client Registration profile using the specified name:

-g ’{ "name" : "default" }

    {"type":"settings","fname":"/etc/pb.settings"}
    {"type":"certificate","to":"/etc/${prefix}pbrest.pem${suffix}"}
    {"type":"save","sname":"networkencryption"}
    {"type":"save","sname":"restkeyencryption"}
    {"type":"save","sname":"sslservercertfile"}
{"type":"save","sname":"sslserverkeyfile"}

"<-u|--update>" "{ param }"

Examples

Update the specified Client Registration profile:

-u ’{ "name" : "prof1", [{"type":"settings",
    "fname":"/etc/pb.mysettings"},
{"type":"save","sname":"networkencryption"} ]’

"<-d|--delete>" "{ param }"

Example

Delete the specified Client Registration profile:

-d ’{ "name" : "prof1" }’

<-l|--list>

List all the Client Registration profiles.

<-n|--new>

Create and initialize the Client Registration database.

RNS options

These options allow the maintenance and interrogation of the Registry Name Services.

Usage

pbdbutil --svc [<options>] [ <file> <file> ...]

Example

Recreate the Registry Name Service Database

 pbdbutil --svc -N --force

Example

List Service Groups from Registry Name Service Database

 pbdbutil -P --svc -l

Result:

{
    "svcgid": 1,
    "svcgname": "registry_name_svc",
    "svc": "registry",
    "updated": "2016-06-09 15:42:33",
    "deleted": 0
}
{
    "svcgid": 2,
    "svcgname": "dfl_pb_policy_svc",
    "svc": "pbpolicy",
    "updated": "2016-06-09 15:42:33",
    "deleted": 0
}
{
    "svcgid": 3,
    "svcgname": "dfl_log_svc",
    "svc": "logsvr",
    "updated": "2016-06-09 15:42:33",
    "deleted": 0
}
{
    "svcgid": 4,
    "svcgname": "dfl_sudo_policy_svc",
    "svc": "sudopolicy",
    "updated": "2016-06-09 15:42:33",
"deleted": 0
}

Example

List primary and secondary servers within the Service Groups

 pbdbutil -P --svc -l -l

Result:

{
    "svcgid": 1,
    "svcgname": "registry_name_svc",
    "svc": "registry",
    "updated": "2016-06-14 10:43:14",
    "deleted": 0,
    "svcs": [
{
    "svcgid": 1,
    "hostid": 1,
    "role": "primary",
    "created": "2016-06-14 10:43:14",
    "updated": "2016-06-14 09:43:14",
    "deleted": 0,
    "cn": "pbuild",
    "uuid": "969ecab2-93d8-4322-a8cf-6314457053bb",
    "fqdn": "pbuild",
    "addrs": [
    {
    "family": 4,
    "port": 24351,
    "addr": "192.168.16.138"
    }
    "tnlzone": 0
    }
    ]
    }
    {
    "svcgid": 2,
    "svcgname": "dfl_pb_policy_svc",
    "svc": "pbpolicy",
    "updated": "2016-06-14 10:43:14",
    "deleted": 0
    }
    {
    "svcgid": 3,
    "svcgname": "dfl_log_svc",
    "svc": "logsvr",
    "updated": "2016-06-14 10:43:14",
    "deleted": 0
    }
    {
    "svcgid": 4,
    "svcgname": "dfl_sudo_policy_svc",
    "svc": "sudopolicy",
    "updated": "2016-06-14 10:43:14",
    "deleted": 0
}

Example

Retrieve specified Service Group

pbdbutil --svc -g '{ "svcgname" : "registry_name_svc" }'

Result:

{"svcgid":1,"svcgname":"registry_name_svc","svc":"registry","updated":"2016-06-06 16:56:53","deleted":0}

Example

Retrieve Specified Host by "cn"

pbdbutil --svc -g '{ "cn" : "pbuild" }'

Result:

{"addrs":[{"family":4,"addr":"192.168.16.138","port":24351}],"cn":"pbuild","uuid":"969ecab2-93d8-4322-a8cf-6314457053bb","$

Example

Retrieve Specified Host by "uuid"

pbdbutil --svc -g '{ "uuid" : "969ecab2-93d8-4322-a8cf-6314457053bb" }'

Result:

{"addrs":[{"family":4,"addr":"192.168.16.138","port":24351}],"cn":"pbuild","uuid":"969ecab2-93d8-4322-a8cf-6314457053bb","$

Example

Retrieve Host Entry for the Primary of the Specified Service Group

pbdbutil --svc -g '{ "primary" : "registry_name_svc" }'

Result:

{"svcgid":1,"svcgname":"registry_name_svc","svc":"registry","updated":1465228621,"deleted":0,"hostid":1,"role":"primary","$

Example

Retrieve Host Information for Specified Host

pbdbutil --svc -L pbuild

Result:

{"fqdn":"pbuild","cn":"pbuild","uuid":"969ecab2-93d8-4322-a8cf-6314457053bb","addrs":[{"addr":"192.168.16.138","family":4,$

Example

List All Hosts

 pbdbutil -P --svc -L

Result:

{
"hostid": 1,
"cn": "pbuild",
"uuid": "969ecab2-93d8-4322-a8cf-6314457053bb",
"fqdn": "pbuild",
"addrs": [
{
"family": 4,
"port": 24351,
"addr": "192.168.16.138"
}
],
"tnlzone": 0,
"updated": 1465897394,
"deleted": 0
}
{
"hostid": 4,
"cn": "pbtest",
"uuid": "969ecab2-93d8-4322-a8cf-6314457053bf",
"fqdn": "pbtest",
"addrs": [
{
"family": 4,
"port": 24351,
"addr": "192.168.16.184"
}
],
"tnlzone": 0,
"updated": 1465898703,
"deleted": 0
}

Example

Add a Specified Host ("cn" Common Name and "uuid" Are Required)

 pbdbutil --svc -u '{ "cn" : "pbtest" , "uuid" : "969ecab2-93d8-4322-a8cf-6314457053bf" }'

Example

Add New Service Group

 pbdbutil --svc -u '{  "svcgname" : "foobar", "svc" : "logsvr" }'

Example

Add Host to Service Group

 pbdbutil --svc -u '{ "svcgname" : "foobar", "cn" : "pbtest" }'

Example

Delete Host

 pbdbutil --svc -d '{ "cn" : "pbtest" }'

Example

Add Host to Service Group as Primary Server

 pbdbutil --svc -u '{ "svcgname" : "foobar", "cn" : "pbtest", "role" : "primary" }'

Example

Delete Host When It Is a Primary

 pbdbutil --svc -d '{ "cn" : "pbtest" }'

4011.01 Host is a primary server. Please reassign primary before deleting host from service group, or use force on the $.

Example

Delete the Service Group

 pbdbutil --svc -d '{ "svcgname" : "foobar" }' --force

Example

Promote a Host That Is Currently a Secondary Server to a Primary Server

 pbdbutil --svc -p foobar pbtest

Management event options

These options provide methods to create, maintain, export, and import role-based policies into EPM-UL.

Usage

• pbdbutil --evt [<options>] [<file> <file> ...]
• -s {json param}: Search Management event records
• Record entities: hostname, evtname, service, by, severity, before/after/then progname, version, arch, taxonomy

Records can be searched using the above entities and are matched as wildcards.

Example

-s '{ "taxonomy" : "chgmgt" } 'Display all Change Management Events``-s '{ "taxonomy" : "chgmgt", "hostname" : "host1" } ' Display all Change Management Events for host1

Description

Example

Retrieve all change management events

-S '{ "taxonomy" : "chgmgt" }'
{"hostname" : "pbuild", "evtname" : "file_import", "service" : "pbdbutil9.0.0-01_debug", "who" : "ctaylor", "severity" : 16, "progname" : "pbdbutil9.0.0-01_debug", "version" : "9.0.0-01_debug", "arch" : "x86_64_ linuxA", "data" : {"msg" : "foo, bar", "fname" : "/opt/pbul/policies/pb.conf, conf","version" : 4, "sid" : 4995, "pid" : 31976, "uid" : 0}, "utc" : "2014-11-1109 : 19 : 28"}
{"hostname" : "pbuild", "evtname" : "tag_file", "service" : "pbdbutil9.0.0- 01_debug", "who" : "ctaylor", "severity" : 16, "progname" : "pbdbutil9.0.0- 01_debug", "version" : "9.0.0-01_debug", "arch" : "x86_64_linuxA", "data" :{"fname" : "/opt/pbul/policies/pb.conf", "tag" : "foo", "version" : -1, "sid" : 4995,"pid" : 31979, "uid" : 0}, "utc" : "2014-11-11 09 : 19 : 30"}

Example

Retrieve change management events for host1 only

-S '{ "taxonomy" : "chgmgt" , "hostname" : "host1" }'

REST keystore options

Usage

pbdbutil --rest [<options>] [ <file> <file> ...]

Database synchronization options

These options allow the interrogation of Database Synchronization status on primary servers.

Usage

pbdbutil --dbsync [<options>] [ <file> <file> ...]

Registry Name Service Cache Options

Each host has a Registry Name Service Cache that holds the Service Group information that is applicable to them.

These options allow the retrieval of information and options to re-initialize the Registry Name Service Cache database.

Usage

pbdbutil --scache [<options>] [ <file> <file> ...]

Elasticsearch credential management

The pbdbutil settings outlined here support Elasticsearch credential management.

The options available with the pbdbutil tool are also available in the EPM-UL REST API.

ℹ️

For more information, see Elasticsearch Logstash API Calls.

Usage

pbdbutil --elkcred [<options>]

Test a credential

To test a credential independently of /etc/pb.settings, add the elkinstances JSON attribute, as shown here:

Example

 pbdbutil --elkcred -t '{"id": "elastic_token", "type": "token", "username": "jeff", \
"password": "<password>", "endpoint": "/_security/oauth2/token", \
"elkinstances": "elasticsearch=https://elksite.us-east-1.aws.found.io"}' -P
{
   "results": [
      {
         "token-request": {
            "url": "https://elksite.us-east-1.aws.found.io/_security/oauth2/token",
            "curlcode": "0 (No error)",
            "httpcode": "200 (OK)"
         },
         "test-request": {
            "url": "https://elksite.us-east-1.aws.found.io/?pretty",
            "curlcode": "0 (No error)",
            "httpcode": "200 (OK)"
         }
      }
   ]
}

The format of the elkinstances value is the same as it would be in /etc/pb.settings.

Use -P to make the output more readable. As is the case with an existing credential, an attempt to test a prospective credential of type token or apikey against a Logstash instance fails.

poldbg

ℹ️

These options are not applicable to EPM-L.

Description

Policy language debugging can be enabled, disabled, and reviewed using the poldbg option.

With this command:

• List policy debugging entries to identify and resolve issues that may have occurred in a policy.
• Specify users whose policy is debugged, and specify the amount of time that debugging is enabled for that user and policy.
• Run pbrun command and review the debugging information.

ℹ️

Policy debugging is only available for if statements and switch case statements.

Syntax

Run to list debugging policy entries.

--poldbg -l

Run to identity users who can debug entries. You can also designate how long the user has access.

--poldbg -u

Run to view and print a clean output of events for policy debugging in JSON-equivalent format.

pbadmin -P --evt -s '{taxonomy" : policydbg" }'

Run to view and print events for policy debugging in a CSV-type format.

pbadmin -C --evt -s '{taxonomy" : policydbg" }'

Example

pbadmin --poldbg -u rjones 2h

In this example, the user rjones is specifically allowed to debugging access for two hours.

Example

pbadmin -C --evt -s '{taxonomy" : policydbg", "rowid" : 3 }'

In this example, the events are going to be provided in a CSV-type format in which the information specifically in row three is expanded.

Integrated product options

These options provide options to configure the Integrated Products Queue database.

Usage

pbdbutil --intprod [<options>] [ <file> <file> ...]

Policy and log caching options

These options support the policy and log caching feature introduced in EPM-UL version 23.1.

Usage

pbdbutil --remotecache [<options>]

Options supported on a client

Options supported on a policy server

Example

List client policy versions in a human-friendly format.

pbdbutil --remotecache --list-versions -P

I/O logfile queue options

These options allow users to maintain the database that queues the I/O logfile names for indexing to ElasticSearch.

Usage

pbdbutil --iologidx[<options>]

When an iolog is started, pblogd (or pbmasterd) adds that iolog to the logfile queue with a pblogd_status of started and retry set to never. When the iolog file is closed in a normal fashion, the pblogd_status is set to finished. During the time that pblogd is active, it periodically sends a heartbeat.

When an iolog is not properly closed (pbrun killed or network issues, for example), the heartbeat is used with the iologactionqueuetimelimit keyword to artificially set the pblogd_status to finished, so that iolog can be processed for ElasticSearch or iologcloseaction.

When an iolog is being processed for ElasticSearch or iologcloseaction, the proc_status is set to processing. When ElasticSearch or iologcloseaction has successfully completed, the proc_status is set to finished. When ElasticSearch reports a recoverable error, or iologcloseaction returns -1, the iolog is re-queued by setting lastupdated to now, setting retry (now + iologactionretry minutes), and incrementing the retries.

Example

Delete all queued I/O log file names

pbdbutil –-iologidx -d *

I/O logfile cache options

These options allow users to maintain the database that caches the I/O logfile names for use with BeyondInsight for Unix & Linux.

Usage

pbdbutil --iocache [<options>]

Display cached list of I/O log files:

Remove I/O log file entries from the logfile cache database:

-d '{param…}']

Where the {param…} argument is formatted JSON parameters:

• {"path":"pattern"}: glob wildcard for logfile path
• {"loghost":"host1"}: Filter by loghost name
• {"submithost":"host2"}: Filter by submithost name
• {"runhost":"host3"}: Filter by runhost name
• {" submituser":"user1"}: Filter by submituser name
• {"runuser":"user2"}: Filter by runuser name
• {"runcmd":"command"}: Filter by run command
• {"from":"<yyyy-mm-dd HH:MM>"}: Filter I/O logs created on or after this date/time
• {"to":"<yyyy-mm-dd HH:MM"}: Filter I/O logs created on or before this date/time
• {"start":<offset>}: Specify record offset (number) when limiting output
• {"len":<len>}: Specify number of rows when limiting output

Migrate I/O log location cache database (Upgrades only):

-n [--force]

Migrates pre-v10.3.1 I O log location cache database to the new database configuration.

Migration is automatically done during an upgrade via pbinstall. Running this manually is typically not necessary unless circumstances prevented the automatic migration during the upgrade. The optional --force skips backup of the original/obsolete I/O log cache database if it already has been backed up by other methods.

Where the {param} argument is formatted JSON with parameters:

• "path":"pattern": glob wildcard for logfile path
• "loghost":"host2": loghost name
• "submithost":"host1": Filter by submithost name
• "runhost":"host1": Filter by runhost name
• "submituser":"user1": Filter by submituser name
• "runuser":"user1": Filter by submituser name
• "runcmd":"cmd": Filter by runcmd name
• "from":"<yyyy-mm-dd HH:MM>": Filter by logfiles opened on or after this date/time
• "to":"<yyyy-mm-dd> HH:MM": Filter by logfiles opened on or before this date/time
• "start":<offset>: Specify record offset (number) when limiting output
• "len":<limit>: Specify number of rows when limiting output

File Integrity Monitor options

These options provide maintenance for the File Integrity Monitor database, and options for the client to run an integrity check.

Usage

pbdbutil --fim [<options>] [ <file> <file> ...]

Options for FIM client

Options for FIM server database management

Event logfile cache options

These options allow users to query and maintain the database that caches the event logfile names for use with BeyondInsight for Unix & Linux.

Usage

pbdbutil --evtcache [<options>]

Display cached list of event log files:

Where the {param} argument is formatted JSON parameters:

• {"path":"<pattern>"}: glob wildcard for logfile path
• {"runhost":"<host1>"}: Filter by runhost name
• {"loghost":"<host2>"}: Filter by loghost name
• {"from":"<yyyy-mm-dd HH:MM>"}: Filter by event logs active on or after this date/time
• {"to":"<yyyy-mm-dd HH:MM"}: Filter event logs active on or before this date/time
• {"start":<offset>}: Specify record offset (number) when limiting output
• {"len":<limit>}: Specify number of rows when limiting output

Remove event log file entries from the logfile cache database:

-d '{param…}'

Where the {param…} argument is formatted JSON parameters:

• {"path":"pattern"}: glob wildcard for logfile path
• {"loghost":"host2"}: Filter by loghost name
• {"from":"<yyyy-mm-dd HH:MM>"}: Filter event logs active on or after this date/time
• {"to":"<yyyy-mm-dd HH:MM"}: Filter event logs active on or before this date/time

Policy and log caching options

These options support the policy and log caching feature introduced in EPM-UL version 23.1.

Usage

pbdbutil --remotecache [<options>]

Options supported on a client

Options supported on a policy server

Example

List client policy versions in a human-friendly format.

pbdbutil --remotecache --list-versions -P

Write queue status options

Starting in EPM-UL 22.3, report on and summarize the content of write queue files using new options added to the pbadmin command. The files are created when the message router is offline or when write queue records cannot be written to a log server’s event log.

Usage

pbadmin --wqstatus [<options>]

Options

Examples

Example

pbdbutil --wqstatus -l

[root@dev-test ~]# pbdbutil --wqstatus -l /opt/pbul/msgrouter/wq_0003 -P
[
   {
      "file": "/opt/pbul/msgrouter/wq_0003",
      "created": "2022-09-02 14:01:22",
      "count": 2,
      "completed": 0,
      "pending": 0,
      "notprocessed": 2
   }
]

Example

pbdbutil –wqstatus -ll

[root@dev-test ~]# pbdbutil --wqstatus -ll /opt/pbul/msgrouter/wq_0003 -P
[
   {
      "file": "/opt/pbul/msgrouter/wq_0003",
      "created": "2022-09-02 14:01:22",
      "count": 2,
      "completed": 0,
      "pending": 0,
      "notprocessed": 2,
      "numaccept": 1,
      "numreject": 0,
      "numfinish": 1,
      "numkeystroke": 0,
      "numiologclose": 0,
      "numiologcache": 0,
      "records": [
         {
            "type": "event log",
            "length": 686,
            "wqstatus": "notprocessed",
            "event": "Finish",
            "uniqueid": "0a64a8e963120c883D37",
            "timestamp": "2022-09-02 14:00:52"
         },
         {
            "type": "event log",
            "length": 8615,
            "wqstatus": "notprocessed",
            "event": "Accept",
            "uniqueid": "0a64a8e963120ded3F1F",
            "timestamp": "2022-09-02 14:06:37"
         }
      ]
   }
]

Example

pbdbutil --wqstatus -T

[root@dev-test ~]# pbdbutil --wqstatus -T -P
{
   "files": 5,
   "records": 31,
   "completed": 0,
   "pending": 0,
   "notprocessed": 31,
   "numaccept": 19,
   "numreject": 0,
   "numfinish": 7,
   "numkeystroke": 0,
   "numiologclose": 3,
   "numiologcache": 2,
   "first": "2022-09-02 14:00:40",
   "last": "2022-09-02 14:36:31"
}