Cisco Bug Search Tool (BST) is a web-based tool that acts as a gateway to the Cisco bug tracking system that maintains a comprehensive list of defects and vulnerabilities in Cisco products and software. BST provides you with detailed defect information about your products and software.

Cisco CMX Command Reference Guide, Release 10.6.3

Preface

Preface xii

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands

•

Using the Command-Line Interface, on page 4

•

cassandraexport, on page 5

•

cmxctl checkdb , on page 6

•

cmxctl checklogs , on page 7

•

cmxctl config analytics, on page 8

•

cmxctl config aps delete, on page 11

•

cmxctl config audit, on page 12

•

cmxctl config auth, on page 15

•

cmxctl config authinfo get, on page 18

•

cmxctl config authserver, on page 19

•

cmxctl config banner, on page 21

•

cmxctl config certs, on page 22

•

cmxctl config controllers , on page 28

•

cmxctl config data, on page 30

•

cmxctl config devicelimitalert, on page 31

•

cmxctl config featureflags, on page 32

•

cmxctl config fips, on page 34

•

cmxctl config fips ipsecauth, on page 36

•

cmxctl config fips ucaplmode, on page 37

•

cmxctl config fips ucaplmode autobackup, on page 39

•

cmxctl config fips ucaplmode logFileAccess, on page 40

•

cmxctl config fips ucaplmode logHTTPHeaders, on page 41

•

cmxctl config gateway, on page 42

•

cmxctl config get, on page 43

•

cmxctl config heatmaps summary, on page 45

•

cmxctl config hyperlocation mixmode, on page 46

•

cmxctl config import , on page 48

•

cmxctl config ipsec, on page 49

•

cmxctl config loginrate, on page 51

•

cmxctl config manageacl, on page 52

•

cmxctl config maps address, on page 53

•

cmxctl config maps aplist, on page 54

•

cmxctl config maps buildings, on page 56

Cisco CMX Command Reference Guide, Release 10.6.3

•

cmxctl config maps campuses, on page 57

•

cmxctl config maps delete, on page 58

•

cmxctl config maps floors, on page 59

•

cmxctl config maps import, on page 60

•

cmxctl config maps reprocessimage, on page 62

•

cmxctl config maps zones, on page 63

•

cmxctl config qlesspyworker, on page 64

•

cmxctl config reload , on page 65

•

cmxctl config rfid timeout, on page 66

•

cmxctl config set, on page 67

•

cmxctl config smartlicense enable, on page 69

•

cmxctl config smartlicense register, on page 70

•

cmxctl config smartlicense status, on page 71

•

cmxctl config smartlicense renewauthorization, on page 72

•

cmxctl config smartlicense renewregistration, on page 73

•

cmxctl config smartlicense reregister, on page 74

•

cmxctl config smartlicense deregister, on page 75

•

cmxctl config smartlicense secondaryudi, on page 76

•

cmxctl config uptimethreshold, on page 77

•

cmxctl config verify , on page 78

•

cmxctl debug , on page 80

•

cmxctl disable , on page 81

•

cmxctl dump , on page 83

•

cmxctl enable , on page 84

•

cmxctl heterarchy, on page 86

•

cmxctl influxdb wipe, on page 87

•

cmxctl jobs , on page 88

•

cmxctl metrics notification , on page 89

•

cmxctl node , on page 90

•

cmxctl restart , on page 91

•

cmxctl stack, on page 93

•

cmxctl start , on page 94

•

cmxctl status , on page 96

•

cmxctl stop , on page 99

•

cmxctl trace mac , on page 101

•

cmxctl trace status , on page 102

•

cmxctl trace update , on page 103

•

cmxctl users , on page 104

•

cmxctl users unlock, on page 105

•

cmxctl version , on page 106

•

cmxloc delete, on page 107

•

cmxloc download, on page 108

•

cmxloc find, on page 109

•

cmxloc list, on page 110

•

cmxloc monitor, on page 111

•

cmxloc start, on page 112

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands

•

cmxos addswap , on page 113

•

cmxos adminui, on page 114

•

cmxos apiserver disable, on page 115

•

cmxos apiserver enable, on page 116

•

cmxos apiserver reset, on page 117

•

cmxos apiserver restart, on page 118

•

cmxos apiserver start, on page 119

•

cmxos apiserver status, on page 120

•

cmxos apiserver stop, on page 121

•

cmxos apiserver user, on page 122

•

cmxos backup , on page 123

•

cmxos backupsched, on page 124

•

cmxos benchmark disk , on page 125

•

cmxos changedate, on page 126

•

cmxos checkpostgresdatasize , on page 127

•

cmxos clean , on page 128

•

cmxos configure , on page 130

•

cmxos date, on page 131

•

cmxos encryptdisk, on page 132

•

cmxos etchosts, on page 134

•

cmxos firstboot , on page 135

•

cmxos fixhaproxy , on page 136

•

cmxos health, on page 137

•

cmxos inventory , on page 138

•

cmxos kill, on page 139

•

cmxos monit, on page 140

•

cmxos ntp, on page 141

•

cmxos openports , on page 142

•

cmxos patch, on page 143

•

cmxos reboot, on page 144

•

cmxos reconfigure , on page 145

•

cmxos rediscleanup, on page 148

•

cmxos restore , on page 149

•

cmxos shutdown, on page 151

•

cmxos smartlicenseudi, on page 152

•

cmxos sslcert , on page 153

•

cmxos sysproxy, on page 154

•

cmxos techsupport , on page 156

•

cmxos techsupport dump , on page 157

•

cmxos upgrade , on page 158

•

cmxos vacuumdb, on page 160

•

cmxos verify , on page 161

•

cmxos wipeoutdisk, on page 162

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands

Using the Command-Line Interface

Using the Command-Line Interface

Starting from Cisco CMX 10.3.1, you can use the Tab key to auto complete any Cisco CMX command on the command line interface. If you enter cmxos and then click the Tab key, the CLI displays the available keywords. If you enter a partial string and then click the Tab key, the CLI then displays the complete string.

Note The documentation set for this product strives to use bias-free language. For purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cassandraexport

cassandraexport

To export Cisco CMX history data from Cassandra to a CSV file, use the cassandraexport command.

cassandraexport { --date <yyyy/mm/dd> } [{ --table <tablename> | --file <filename> | --sql <sql statement> | --rowsperfetch <rows per fetch> }]

Syntax Description --date <yyyy/mm/dd>

--table <table name>

--file <filename>

Date on which the export is to be performed. This is required.

(Optional) Name of the table to export.

(Optional) Name of the CSV file. The default is

/tmp/CassandraExport_sql.csv.

This option is not currently supported.

--sql <sql statement>

--rowsperfetch <rows per fetch> (Optional) The default is 1000 rows.

Command Default

Command Modes

Command History

Usage Guidelines

None.

CMX root user

Release Modification

Cisco CMX Release 10.3.0

This command was introduced.

This command extracts a maximum of only one day of data, starting from midnight of the date given to the time when the command is issued.

You can use these methods to export Cisco CMX data from Cassandra:

• The method that we most recommend is through the Notifications feature ( Manage > Notifications>

New Notification ). For more information, see the “Managing Notifications from Applications” section in the Cisco Connected Mobile Experiences Configuration Guide for this release at: http://www.cisco.com/ c/en/us/support/wireless/mobility-services-engine/products-installation-and-configuration-guides-list.html

• An alternative method is to use the cassandraexport command, and to export daily. We recommend that you schedule the export during a quiet period of the day, for example 2:00 A.M. If you use this method during a time when the system is continuously changing, a timeout can occur.

• Use the Cisco CMX History API only if your export does not exceed 2000 records, for example 100 floors.

Example

The following example shows how to export Cisco CMX data from Cassandra to a CSV file:

[cmxadmin@server]# /opt/cmx/bin/cassandraexport --date 2017/06/14

Data exported into the file /tmp/CassandraExport_201706150220-02.csv

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl checkdb

cmxctl checkdb

To check the database for schema integrity, use the cmxctl checkdb command.

cmxctl checkdb { cassandra | postgres }

Syntax Description cassandra Checks the cassandra schema.

postgres Checks the postgres schema.

Command Default

Command Modes

Command History

None

CMX admin user

Release Modification

Cisco CMX Release 10.3

This command was introduced.

Example

The following example shows how to the schemen integrity for cassandra and postgres database:

[cmxadmin@server]# cmxctl checkdb cassandra

Schema passed analytics

Schema passed loc

Schema passed mse

Cassandra passed schema validation

[root@server]# cmxctl checkdb postgres

Schema passed analytics

Schema passed loc

Schema passed mse

Postgres passed schema validation

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl checklogs

cmxctl checklogs

To check logs and generate a report, use the cmxctl checklogs command.

Command Default

Command Modes

Usage Guidelines cmxctl checklogs

None

CMX admin user

After a report is generated, the specific log that shows the error can be viewed for additional details. For example, /opt/cmx.var.log.cmxjobs.log.3

has 108 errors, use the command more

/opt/cmx.var.log.cmxjobs.log.3

to view the corresponding file.

The following example shows how to check logs and generate a report:

[cmxadmin@cmx]# cmxctl checklogs

************************************************************************

Checking /opt/cmx/var/log/cmxjobs.log.3 for errors..

/opt/cmx/var/log/cmxjobs.log.3 has 108 errors

**********************************************************************

Checking /opt/cmx/var/log/system-cron.log for errors..

/opt/cmx/var/log/system-cron.log has 0 errors

************************************************************************

Checking /opt/cmx/var/log/cmxjobs.log for errors..

/opt/cmx/var/log/cmxjobs.log has 81 errors

************************************************************************

Checking /opt/cmx/var/log/collectd.log for errors..

/opt/cmx/var/log/collectd.log has 0 errors

***********************************************************************

Checking /opt/cmx/var/log/consul.log for errors..

/opt/cmx/var/log/consul.log has 0 errors

************************************************************************

Checking /opt/cmx/var/log/qless-py-worker.log for errors..

/opt/cmx/var/log/qless-py-worker.log has 0 errors

************************************************************************

Checking /opt/cmx/var/log/influxdb.log for errors..

/opt/cmx/var/log/influxdb.log has 0 errors

************************************************************************

Checking /opt/cmx/var/log/cmxjobs.log.4 for errors..

/opt/cmx/var/log/cmxjobs.log.4 has 108 errors

***********************************************************************

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config analytics

cmxctl config analytics

To configure general analytics settings, use the cmxctl config analytics command: cmxctl config analytics { cleanRedis | enableMinDwellFilter | { True | False } | setMinDwellFilter

<value> | setNumMonthsRepeatHistory <value> | view }

Syntax Description cleanRedis enableMinDwellFilter {True | False}

Removes old, invalid Redis bloom filters.

• True —Enables the minimum dwell filter.

• False —Disables the minimum dwell filter. This is the default.

setMinDwellFilter <value> view

Sets the minimum dwell filter value [0-1440]. The default is 0.

setNumMonthsRepeatHistory <value> Sets the number of months [0-6] to retain the repeat history. The default is 6.

Displays the general analytics settings.

Command Default

Command Modes

Command History

Usage Guidelines

None.

CMX admin user

Release

Cisco CMX Release 10.5

Modification

Additional subcommands were added.

Cisco CMX Release 10.3.1

This command was introduced.

You can set a minimum dwell filter to filter out visitors whose dwell at the root campus level is less than a specified amount. The root campus level encompasses all campuses; it represents the root of the heterarchy.

This affects the aggregated data, so once the filter is enabled, it applies to all reports for that day moving forward (until it is disabled again). This filter does not affect the raw visits.

If you configure the minimum dwell filter setting, you must restart Cisco CMX for the change to take effect.

Use the cmxctl restart command to restart Cisco CMX.

Note Use the minimum dwell filter only if you don't want to see devices that spend less than the minimum number of minutes at the root campus level.

Repeat history is kept for the current month and the set number of previous months. This set number of months must be in the range of 0 to 6 months. You do not need to restart Cisco CMX to put this setting into effect.

Note If you use the setNumMonthsRepeatHistory command, all current repeat history is deleted.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config analytics

Examples

The following example shows how to display the current general analytics settings:

[cmxadmin@cmx]# cmxctl config analytics view

+--------------------------+------+

| enableMinimumDwellFilter | True |

+--------------------------+------+

| minimumDwellFilter | 30 |

+--------------------------+------+

| numMonthsRepeatHistory | 6 |

+--------------------------+------+

The following example shows how to set and enable the Analytics minimum dwell filter setting:

[cmxadmin@cmx]# cmxctl config analytics setMinDwellFilter 30

+--------------------------+-------+

| enableMinimumDwellFilter | False |

+--------------------------+-------+

| minimumDwellFilter | 0 |

+--------------------------+-------+

| numMonthsRepeatHistory | 6 |

+--------------------------+-------+

[root@server]# cmxctl config analytics enableMinDwellFilter True

+--------------------------+-------+

| enableMinimumDwellFilter | True |

+--------------------------+-------+

| minimumDwellFilter | 30 |

+--------------------------+-------+

| numMonthsRepeatHistory | 6 |

+--------------------------+-------+

[root@server]# cmxctl analytics restart

...............

Service Analytics has successfully restarted.

The following example shows how to disable the minimum dwell filter setting:

[cmxadmin@cmx]# cmxctl config analytics cleanRedis

Cleaning up old bloom filters from redis on 2018-06-26

Month filter cutoff date = 2017-12-01

Current valid ids = [4, 3, 2, 1, 17, 18, 8, 9, 11, 12, 13, 14, 19] cutoff = 2017-12-01 validids = [4, 3, 2, 1, 17, 18, 8, 9, 11, 12, 13, 14, 19] cutoff = 2018-06-25 validids = [4, 3, 2, 1, 17, 18, 8, 9, 11, 12, 13, 14, 19]

Deleting key: Day_2018-06-23_2

Deleting key: Day_2018-06-24_4

Deleting key: Day_2018-06-21_2

Deleting key: Day_2018-06-21_12

Deleting key: Day_2018-06-24_12

Deleting key: Day_2018-06-22_12

Deleting key: Day_2018-06-23_4

Deleting key: Day_2018-06-21_8

Deleting key: Day_2018-06-23_12

Deleting key: Day_2018-06-22_2

Deleting key: Day_2018-06-24_8

Deleting key: Day_2018-06-22_8

Deleting key: Day_2018-06-21_14

Deleting key: Day_2018-06-22_4

Deleting key: Day_2018-06-23_14

Deleting key: Day_2018-06-24_2

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config analytics

The following example shows how to set the repeat history setting:

[cmxadmin@cmx]# cmxctl config analytics setNumMonthsRepeatHistory 5

Doing this will delete current history for ALL months. This will affect aggregated report data but will NOT affect raw visits data. Do you want to continue? [y/N]: y

Successfully change the number of months tracked for repeat history.

+--------------------------+-------+

| enableMinimumDwellFilter | False |

+--------------------------+-------+

| minimumDwellFilter | 0 |

+--------------------------+-------+

| numMonthsRepeatHistory | 5 |

+--------------------------+-------+

[root@server]# #

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config aps delete

cmxctl config aps delete

To delete an access point from Cisco CMX, use the cmxctl config aps delete command.

cmxctl config aps delete MAC Address

Syntax Description MAC Address Displays the MAC address of the access point.

Command Default

Command Modes

Command History

None.

CMX admin user

Release Modification

Cisco CMX Release 10.4

This command was introduced.

This command should be run at the cmxadmin level.

Usage Guidelines

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config audit

cmxctl config audit

To enable and manage the remote logging of system events (syslogs), use the cmxctl config audit settings command. To view logged files, use the cmxctl config audit view command.

cmxctl config audit { restart | settings | status | view }

Syntax Description restart settings status view

Restarts rsyslog service.

Enables, disables and configures audit log settings. See Usage Guidelines for information.

Displays whether audit logging is running on CMX, or is disabled. For example,

Remote Audit Logging = Disabled

Displays all or specific log files. See Usage Guidelines for information.

Command Default

Command Modes

Command History

Usage Guidelines

By default, remote system logging is disabled.

CMX admin user

Release

Cisco CMX Release 10.6.3

Modification

This command was modified to include restart and status keywords.

This command was introduced.

Cisco CMX Release 10.5.0

• The command cmxctl config audit settings prompts you to enter the following configuration questions.

If you enter no value, CMX selects the default value, shown in [brackets].

Note To enable remote audit logging, enter a remote syslog IP address, port number and domain name. Otherwise, only local audit logging is enabled.

[cmxadmin@cmx]# cmxctl config audit settings

Enable or Disable Remote Syslogging [Enable / Disable] [Enable]:

If logs size goes beyond 1gb, drop or overwrite messages? [drop / overwrite] [overwrite]:

Protocol for rsyslog connection [TLS / IPSEC] [TLS]:

Please enter rsyslog IP: 192.0.2.1

Please enter rsyslog port [514]: 4514

Enter CA cert file for Remote syslog server: <<CA_FILE_NAME>>

Please enter rsyslog server's Common Name(CN) or Subject Alternate Name(SAN): cisco-ova-00

Please enter the email IDs (comma separated) for mail alerts: [email protected]

Checking for CRL Distribution Points

No CRL URI found. Skipping CRL download.

Import Rsyslog CA Certificate successful

Remote Audit Logging = Enabled

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config audit

[cmxadmin@cmx]# cmxctl config audit settings

Enable or Disable Remote Syslogging [Enable / Disable] [Enable]:

If logs size goes beyond lgb, drop or overwrite messages? [drop / overwrite] [overwrite]:

Please enter rsyslog IP:

Please enter rsyslog port [514]:

Please enter rsyslog DNS name: yoursyslogserver.yourco.com

Please enter the email IDs (comma separated) for mail alerts: [email protected]

Follow the prompts to select what events you would like logged:

Please select the events to be logged

All Events [yes/no] [yes]:

Settings saved

Starting rsyslog service

If you enter yes , all events are logged. If no , answer the following prompts:

Enter day [today(1)/yesterday(2)/last week(3)/last month(4)/all(5)] [5]:

Enter event type [MGMT_EVENT(1)/CONN_EVENT(2)/AUTH_EVENT(3)/CONF_EVENT(4)/ALL(5) [5]:

Enter identity [root(1)/admin(2)/all(3)] [3]:

Enter status [success(1)/failure(2)/all(3) [3]:

• The command cmxctl config audit view prompts you to enter which types of logs you want to view.

Show all logs [yes/no] [yes]:

If you enter yes , all logged events are displayed. If no , answer the following prompts, or Enter to accept the default vaule.

Enter day [today(1)/yesterday(2)/last week(3)/last month(4)/all(5)] [5]:

Enter event type [MGMT_EVENT(1)/CONN_EVENT(2)/AUTH_EVENT(3)/CONF_EVENT(4)/ALL(5) [5]:

Enter identity [root(1)/admin(2)/all(3)] [3]:

Enter status [success(1)/failure(2)/all(3) [3]:

Examples

The following example shows how to enable remote system logging of all events:

[cmxadmin@cmx]# cmxctl config audit settings

Enable or Disable Remote Syslogging [Enable / Disable] [Enable]:

If logs size goes beyond lgb, drop or overwrite messages? [drop / overwrite] [overwrite]:

Please enter rsyslog IP: 168.172.1.20

Please enter rsyslog port [514]: 514

Please enter rsyslog DNS name: [email protected]

Please enter the email IDs (comma separated) for mail alerts: [email protected]

Remote Audit Logging = Enabled

Please select the events to be logged

All Events [yes/no] [yes]: yes

Settings saved

Restarting rsyslog service

Shutting down system logger: [OK]

Starting system logger: [OK]

The following example shows how to display all admin-level success status logs for the current day.

[cmxadmin@cmx]# cmxctl config audit view

Cisco CMX Command Reference Guide, Release 10.6.3

cmxctl config audit

Cisco CMX Commands

Show all logs [yes/no] [yes]: no

Enter day [today(1)/yesterday(2)/last week(3)/last month(4)/all(5)] [5]: 1

Enter event type [MGMT_EVENT(1)/CONN_EVENT(2)/AUTH_EVENT(3)/CONF_EVENT(4)/ALL(5) [5]: 5

Enter identity [root(1)/admin(2)/all(3)] [3]: 2

Enter status [success(1)/failure(2)/all(3) [3]: 1

CMX displays the selected logs.

The following example shows how to view the audit log status.

[cmxadmin@cmx]# cmxctl config audit status

Remote Audit Logging = Enabled

Remote Syslog Server IP = 10.20.1.10

Remote Syslog Server Port = 4514

Connection Protocol = TLS

The following example shows how to restart rsyslog service.

[cmxadmin@cmx]# cmxctl config audit restart rsyslog service restarted

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config auth

cmxctl config auth

To set strong CMX authentication requirements for passwords, logging in, and session timeout, use the cmxctl config auth settings command. To view these authentication settings, use the cmxctl config auth show command.

cmxctl config auth { settings | show }

Syntax Description settings show

Configures CMX authentication settings.

Displays CMX authentication settings.

Command Default

Command Modes

Command History

By default, strong authentication is not enabled.

CMX admin user

Release

Cisco CMX Release 10.6.2

Cisco CMX Release 10.6

Cisco CMX Release 10.5.0

Modification

This command was modified to set fail interval to 15 minutes when UCAPL mode is enabled. Added two new parameters: Maximum password lifetime and

Password Expiry Warning Period .

This command was modified to add the default values for FIPS and UCAPL.

This command was introduced.

Usage Guidelines

The command cmxctl config auth prompts you to set the appropriate values, according to your system authentication settings.

If Enable strong password is set to Yes , you can extend the password upto 127 characters. However, we recommend you to ensure that password should have minimum one lower case, one upper case, one digit and a special character.

Enable strong password [yes / no] [yes]:

Minimum password length [8-20] [8]:

Maximum password lifetime [1-9999] [9999]:

Password Expiry Warning Period [1-30] [14]:

Unsuccessful login attempts before account lock [3-5] [3]:

Fail interval in minutes [1-120] [15]:

Account lockout interval in minutes [1-120] [30]:

Session idle timeout in minutes [1-120] [30]:

• CMX authentication defaults with FIPS/UCAPL off:

Enable strong password: yes/no

Minimum password length: 8-20 characters

Maximum password lifetime: [1-9999]

Password Expiry Warning Period [1-30]

Unsuccessful login attempts before account lock: 3-5 attempts

Fail interval in minutes: [1-120]

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config auth

Set session timeout in minutes: 10-60 minutes

• CMX authentication defaults in FIPS mode:

Enable strong password [yes / no] [yes]:

Minimum password length [8-20] [8]:

Maximum password lifetime [1-9999] [9999]:

Password Expiry Warning Period [1-30] [14]:

Unsuccessful login attempts before account lock [3-5] [3]:

Account lockout interval in minutes [1-120] [30]:

Session idle timeout in minutes [1-120] [30]:

Restart services for the changes to take effect

• CMX authentication defaults in UCAPL mode:

Enable strong password [yes / no] [yes]:

Minimum password length [15-20] [15]:

Maximum password lifetime (in days): 60 days

Password Expiry Warning Period (in days): 7 days

Unsuccessful login attempts before account lock is set to 3 for UCAPL mode.

Fail interval in minutes [1-120] [15]:

Account lockout interval in minutes [1-120] [30]:

Session timeout is set to 15 minutes for UCAPL mode.

Enable Global session timeout (10 mins) for UCAPL mode [yes / no] [no]:

Global Session timeout set to: 15 minutes

Restart services for the changes to take effect

Note Fail interval is automatically set to 15 minutes when UCAPL mode is enabled.

Cisco CMX account will be locked if consecutive failed login attempts occur within the set fail interval period.

• CMX authentication defaults in UCAPL over FIPS mode:

Enable strong password: yes

Minimum password length: 15-20 characters

Unsuccessful login attempts before account lock: 3

Enable Global session timeout (10 mins) for Web UI: yes

Examples

The following example shows how to display security parameters for a FIPS-enabled CMX:

[cmxadmin@cmx]# cmxctl config auth show

Enable strong password : yes

Minimum password length : 8

Maximum password lifetime : 9999

Password Expiry Warning Period : 30

Unsuccessful login attempts before account lock : 3

Fail interval in minutes : 15

Account Lockout interval in minutes : 30

Session idle timeout in minutes : 30

Examples

The following example shows how to configure auth settings:

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config auth

[cmxadmin@cmx]# cmxctl config auth settings

Enable strong password [yes / no] [yes]: yes

Minimum password length [8-127] [8]: 8

Maximum password lifetime [1-9999] [9999]:9999

Password Expiry Warning Period [1-30] [14]:30

Unsuccessful login attempts before account lock [3-5] [3]: 3

Fail interval in minutes [1-120] [15]: 15

Account lockout interval in minutes [1-120] [30]: 30

Session idle timeout in minutes [1-720] [30]:

Restart services for the changes to take effect

The following example shows how to view the auth settings:

[cmxadmin@cmx]# cmxctl config auth show

Enable strong password : yes

Minimum password length : 8

Maximum password lifetime :9999

Password Expiry Warning Period :30

Unsuccessful login attempts before account lock : 3

Fail interval in minutes : 15

Account Lockout interval in minutes : 30

Session idle timeout in minutes : 30

Related Commands Command cmxctl config fips cmxctl config fips ucaplmode

Description

Enables FIPS mode, which requires strong authentication.

Enables UCAPL over FIPS mode, which requires strong authentication.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config authinfo get

cmxctl config authinfo get

To view the the SHA1 (keyHash) and SHA2(sha2KeyHash) strings, use the cmxctl config authinfo get command.

cmxctl config authinfo get

CMX admin user

Command Modes

Command History Release Modification

Cisco CMX Release 10.4

This command was introduced.

This command gets the authorization information for NMSP connections to the controllers.

Usage Guidelines

Example

The following example shows how to get the authorization information:

[cmxadmin@cmx]# cmxctl config authinfo get

+-------------------+------------------------------------------+------------------------------------------------------------------+

| macAddress | keyHashString | sha2KeyHashString

+-------------------+------------------------------------------+------------------------------------------------------------------+

| 00:0c:29:07:36:84 | e743ac54029ce36282c582f04bfb45ec187c824d |

560d69882adb90dda10227651da0c6a2850999620b50f83ed0d157fb87d1a920 |

+-------------------+------------------------------------------+------------------------------------------------------------------+

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config authserver

cmxctl config authserver

To add and manage external RADIUS authentication servers, use the cmxctl config authserver command.

cmxctl config authserver { delete | settings | show }

Syntax Description delete settings show

Removes an external RADIUS authentication server.

Adds and configures an external RADIUS authentication server.

Shows external server configuration.

Command Default

Command Modes

Command History

Usage Guidelines

External Remote Authentication Dial-In User Service (RADIUS) authentication server is not configured.

CMX admin user

Release

Cisco CMX Release

10.6.3

Modification

This command was introduced.

Before running this command, create a RADIUS user with information similar to the following example:

Table 2: Example of RADIUS authentication user

Entry

File name:

#Create user with User-Name =

Values

/usr/local/etc/raddb/users radiusUser radiusUser Cleartext-Password :=

Reply-Message =

"Cisco123"

"Hello, %{User-Name}"

The cmxctl config authserver settings command prompts you to configure the authentication server:

Enter external RADIUS authentication server host :

Enter RADIUS server shared secret key :

Configure local account. This account can be used if RADIUS server is not reachable.

Enter username :

Enter password :

Repeat for confirmation :

External RADIUS authentication server configured successfully.

Examples

The following example shows how to add an external RADIUS authentication server to CMX.

Note This example uses the values described in the Usage Guidelines.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config authserver

[cmxadmin@cmx]# cmxctl config authserver settings

Enter external RADIUS authentication server host : 168.192.28.114

Enter RADIUS server shared secret key : Cisco123

Configure local account. This account can be used if RADIUS server is not reachable.

Enter username : radiusUser

Enter password : Cisco123

Repeat for confirmation : Cisco123

External RADIUS authentication server configured successfully.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config banner

cmxctl config banner

To create and manage a banner that displays when users log into CMX, use the cmxctl config banner command.

cmxctl config banner { disable | edit | show }

Syntax Description disable edit show

Disable the login banner.

Edit the login banner text.

Display the login banner.

Command Default

Command Modes

Command History

By default, CMX has no login banner.

CMX admin user

Release

Cisco CMX Release 10.5.0

Cisco CMX Release 10.6

Modification

This command was introduced.

This command was modified to include disable keyword.

None

Usage Guidelines

Examples

The following example shows how to create the login banner “CentOS release 7.0.”

[cmxadmin@cmx]# cmxctl config banner edit

Current Login Banner = []

Enter text to be displayed as login banner. Enter a single period on a line to terminate.

CentOS release 7.0

When you log into the CLI, you would see something like this: login as: cmxadmin

CentOS release 7.0

[email protected]’s password:

Last login: 6/5/2018 1:10 PM

When you log into CMX from a browser, the banner message appears in a pop-up window on the login page.

The following example shows how to disable the login banner.

[cmxadmin@cmx]# cmxctl config banner disable

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config certs

cmxctl config certs

To create, import, or manage security key certificates, use the cmxctl config certs command.

cmxctl config certs { clear | clientcertvalidation { enable | disable } | creatcsr | importcacert filename.pem

| importcrl filename.pem | importcrlurl URL | importrsyslogca filename.pem |

importradiusca filename.pem | importservercert filename.pem | installnewcerts | keytype { RSA

| ECDSA } | show }

Syntax Description clear clientcertvalidation

Clears certificate files in the /opt/cmx/srv/certs directory.

When FIPS or UCAPL is enabled, configures CMX to validate all client certificates.

• Enable — requires every CMX user to have a client certificate.

• disable — does not check for client certificates.

createcsr

importcacert filename.pem

importcrl filename.pem

importcrlurl URL

importrsyslogca filename.pem

importradiusca filename.pem

importservercert filename.pem

Creates a new public and private keypair, and generates a corresponding Certificate Signing Request (CSR).

Imports a Certificate of Authority (CA) Privacy Enhanced Mail

(pem) file.

Imports a Certificate Revocation List (CRL) pem file.

Imports the URL of the CRL online, to keep the CRL current.

Imports a CA pem file for the remote syslog server.

Imports a CA pem file for the Radius/AAA server.

Imports the signed certificate and private key for the CMX server, concatenated into a single pem file.

Note When certificates are imported, there is a validity check that verifies the start date and end date. If the dates are not within the range or if the certificates are going to expire soon (withhin 30 days), an alert is generated on System > Alerts tab in Cisco CMX. The alert will be generated once a day until certificate expires or new valid certificate is installed.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config certs

Command Default

Command Modes

Command History installnewcerts keytype show

Generates new self-signed certificates.

Selects your encryption algorithm key type.

• RSA — Install the Rivest–Shamir–Adleman (RSA) encryption algorithm.

• ECDSA — Install the Elliptic Curve Digital Signature

Algorithm (ECDSA).

Displays certificate details.

By default, authentication certificates are not created, imported, or validated.

CMX admin user

Release

Cisco CMX Release10.6.2

Cisco CMX Release10.6

Cisco CMX Release 10.5.0

Modification

This command was modified to include importradiusca filename.pem keyword.

This command was modified to include clientcertvalidation , importcontrollerca , and importrsyslogca keywords.

This command was introduced.

Usage Guidelines

Note Certificates and keys are stored in the /opt/cmx/srv/certs folder.

Cisco recommends following this deployment order for cmxctl config certs commands.

1. cmxctl config certs clear — Optional, but recommended. Clears any certificates from the

/opt/cmx/srv/certs directory.

2. cmxctl config certs keytype — Selects your key type: RSA (the default) or ECDSA.

3. cmxctl config certs installnewcerts — Generates new self-signed certificates in the

/opt/cmx/srv/certs directory.

4. cmxctl config certs createcsr — Creates a Certificate Signing Request (CSR).

• Private key — /opt/cmx/srv/certs/ cmxserverkey.pem

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config certs

• CSR — /opt/cmx/srv/certs/ cmxservercsr.pem

Send the CSR to an external CA, to obtain a signed certificate for the CMX server.

6. cmxctl config certs importcacert — Installs the CA certifications. At the prompt, provide an export and import password specific to this command.

7. cmxctl config certs importservercert — Installs the CA-signed server certificate and the private key as a concatenated pem file. At the prompt, provide an export and import password specific to this command.

The command cmxctl config certs clientcertvalidation enable prompts you to answer whether or not you want CMX to accept invalid client certificates.

Do you want to accept invalid client certificate? [yes/no] [no]:

• no —Enables client certificate validation, and will not accept invalid client certificates.

• yes —Enables client certificate validation, but will accept invalid client certificates.

Examples

The following example shows how to clear out old certificates from the /opt/cmx/srv/certs directory.

[cmxadmin@cmx]# cmxctl config certs clear

Clear Certificates

The following example shows how to select key type ECDSA:

[cmxadmin@cmx]# cmxctl config certs keytype

Please enter key type [RSA / ECDSA] [RSA]:ECDSA

Keytype is set to ECDSA.

The following example shows how to generate new self-signed certification files in the

/opt/cmx/srv/certs directory using an RSA key:

[cmxadmin@cmx]# cmxctl config certs installnewcerts

Keytype is RSA, generating RSA key with length 4096

Generating RSA private key, 4096 bit long modulus

.......................

...............................

e is 65537 (0x10001)

Generating RSA private key, 4096 bit long modulus

..............................................

..........................

e is 65537 (0x10001)

Signature ok subject=/C=US/ST=CA/L=San Jose/O=MSE/CN=ServerCrt

Getting CA Private Key

Certificates are valid.

New self-signed certificates installed successfully.

To apply these certificate changes, CMX Services will be restarted now.

Please press Enter to continue.

The following example shows how to create a new certificate signing request (CSR):

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config certs

[cmxadmin@cmx]# cmxctl config certs createcsr

For SAN field of CSR, enter FQDN for CMXX server : servername.domain.com

Keytype is RSA, so generating RSA key with length 4096

Generating RSA private key, 4096 bit long modulus

...........

........

e is 65537 (0x10001)

You are about to be asked to enter information that will be incorporated into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]: US

State or Province Name (full name) [Some-State]: CA

Locality Name (eg, city) []: San Jose

Organization Name (eg, company) [Internet Widgits Pty Ltd]: Yourco, Inc.

Organizational Unit Name (eg, section) []: Gulag 10

Common Name (e.g. server FQDN or YOUR name) [servername.domain.com]: wirelesstestserver.domain.com

Email Address []: [email protected]

Please enter the following 'extra' attributes to be sent with your certificate request

A challenge password []:

An optional company name []:

The CSR is in: /opt/cmx/srv/certs

The Private key is in: /opt/cmx/srv/certs

CSR created successfully.

Sometimes two or more files need to be combined (or concatenated ) before you can import the resulting file. For example, you may have intermediate CA certificates as well as root certs. This example shows how to concatenate the files root-ca-cert.pem and intermediate-ca-cert.pem, and import the resulting file to CMX.

Concatenate the files:

[cmxadmin@cmx]# cat root-ca-cert.pem intermediate-ca-cert.pem > ca-chain.pem

Import the new file ca-chain.pem

[cmxadmin@cmx]# cmxctl config certs importcacerts ca-chain.pem

Importing CA certificate.....

Enter Export Password: caexportpw

Verifying - Enter Export Password: caexportpw

Enter Import Password: caimportpw

Import CA Certificate successful

The importservercert command requires you to combine the server key and the server certificate into one pem file. The following example shows how to combine the files and import the resulting file.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config certs

Note Import CA chain certificates before importing the server certificate.

Concatenate the files:

[cmxadmin@cmx]# cat cmxserverkey.pem signed-cert.pem > server-key-cert.pem

Import the new file server-key-cert.pem

[cmxadmin@cmx]# cmxctl config certs importservercerts server-key-cert.pem

Importing Server certificate.....

Successfully transferred the file

At the prompts, provide an export and import password specific to this command.

Enter Export Password: svrexportpw

Verifying - Enter Export Password: svrexportpw

Enter Import Password: svrimportpw

Private key present in the file: /home/cmxadmin/server-key-cert.pem

Enter Import Password: svrimportpw

No CRL URI found. Skipping CRL download.

Validation of server certificate is successful

Import Server Certificate successful

Restart CMX services for the changes to take effect.

Server certificate imported successfully.

To apply these certificate changes, CMX Services will be restarted now.

Please press Enter to continue.

The following example shows how to display the details of the server certificate and all CA chain certificates:

[cmxadmin@cmx]# cmxctl config certs show

Certificate details

************************* Certificate Listing ********************

====================================================================

*********************** UMLC CA Certificate(s) ************************

====================================================================

Certificate:

Data:

Version: 3 (0x2)

Serial Number: b6:c0:fc:05:f6:27:45:1a

Signature Algorithm: sha256WithRSAEncryption

Issuer: C=US, ST=CA, L=San Jose, O=MSE, CN=RootCA

Validity

Not Before: Jan 19 05:17:33 2018 GMT

Not After : Jan 18 05:17:33 2021 GMT

Subject: C=US, ST=CA, L=San Jose, O=MSE, CN=RootCA

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

Public-Key: (4096 bit)

Modulus:

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config certs

00:ba:f2:2b:cd:87:90:23:f0:64:f5:83:d5:f2:90:

43:1a:16:36:c9:67:1a:82:f1:8f:6b:eb:1c:47:f1: c4:fd:bf:55:98:ab:06:c0:90:dc:d7:13:1f:d3:2f:

12:e8:f2:74:66:65:7c:49:12:72:0c:27:9c:2e:84:

7e:29:a8:b6:18:62:5f:c2:97:a4:1c:e7:45:a2:cb: f3:35:f3:64:15:e5:f0:27:6f:f1:07:61:41:9b:4c:

96:b3:56:d4:28:a4:85:90:86:52:4c:04:bc:da:38: cc:f8:05:5b:3e:5c:03:b4:59:ec:8b:c9:5d:eb:61:

76:ba:20:3f:64:6c:25:5d:50:1e:85:37:ad:09:b2:

4a:fa:58:15:89:91:d9:5f:b8:9d:dd:64:31:8b:a4: df:99:ff:ae:72:19:f8:a3:93:81:b9:4e:07:74:74:

95:b6:42:7b:5a:7d:38:92:4a:f4:86:5a:54:66:f0: c1:fe:38:31:df:24:1c:40:94:36:67:8b:b3:56:93:

62:26:29:c2:cd:7f:7d:66:9d:f1:78:54:88:4f:6c: b3:b7:80:54:05:03:09:c9:f9:14:65:8a:21:00:b5:

Related Commands Command cmxctl config fips cmxctl config fips ucaplmode

Description

Enables FIPS mode, which requires these certificates.

Enables UCAPL over FIPS mode, which requires these certificates.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config controllers

cmxctl config controllers

To manage Cisco Wireless Controllers (Cisco WLC), use the cmxctl config controllers command.

cmxctl config controllers { activeaps | add | delete | floors wlc-ip-address | import | missingaps | show }

Syntax Description activeaps add delete

floors wlc-ip-address import missingaps show

Displays active access points.

Adds a Cisco WLC.

Deletes a Cisco WLC.

Displays floors managed by Cisco WLCs.

Imports a Cisco WLC from Cisco Prime Infrastructure by providing the corresponding credentials, or by placing an exported Cisco Prime Infrastructure MAP file in the /opt directory of the Cisco CMX server and providing the path to the exported MAP file.

Lists the access points from which Cisco CMX has received data, but the access points are not yet placed on a map.

Displays information pertaining to a Cisco WLC.

Command Default

Command Modes

Command History

Usage Guidelines

None.

CMX admin user

Release Modification

Cisco CMX Release 10.3.1

The missingaps and floors keywords were added.

Cisco CMX Release 10.3.0

This command was introduced.

The message "controller added successfully" after a Cisco WLC is added, refers only to the correct parsing of the command. You should issue a cmxctl controllers show command to ensure that the Cisco WLC is not active.

The missingaps keyword uses SNMP to retrieve the AP's MAC addresses from the access point’s configuration cache every six hours. If the AP MAC address is not present, it will be displayed as

NA on the CLI.

In addition, the AP MAC address will be displayed only if you have enabled the configuration.apimport

feature flag by using the cmxctl config featureflags configuration.apimport: true command. For example:

[cmxadmin@server]# cmxctl config featureflags configuration.apimport true

+---------------------------------+-------+

| location.compactlocationhistory | false |

+---------------------------------+-------+

| configuration.apimport

| true |

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config controllers

The AP MAC address import occurs every 6 hours, so for new APs added to the controller, the AP MAC value for missingap will be available only after the next job run.

Examples

Starting from Cisco CMX Release 10.3.1, you can specify SNMP settings when you use the cmxctl config controllers add command. For example:

[cmxadmin@cmx]# cmxctl config controllers add

Please enter controller type [WLC / NGWC] [WLC]: WLC

Please enter controller ip: 0.0.0.0

Please enter the controller version [Optional]:

Please enter controller SNMP version [v1 / v2c / v3] [v2c]: v2c

Please enter controller SNMP write community [private]:

....................................................................

Controller Added 0.0.0.0

The following example shows how to display the Cisco WLC information:

[cmxadmin@cmx]# cmxctl config controllers show

+--------------+------+------------+----------------+------+--------+

+--------------+------+------------+----------------+------+--------+

| 30.30.30.65 | WLC | 8.0.72.141 | - | No | ACTIVE |

+--------------+------+------------+----------------+------+--------+

| 30.30.30.44 | WLC | 8.0.72.141 | - | No | ACTIVE |

+--------------+------+------------+----------------+------+--------+

| 30.30.30.46 | WLC | 8.0.72.141 | - | No | ACTIVE |

+--------------+------+------------+----------------+------+--------+

| 30.30.30.70 | WLC | 8.0.72.141 | - | No | ACTIVE |

+--------------+------+------------+----------------+------+--------+

| 30.30.30.93 | WLC | 8.0.72.141 | - | No | ACTIVE |

+--------------+------+------------+----------------+------+--------+

| 30.30.30.97 | WLC | 8.0.72.141 | - | No | ACTIVE |

+--------------+------+------------+----------------+------+--------+

| 30.30.30.35 | WLC | 8.0.72.141 | - | No | ACTIVE |

+--------------+------+------------+----------------+------+--------+

| 30.30.30.58 | WLC | 8.0.72.141 | - | No | ACTIVE |

+--------------+------+------------+----------------+------+--------+

| 30.30.30.82 | WLC | 8.0.72.141 | - | No | ACTIVE |

+--------------+------+------------+----------------+------+--------+

| 30.30.30.84 | WLC | 8.0.72.141 | - | No | ACTIVE |

+--------------+------+------------+----------------+------+--------+

| 30.30.30.53 | WLC | 8.0.72.141 | - | No | ACTIVE |

+--------------+------+------------+----------------+------+--------+

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config data

cmxctl config data

To manage history data, use the cmxctl config data command.

cmxctl config data deleteAll

Syntax Description deleteALL Deletes all client history and analytics raw data.

Command Default

Command Modes

Command History

None.

CMX admin user

Release

Cisco CMX Release

10.5

Modification

This command was introduced.

Example

This example shows how to delete client history and raw analytics data.

[cmxadmin@cmx]# cmxctl config data deleteAll

Do you wish to continue? All client history data, analytics data will be deleted and CMX services will be restarted. [y/N]: y

Stopping all the services

All the Application services are stopped

Data Deletion Began

Deleting All Analytics Raw Visits Data

Deleting All Clients History Data

Starting all the services

All the Application services are restarted

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config devicelimitalert

cmxctl config devicelimitalert

To manage percent setting at which warning alert is generated for unique device count on Cisco CMX, use the cmxctl config devicelimitalert command.

cmxctl config devicelimitalert { getalertpercent | setalertpercent percent }

Syntax Description getalertpercent Displays the current percent setting after which warning alert is generated for Unique

Device Count on Cisco CMX.

setalertpercent Sets a percentage limit for Unique Device Count warning alert on Cisco CMX.

percent Enter the percent settings after which a warning alert is generated for Unique Device

Count on Cisco CMX. Percent value can be between 1-99. The default value is 90%.

Command Default

Command Modes

Command History

Usage Guidelines

None.

CMX admin user

Release Modification

Cisco CMX Release 10.6.2

This command was introduced.

This command should be run at the cmxadmin level.

Example

The following example shows how to set percent setting after which a warning alert is generated for

Unique Device Count on Cisco CMX:

[cmxadmin@cmx]# cmxctl config devicelimitalert setalertpercent

Percent after which Unique Device Alert gets generated [1-99] [90]: 50

Changed the Warning Alert Percent Setting for Device Count Successfully

Example

The following example shows how to display the percent setting for Unique Device Count warning alert on Cisco CMX:

[cmxadmin@cmx]# cmxctl config devicelimitalert getalertpercent

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config featureflags

cmxctl config featureflags

To list and toggle feature flags, use the cmxctl config featureflags command.

cmxctl config featureflags { feature name } { true | false }

Syntax Description service.featurename

Name of the Cisco CMX service and feature.

• location.compactlocationhistory

• configuration.oi.host

• configuration.apimport

• location.ssidfilterpersistblockedmacs

• location.rogueapclienthistory

• location.filteredssidscleanupatmidnight

• nmsplb.cmxgrouping

• monit

• container.influxdbreporter

• nmsplb.autolearnssids

• configuration.highendbypass

• apiserver.enabled

• location.computelocthroughassociatedap

• analytics.queuetime

true false

Enables the feature of the service.

Disables the feature of the service

Command Default

Command Modes

Command History

None

CMX admin user

Release Modification

Cisco CMX Release 10.6.2

This command was modified to add more location feature names.

Cisco CMX Release 10.2.2

This command was changed. The display default for analytics.sma was changed to false.

Cisco CMX Release 10.2.0

This command was introduced.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands

Example

The following example shows how to list the feature flags:

[cmxadmin@cmx]# cmxctl config featureflags

+-----------------------------------------+-------+

| location.compactlocationhistory

| false |

+-----------------------------------------+-------+

| configuration.oi.host

| true |

+-----------------------------------------+-------+

| configuration.apimport

| false |

+-----------------------------------------+-------+

| location.ssidfilterpersistblockedmacs

| false |

+-----------------------------------------+-------+

| location.rogueapclienthistory

| false |

+-----------------------------------------+-------+

| location.filteredssidscleanupatmidnight | true |

+-----------------------------------------+-------+

| nmsplb.cmxgrouping

| false |

+-----------------------------------------+-------+

| monit | true |

+-----------------------------------------+-------+

| container.influxdbreporter

| true |

+-----------------------------------------+-------+

| nmsplb.autolearnssids

| true |

+-----------------------------------------+-------+

| configuration.highendbypass

| false |

+-----------------------------------------+-------+

| apiserver.enabled

| true |

+-----------------------------------------+-------+

| location.computelocthroughassociatedap

| false |

+-----------------------------------------+-------+

| analytics.queuetime

| false |

+-----------------------------------------+-------+ cmxctl config featureflags

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config fips

cmxctl config fips

To enable, verify, and manage Federal Information Processing Standards (FIPS) mode, use the cmxctl config fips command.

cmxctl config fips { enable | status | verify }

Syntax Description enable status verify

Enables FIPS mode.

Displays FIPS mode status.

Verifies that your CMX system is correctly configured to support FIPS mode.

Command Default

Command Modes

Command History

By default, FIPS mode is disabled.

CMX admin user

Release

Cisco CMX Release

10.6

Modification

This command was introduced.

Usage Guidelines

Cisco CMX supports the Federal Information Processing Standard 140-2 (FIPS 140-2). FIPS 140-2 is a standard published by the National Institute of Standards and Technology (NIST) and is used to accredit cryptographic modules in software components. The US Federal government requires that all IT products dealing with Sensitive, but Unclassified (SBU) information meet these standards. If your system needs to be

FIPS 140-2 compliant, you can enable FIPS. Once you do so, the system uses the cryptographic algorithms defined by the NIST for FIPS 140-2 for all encrypted communication between its internal and external components.

Note FIPS is a prerequisite to UCAPL mode. Enable and configure FIPS before running the cmxctl config fips ucapl command. See

cmxctl config fips ucaplmode, on page 37 .

Cisco recommends that you run these commands before enabling FIPS mode:

• cmxctl config certs...

—Removes old certificates and installs or imports new ones.

• cmxctl config audit settings —Configures CMX authentication settings.

• cmxctl config certs importrsyslogca <cert.pem> —Imports a CA pem file for the remote syslog server.

• cmxctl config fips verify —Checks to see if your system is correctly configured for FIPS.

Note Note that the command cmxctl config fips enable is irreversible. You cannot disable FIPS mode after you enable the FIPS mode.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config fips

The following example shows how to check that your CMX system is correctly configured to support

FIPS mode. In this example, the system lacks the strong password required for FIPS compliance.

[cmxadmin@cmx]# cmxctl config fips verify

+--------------------------------------+

| CA Certificate | True |

+--------------------------------------+

| Server Certificate | True |

+--------------------------------------+

| Server Key | True |

+--------------------------------------+

| Rsyslog CA Certificate | False|

+--------------------------------------+

Certificate Validation

+--------------------------------------+

| CA Cert Validation | True |

+--------------------------------------+

| Server Cert Validation | True |

+--------------------------------------+

| Client Cert Validation | True |

+--------------------------------------+

Security Configuration

+--------------------------------------+

| Strong Password | True |

+--------------------------------------+

| Security Parameters | True |

+--------------------------------------+

Audit Logging

+--------------------------------------+

| Audit Logging Status | False|

+--------------------------------------+

Related Commands Command cmxctl config auth cmxctl config certs

Description

Sets strong CMX authentication requirements, which are required for

FIPS and UCAPL modes.

Creates, imports, and manages security key certificates, which are necessary for FIPS and UCAPL modes.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config fips ipsecauth

cmxctl config fips ipsecauth

To enable and manage pre-shared key (PSK) authentication in Federal Information Processing Standards

(FIPS) mode, use the cmxctl config fips ipsecauth command.

cmxctl config fips ipsecauth { disablepsk | enablepsk | status }

Syntax Description ipsecauth disablepsk enablepsk status

Manages IPSec authentication.

Disables pre-shared key (PSK) authentication.

Enables PSK authentication.

Displays the current IPSec authorization type. The default is pubkey .

Command Default

Command Modes

Command History

By default, pre-shared key (PSK) authentication is disabled.

CMX admin user

Release

Cisco CMX Release

10.6

Modification

This command was introduced.

The following example shows how to enable pre-shared key (PSK) authentication.

[cmxadmin@cmx]# cmxctl config fips ipsecauth enablepsk

IPSec auth type changed to PSK.

IPSec is configured with PSK : U9u3Pr8agBoUQoP2bKtxtk555J1JxfNr

Configuring ipsec ....

In primary

Stopping strongSwan IPsec...

Starting strongSwan 5.6.2 IPsec [starter]...

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config fips ucaplmode

cmxctl config fips ucaplmode

To enable, view status, or disable compliance with the U.S. Department of Defense Unified Capabilities

Approved Products List (UCAPL) certification, use the cmxctl config fips ucaplmode command.

cmxctl config fips ucaplmode { enable | disable | status }

Syntax Description enable disable status

Enables UCAPL over FIPS mode.

Disables UCAPL over FIPS mode.

Displays UCAPL mode status.

Command Default

Command Modes

Command History

By default, UCAPL mode is disabled.

CMX admin user

Release

Cisco CMX Release 10.6

Modification

This command was introduced.

Usage Guidelines

UCAPL mode is a higher level of security than FIPS alone. Its purpose is to maintain a single consolidated list of products that have completed Interoperability and cybersecurity certification. Less secure protocols, such as HTTP, TLS ver. 1, and RSA 1024 are no longer supported. Once you have enabled FIPS mode, you have the option to enable UCAPL mode. UCAPL requires a 15-20 character password, and disk encryption, among other restrictions.

Once UCAPL mode is enabled, the following authentication changes are made, if they are not already specified:

• Enable strong password : yes

• Minimum password length : 15

• Unsuccessful login attempts before account lock : 3

• Session timeout in minutes : 10

The following example shows how to enable UCAPL over FIPS mode:

[cmxadmin@cmx]# cmxctl config fips ucaplmode enable

UCAPL mode enabled.

The CMX processes restart.

Related Commands Command cmxctl config audit cmxctl config auth

Description

Enables and manages audit logging, which is necessary for UCAPL mode.

Sets strong CMX authentication requirements, which are required for FIPS and

UCAPL modes.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config fips ucaplmode

Command cmxctl config certs cmxctl config fips cmxos encryptdisk

Description

Creates, imports, and manages security key certificates, which are necessary for

FIPS and UCAPL modes.

Enables FIPS mode, which is a prerequisite to enable UCAPL mode.

Enables post-installation disk encryption of the CMX /opt partition, which is a prerequisite to enable UCAPL mode.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config fips ucaplmode autobackup

cmxctl config fips ucaplmode autobackup

To enable or disable an automatic backup that will run when UCAPL mode is enabled, use the cmxctl config fips ucaplmode autobackup command.

Command Default

Command Modes

Command History cmxctl config fips ucaplmode autobackup

By default, the CMX automatic backup is disabled. The backup duration is weekly.

CMX admin user

Release

Cisco CMX Release

10.6

Modification

This command was introduced.

All auto-backups are run weekly, on the day and hour you select.

Usage Guidelines

Note You can configure the auto-backup without being in UCAPL mode, but it will not run until UCAPL mode is enabled.

The following example shows how to enable and configure an automatic backup for every Saturday night, while in UCAPL mode.

[cmxadmin@cmx]# cmxctl config fips ucaplmode autobackup

CMX Auto Backup is currently disabled.

Do you want to enable it ? (yes/no) [yes]: yes

CMX Auto Backup frequency is weekly.

Please select day and hour of the week to run the auto-backup.

Day of the week: [0=Sunday, 1=Monday ... 6=Saturday] [0]: 6

Hour of the day: [0-23] [2]: 10

CMX auto-backup is now enabled.

Redirecting to /bin/systemctl restart crond.service

auto-backup will execute every Saturday at 10:10 AM

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config fips ucaplmode logFileAccess

cmxctl config fips ucaplmode logFileAccess

To enable read/write access to configuration file, use the cmxctl config fips ucaplmode logFileAccess command.

Command Default

Command Modes

Command History cmxctl config fips ucaplmode logFileAccess

None.

CMX admin user

Release

Cisco CMX Release

10.6

Modification

This command was introduced.

The cmxctl config fips ucaplmode logFileAccess command prompts you to enable file access logging:

[cmxadmin@cmx]# cmxctl config fips ucaplmode logFileAccess

Enable File Access Logging [yes / no] [no]: yes

Restarting Audit Service

…

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config fips ucaplmode logHTTPHeaders

cmxctl config fips ucaplmode logHTTPHeaders

To enbale HTTP headers logging, use the cmxctl config fips ucaplmode logHTTPHeaders command.

Command Default

Command Modes

Command History cmxctl config fips ucaplmode logHTTPHeaders

None.

CMX admin user

Release

Cisco CMX Release

10.6

Modification

This command was introduced.

Usage Guidelines

We recommend that you enable this command only if needed. Note that this command can degrade the performance of the system due to the excessive logging. Disable this command when not needed.

The cmxctl config fips ucaplmode logHTTPHeaders command prompts you to enable file access logging:

[cmxadmin@cmx]# cmxctl config fips ucaplmode logHTTPHeaders

Enable HTTP Headers Logging [yes / no] [no]: yes

Restarting haproxy service

True

Done

The nodeagent service is currently running with PID: 4061

Attempting to restart Haproxy

....Service Haproxy has successfully restarted logHTTPHeaders is enabled.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config gateway

cmxctl config gateway

To change the gateway configuration for cloud beacon management, use the cmxctl config gateway command.

cmxctl config gateway { cmx_cloud_url URL | show }

Syntax Description cmx_cloud_url Configure the cloud URL for Beacon Management.

URL Enter the cloud URL for Beacon Management.

show Displays the cloud URL configured for Beacon Management.

Command Default

Command Modes

Command History

None

CMX admin user

Release

Cisco CMX Release

10.5

Modification

This command was introduced.

Examples

The following example shows how to display the gateway configuration for cloud beacon management:

[cmxadmin@cmx]# cmxctl config gateway show

CMX_CLOUD_SERVER: demo.com

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config get

cmxctl config get

To display configuration information for Cisco CMX services, use the cmxctl config get command.

cmxctl config get [{ analytics | cache_6378 | cache_6379 | cache_6380 | cache_6381 | cache_6382

| hyperlocation | location | matlabengine | metrics | nmsplb }]

Syntax Description analytics Performs analytics on calculated location data.

agent Manages Cisco CMX system lifecycle. Starts, stops, and monitors all the services running in

Cisco CMX.

cache_6378 Caches the service used by location service.

cache_6379 Caches the service used by location service.

cache_6380 Caches the service used by analytics service.

cache_6381 Caches the service used by analytics service.

cache_6382 Caches the service used by analytics service.

cache_6383 Caches the service used by analytics service.

cache_6385 Caches the service used by analytics service.

cassandra Displays the cassandra database service used by the location service for historical data.

configuration Configures nodes and clusters.

connect database

Displays the connect services.

Displays the database service used by analytics and configuration service.

haproxy Displays the TCP or HTTP load balancer gateway to all service APIs.

hyperlocation Displays hyperlocation configuration.

location Displays location service to compute location.

matlabengine Provides access point heatmap for location service.

metrics nmsplb

Collects system metrics.

Displays the load balancer service used for distributing Network Mobility Services Protocol

(NMSP) messages to location services.

Command Default

Command Modes

The default command cmxctl config get displays configuration information for all supported services when executed without options.

CMX admin user

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config get

Command History Release

Cisco CMX Release 10.5

Modification

Additional services were documented.

Cisco CMX Release 10.3.0

This command was introduced.

Examples

The following example shows how to display configuration information for the CMX analytics service.

[cmxadmin@cmx]# cmxctl config get analytics

{

"services": {

"analytics": {

"maxdirectmemory": "1536M",

"maxnewsize": "400M",

"mem": "1536M"

}

Optionally, you can filter the results by using one of the listed configuration keywords. For example:

[cmxadmin@cmx]# cmxctl config get cassandra

{

"services": {

"cassandra": {

"keycachesize": "100",

"maxnewsize": "800M",

"mem": "4096M"

}

[root@server]$ cmxctl config get cassandra maxnewsize

{"maxnewsize": "800M"}

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config heatmaps summary

cmxctl config heatmaps summary

To show the details of the heapmap from the location service, use the cmxctl config heatmaps summary command.

Command Default

Command Modes

Command History cmxctl config heatmaps summary

None.

CMX admin user

Release Modification

Cisco CMX Release 10.4

This command was introduced.

This command should be run at the cmxadmin level.

Usage Guidelines

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config hyperlocation mixmode

cmxctl config hyperlocation mixmode

To manage mixed mode for hyperlocation for a specified floor, use the cmxctl config hyperlocation mixmode command.

cmxctl config hyperlocation mixmode Floor ID { enable | disable }

Syntax Description Floor ID Provides the specific floor ID.

enable Enables mixed mode support for hyperlocation for the specified floor.

disable Disables mixed mode support for hyperlocation for the specified floor.

Command Default

Command Modes

Command History

Usage Guidelines

None

CMX admin user

Release Modification

Cisco CMX Release 10.4

This command was introduced.

We recommened that you use this command in a scenario where on a single floor there are both Hyperlocation enabled AP and non Hyperlocation APs. The improved location accuracy that comes from the use of

Hyperlocation AP will occur within the convex hull of the Hyperlocation APs. Outside of this convex, standard location accuracy results will occur. At the edges of the convex hull there may also be lower accuracy, when clients are at least 10M inside of the convex hull.

This command does not support the interspersion of Hyperlocation AP with non Hyperlocation AP. If this is type of deployment is used, then there will be no improvement in location over standard probe RSSI based location.

The following is an example of a supported deployment:

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands

Figure 1: Supported Hyperlocation Mixed Mode Deployment cmxctl config hyperlocation mixmode

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config import

cmxctl config import

To import a map and Cisco Catalyst 9800 Wireless Controller from Cisco Prime Infrastructure, use the cmxctl config import command.

cmxctl config import { prime | status }

Syntax Description prime Imports maps from Cisco Prime Infrastructure.

status Shows import status.

Command Default

Command Modes

None.

CMX admin user

Examples

The following example shows how to import a map and controller from Cisco Prime Infrastructure:

[cmxadmin@cmx]# cmxctl config import prime

Please enter PI ip address: x.x.x.x

Please enter PI username [root]: root

Please enter PI password [Public123]:

Import successfully started from PI x.x.x.x. Check import status using cmxctl config import status.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config ipsec

cmxctl config ipsec

To manage IP security (IPSec) protocol, use the cmxctl config ipsec command.

cmxctl config ipsec { authtype | disable | enable | restart | start | status | stop }

Syntax Description authtype Changes IPSec authentication type.

disable Disables IPSec protocol.

enable restart start status stop

Enables IPSec protocol.

Restarts IPSec tunnel.

Starts IPSec tunnel.

Shows IPSec status.

Stops IPSec status.

Command Default

Command Modes

Command History

Usage Guidelines

None.

CMX admin user

Release

Cisco CMX Release

10.6.1

Modification

This command was introduced.

The default authentication type for IPSec is “PUBKEY”/Public Key. It is set when you run the cmxctl config ipsec enable command.

Example

The following example shows how to enable IPSec:

[cmxadmin@cmx]# cmxctl config ipsec enable

Do you want to enable IPSec? (y/n) [n]: y

IPSec is enabled and Authtype set to PUBKEY

Configuring ipsec ....

In primary

Stopping strongSwan IPsec failed: starter is not running

Starting strongSwan 5.6.2 IPsec [starter]...

IPSEC tunnel establised successfully with 192.0.2.1

The following example shows how to display the status of the IPSec service:

[cmxadmin@cmx]# cmxctl config ipsec status

IPSec is enabled

IPSec Authentication Type = Public Key (Certificate)

Security Associations (1 up, 0 connecting): rsyslog[2]: ESTABLISHED 18 seconds ago,

192.0.2.1[cisco-cmx-ova-30]...192.0.2.3[cisco-cmx-ova-32]

Cisco CMX Command Reference Guide, Release 10.6.3

cmxctl config ipsec

Cisco CMX Commands rsyslog{2}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: c549935a_i c02aee35_o rsyslog{2}: 192.0.2.1/32 === 192.0.2.3/32

The following example shows how to change the authentication type:

[cmxadmin@cmx]# cmxctl config ipsec authtype

Current IPSec Auth Type = PUBKEY

Do you want to change it? (y/n) [n]: y

Select IPSec Auth Type: (PUBKEY/PSK) [PUBKEY]: PSK

IPSec auth type changed to PSK.

IPSec is configured with PSK : nIXRjNrMiNzcKj7yVZ0Nod5IzxUyO9XZ

Configuring ipsec ....

In primary

Stopping strongSwan IPsec...

Starting strongSwan 5.6.2 IPsec [starter]...

Failed to establish IPSEC tunnel with 192.0.2.3 (cisco-cmx-ova-32)

The following example shows how to restart the IPSec service:

[cmxadmin@cmx]# cmxctl config ipsec restart

Starting IPSec tunnel ...

Stopping strongSwan IPsec...

Starting strongSwan 5.6.2 IPsec [starter]...

establishing CHILD_SA rsyslog{2} generating CREATE_CHILD_SA request 2 [ N(USE_TRANSP) SA No TSi TSr ] sending packet: from 192.0.2.1[500] to 192.0.2.3[500] (272 bytes) received packet: from 192.0.2.3[500] to 192.0.2.1[500] (208 bytes) parsed CREATE_CHILD_SA response 2 [ N(USE_TRANSP) SA No TSi TSr ]

CHILD_SA rsyslog{2} established with SPIs c8553144_i c727bbd3_o and TS 10.30.114.175/32 ===

10.30.114.177/32 connection 'rsyslog' established successfully

IPSec tunnel established successfully

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config loginrate

cmxctl config loginrate

To configure login rate limit, use the cmxctl config loginrate command.

cmxctl config loginrate { disable | enable | resetall | resetuserusername | status }

Syntax Description disable enable

Disables login rate limit.

Enables login rate limit.

resetall status

Resets login rate details for all the users.

resetuser username Resets login rate details for a specific user.

Displays the login rate status as enabled or disabled.

Command Default

Command Modes

Command History

None.

CMX admin user

Release

Cisco CMX Release

10.6.1

Modification

This command was introduced.

Example

The following example shows how to enable login rate limit:

[cmxadmin@cmx]# cmxctl config loginrate enable

Enter the allowed number of login failure for a user per source ip [3]: 3

Enter the number of source IPs for which login failure is to be maintained [3]: 3

Enter the total allowed number of login failure for a user [10]: 10

The following example shows how to disable login rate limit:

[cmxadmin@cmx]# cmxctl config loginrate disable

The following example shows how to reset login rate limit for a specific user:

[cmxadmin@cmx]# cmxctl config loginrate reset admin

The user details have been reset.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config manageacl

cmxctl config manageacl

To manage CMX access control lists (ACLs), use the cmxctl config manageacl command.

cmxctl config manageacl { add | disable | enable | status }

Syntax Description add disable enable status

Adds an access control list.

Disables ACL authentication.

Enables ACL authentication.

Displays access control list status information.

Command Default

Command Modes

Command History

By default, access control lists are disabled.

CMX admin user

Release

Cisco CMX Release

10.6

Modification

This command was introduced.

Usage Guidelines

When ACLs are enabled, only the servers added in the ACL will be allowed to access CMX through SSH or

HTTPS.

The following example shows how to enable access control lists, and add servers to the ACL.

[cmxadmin@cmx]# cmxctl config manageacl enable

[cmxadmin@cmx]# cmxctl config manageacl add inside aclAdd.

Enter the ip address to be added in the ACL: 168.172.12.18

Do you want to add more ip address in the ACL [Y/n]: Y

Enter the ip address to be added in the ACL: 172.19.35.122

Do you want to add more ip address in the ACL [Y/n]: n

The following example shows how to display access control list status information.

[cmxadmin@cmx]# cmxctl config manageacl status

ACL is enabled

The following ip addresses are allowed to access the CMX box.

Use add command to add the ipaddresses if the list is empty.

168.172.10.10

168.172.10.57

168.172.12.18

168.172.35.122

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config maps address

cmxctl config maps address

To set a directory path to an optional map address file, use the cmxctl config maps address command.

cmxctl config maps address --path filepath

Syntax Description --path filepath

Sets the directory path to an optional map address file. See Usage Guidelines for more information.

Command Default

Command Modes

Usage Guidelines

None.

CMX admin user

Use the cmxctl config maps address command to access an optional map address file that you can associate with a map. This is not a necessary step for maps you create in CMX and PI, but you may have a map from another source that requires a valid address.

Note The first entry in each line of the map address file should be the fully-qualified name and address in

Campus>Building format. For example:

My Campus>My Building, 123 Road St, San Jose CA 95137

Command History Release

Cisco CMX Release 10.5

Cisco CMX Release 10.3.0

Modification

Additional keywords were documented.

This command was introduced.

Examples

The following example shows how to set the path to a map address file, which you can then associate with a map.

[cmxadmin@cmx]# cmxctl config maps address --path /home/cmxadmin/campusPath.csv

cmxctl config maps address --path /home/cmxadmin/campusPath.csv

Now importing address for: North Campus>Building 9

Done importing addresses

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config maps aplist

cmxctl config maps aplist

To display a list of access points (APs) and their status for a specified floor, use the cmxctl config maps aplist command.

cmxctl config maps aplist [{ --active | --inactive }] floorID

Syntax Description --active Optional. Display only the active access points (APs) on the specified floor.

--inactive Optional. Display only the inactive access points (APs) on the specified floor.

floorID The identifying number for the floor. Use the cmxctl config maps floors command to see the

Floor ID.

Command Default

Command Modes

Usage Guidelines

Command History

All access points display for the designated floor.

CMX admin user

To see all the APs on a floor, use the cmxctl config maps aplist command without additional arguments.

To get the Floor ID for a CMX floor map, use the cmxctl config maps floors command.

Release

Cisco CMX Release 10.5

Modification

Additional keywords were documented.

Cisco CMX Release 10.3.0

This command was introduced.

Examples

The following example shows how to list all the APs on the Registration Floor of Bld-4.

First, use the cmxctl config maps floors command to get the Location Floor ID for the floor you want to view:

[cmxadmin@cmx]# cmxctl config maps floors

+------------------------------------+--------------------+--------------------+

| Floor Name | Location Floor ID | Analytics Floor ID |

+------------------------------------+--------------------+--------------------+

| North Campus>Bld-4>Registration | 727035700041482593 | 35 |

+------------------------------------+--------------------+--------------------+

Now run the cmxctl config maps aplist command, and paste in the Floor ID:

[cmxadmin@cmx]# cmxctl config maps aplist 72703570082593

+---------------+-------------------+-------------------+----------------+----------+

+---------------+-------------------+-------------------+----------------+----------+

+---------------+-------------------+-------------------+----------------+----------+

+---------------+-------------------+-------------------+----------------+----------+

| CMX-AP02-7071 | 40:01:7a:b2:c8:86 | 70:70:8b:06:1d:e0 | 72703570082593 | ACTIVE |

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config maps aplist

+---------------+-------------------+-------------------+----------------+----------+

+---------------+-------------------+-------------------+----------------+----------+

| CMX-AP03-7073 | 40:01:7a:b2:c7:92 | 70:70:8b:06:19:20 | 72703570082593 | ACTIVE |

+---------------+-------------------+-------------------+----------------+----------+

| CMX-AP04-7074 | 4c:77:6d:9e:61:04 | 70:69:5a:51:48:e0 | 72703570082593 | ACTIVE |

+---------------+-------------------+-------------------+----------------+----------+

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config maps buildings

cmxctl config maps buildings

To see a list of buildings for a CMX Campus or for all buildings, use the cmxctl config maps buildings command.

cmxctl config maps buildings [{ --campus campusname | --csv }]

Syntax Description --campus Optional. Restricts the list of buildings to a particular campus.

campusname The name of the campus you would like to include.

--csv Optional. Displays the results in comma-separated values (CSV) format, which can be cut and pasted into a spreadsheet.

Command Default

Command Modes

Command History

Running the command without arguments will display all buildings on all campuses.

CMX admin user

Release

Cisco CMX Release 10.5

Modification

Additional keywords were documented.

Cisco CMX Release 10.3.0

This command was introduced.

Usage Guidelines

Command options must follow the last command keyword with a space and two dashes. For example:

[root@server]# command keyword

--option1 --option2 .

When you select the option --csv, the map information you specify is displayed in comma-separated values

(CSV) format, which can be cut and pasted into a spreadsheet.

Examples

The following example shows how to display a list of all buildings, in CSV format. The output format is Campus Name > Building Name , Location Building ID , Analytics Building ID .

[cmxadmin@cmx]# cmxctl config maps buildings --csv

System Campus>TMT,749980497668473090,18

System Campus>LCN,727001546461545854,16

System Campus>PCH,769481534004431937,15

North Campus>Newtech Building,732849996352089441,13

The following example shows how to display a list of building maps for North Campus:

[cmxadmin@cmx]# cmxctl config maps buildings --campus North Campus

+------------------------------+----------------------+-----------------------+

| Building Name | Location Building ID | Analytics Building ID |

+------------------------------+----------------------+-----------------------+

| North Campus>Newtech 1 | 727001546461544629 | 48 |

+------------------------------+----------------------+-----------------------+

| North Campus>Newtech 2 | 725930212039482938 | 49 |

+------------------------------+----------------------+-----------------------+

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config maps campuses

cmxctl config maps campuses

To see a list of your CMX Campuses, use the cmxctl config maps campuses command.

cmxctl config maps campuses [ --csv ]

Syntax Description --csv Optional. Displays the results in comma-separated values (CSV) format, which can be cut and pasted into a spreadsheet.

Command Default

Command Modes

Command History

Usage Guidelines

Running the command without arguments will display all campuses in table format.

CMX admin user

Release

Cisco CMX Release 10.5

Modification

Additional keywords were documented.

Cisco CMX Release 10.3.0

This command was introduced.

Command options must follow the last command keyword with a space and two dashes. For example:

[root@server]# command keyword

--option1 --option2 .

When you select the option --csv, the map information you specify is displayed in comma-separated values

(CSV) format, which can be cut and pasted into a spreadsheet.

Examples

The following example shows how to display a list of campus maps:

[cmxadmin@cmx]# cmxctl config maps campuses

+----------------+--------------------+---------------------+

| Campus Name | Location Campus ID | Analytics Campus ID |

+----------------+--------------------+---------------------+

| North Campus | 727001546461544473 | 14 |

+----------------+--------------------+---------------------+

| South Campus | 384920494820170003 | 15 |

+----------------+--------------------+---------------------+

If you want the campus map to be displayed in CSV format, add the --csv flag:

[cmxadmin@cmx]# cmxctl config maps campuses –-csv

North Campus,727001546461545275,14

South Campus,384920494820170003,15

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config maps delete

cmxctl config maps delete

To delete a map, or all maps in your CMX network, use the cmxctl config maps delete command.

cmxctl config maps delete [{ --name mapname | --all }]

Syntax Description --name

--all

Optional. Deletes a specific map.

mapname The name of the map you want to delete.

Optional. Deletes all CMX maps.

Command Default

Command Modes

Command History

The default for all delete options are not to confirm the delete.

CMX admin user

Release

Cisco CMX Release 10.5

Modification

Additional keywords were documented.

Cisco CMX Release 10.3.0

This command was introduced.

Usage Guidelines

For all cmxctl config maps delete command options, you are asked to confirm the deletion.

If you enter the cmxctl config maps delete command without optional flags, you are asked to provide the map heirarchy in campus-name>building-name>floor-name format.

Please enter the hierarchy to be deleted (campus-name>building-name>floor-name):

Example

This example shows how to delete the Newtech 1 Security floor in North Campus:

[cmxadmin@cmx]# cmxctl config maps delete

Please enter the hierarchy to be deleted (campus-name>building-name>floor-name):

North Campus>Newtech 1>Security map deleted.

This example shows how to delete the map named NorthCampus.

[cmxadmin@cmx]# cmxctl config maps delete --name NorthCampus

Confirm delete hierarchy: NorthCampus ? [y/N]: y

Map deleted.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config maps floors

cmxctl config maps floors

To list the floor maps in a selected campus, building, or all floors, use the cmxctl config maps floors command.

cmxctl config maps floors [ --campus mapname --building mapname --csv ]

Syntax Description --campus Optional. Restricts the list of floors to a particular campus.

mapname The name of the campus you would like to include.

--building Optional. Restricts the list of floors to a particular building.

mapname The name of the building you would like to include.

--csv Optional. Displays the results in comma-separated values (CSV) format, which can be cut and pasted into a spreadsheet.

Command Default

Command Modes

Usage Guidelines

Command History

None.

CMX admin user

Command options must follow the last command keyword with a space and two dashes. For example:

[cmxadmin@server]# command keywords

--option1 --option2 .

When you select the option --csv, the map information you specify is displayed in comma-separated values

(CSV) format, which can be cut and pasted into a spreadsheet.

Release

Cisco CMX Release 10.5

Modification

Additional keywords were documented.

Cisco CMX Release 10.3.0

This command was introduced.

Examples

The following example shows how to display a list of floor maps for North Campus, building A9:

[cmxadmin@cmx]# cmxctl config maps floors --campus North Campus --building A9

+----------------------------------+--------------------+--------------------+

| Floor Name | Location Floor ID | Analytics Floor ID |

+----------------------------------+--------------------+--------------------+

| North Campus>A9>Main Floor | 615446507270015464 | 16 |

+----------------------------------+--------------------+--------------------+

| North Campus>A9>Lab Floor | 727001546461544650 | 17 |

+----------------------------------+--------------------+--------------------+

| North Campus>A9>Offices Floor | 615447265700154640 | 18 |

+----------------------------------+--------------------+--------------------+

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config maps import

cmxctl config maps import

To import CMX location maps, use the cmxctl config maps import command.

cmxctl config maps import --type { PI | FILE } --path importpath --override { yes | no } --importzones { yes | no }

Syntax Description --type { PI | FILE } Identifies the source of the map you want to import.

• PI —Imports a Cisco Prime Infrastructure map.

• FILE —Imports a maps archive file.

--path importpath

--override { yes | no }

Designates the path to the map you want to import.

Resolves how the import should handle duplicate map names:

• yes —Overwrites any duplicate map names.

• no —Does not overwrite duplicate map names. See Usage Guidelines for more information.

--importzones { yes | no }

This option resolves how the import should handle duplicate zone names:

• yes —Overwrites any duplicate zone names.

• no —Does not overwrite duplicate zone names. See Usage Guidelines for more information.

Command Default

Command Modes

Usage Guidelines

None.

CMX admin user

• When CMX accepts your request to import a map from Cisco Prime Infrastructure, you are prompted to answer the following questions. The defaults are in

[brackets]

Please enter PI ip address:

Please enter PI username [root]:

Please enter PI password [Public123]:

• When the --override or --importzones options are set to yes, existing maps or zones with the same names will be overwritten by the import. If you select no, the import will fail if there are conflicting map or zone names. You will need to resolve the conflict by changing the name and importing it again.

• Starting from Cisco CMX Release 10.3.1, you must provide the full (absolute) path to the tar file when using the cmxctl config maps import command. For example:

/opt/cmx/srv/floormaps/ Importfile .tar.gz .

• Command options must follow the last command keyword with a space and two dashes. For example:

[cmxadmin@server]# command keyword

--option1 --option2 .

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config maps import

Command History Release

Cisco CMX Release 10.5

Modification

Additional keywords were documented.

Cisco CMX Release 10.3.1

The import keyword was modified.

Cisco CMX Release 10.3.0

This command was introduced.

Examples

The following example shows how to import a map, overwriting any existing maps or zones with the same name:

[cmxadmin@cmx]# cmxctl config maps import --type PI --path

/opt/Import_fdff5788ad650.tar.gz --override yes --importzones yes

Please enter PI ip address: 168.172.206.3

Please enter PI username [root]: root

Please enter PI password [Public123]: ********

Import successfully started from PI 168.172.206.3.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config maps reprocessimage

cmxctl config maps reprocessimage

When CMX floor map images occasionally become misaligned, use the cmxctl config maps reprocessimage command to realign them.

cmxctl config maps reprocessimage --imagename imagename

Syntax Description --imagename Identify the image needing reprocessing.

imagename The name of the image you would like to reprocess.

Command Default

Command Modes

Command History

Usage Guidelines

None.

CMX admin user

Release

Cisco CMX Release 10.5

Modification

Additional keywords were documented.

Cisco CMX Release 10.3.0

This command was introduced.

Sometimes maps can become misaligned. When this happens, the cmxctl config maps reprocess image command reprocesses the image and realigns the map.

The default folder path for CMX maps is /opt/cmx/srv/floormaps .

Example

The following example shows how to reprocess floor tile images when they become misaligned:

[cmxadmin@cmx]# cmxctl config maps reprocessimage --imagename domain_2_147753.png

File domain_2_147753.png exists in /opt/cmx/srv/floormaps. Proceeding...

Image processing job submitted for domain_2_147753.png.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config maps zones

cmxctl config maps zones

To list the floor maps in a selected campus, building, or all floors, use the cmxctl config maps floors command.

cmxctl config maps zones [ --campus mapname --building mapname --csv ]

Syntax Description --campus Optional. Restricts the list of floors to a particular campus.

mapname The name of the campus you would like to include.

--building Optional. Restricts the list of floors to a particular building.

mapname The name of the building you would like to include.

--csv Optional. Displays the results in comma-separated values (CSV) format, which can be cut and pasted into a spreadsheet.

Command Default

Command Modes

Usage Guidelines

Command History

All zones display when the command is run without options.

CMX admin user

Command options must follow the last command keyword with a space and two dashes. For example:

[root@server]# command keywords

--option1 --option2 .

When you select the option --csv, the map information you specify is displayed in comma-separated values

(CSV) format, which can be cut and pasted into a spreadsheet.

Release

Cisco CMX Release 10.5

Modification

Additional keywords were documented.

Cisco CMX Release 10.3.0

This command was introduced.

Examples

The following example shows how to display a list of zones for North Campus Bld-4:

[cmxadmin@cmx]# cmxctl config maps floors --campus North Campus building Bld-4

[cmxadmin@cmx]# cmxctl config maps zones

+------------------------------------+-----------+-------------------+

| Floor Name | Zone Name | Analytics Zone ID |

+------------------------------------+-----------+-------------------+

| North Campus>Bld-4>1st Floor | NOC | 376 |

+------------------------------------+-----------+-------------------+

| North Campus>Bld-4>1st Floor | School | 375 |

+------------------------------------+-----------+-------------------+

Cisco CMX Command Reference Guide, Release 10.6.3

cmxctl config qlesspyworker

cmxctl config qlesspyworker

To manage qlesspyworker, use the cmxctl config qlesspyworker command.

cmxctl config qlesspyworker cleanRedis

Syntax Description cleanRedis Removes stale and invalid qlesspyworker history data.

Command Default

Command Modes

Command History

None.

CMX admin user

Release

Cisco CMX Release

10.5

Modification

This command was introduced.

Example

[cmxadmin@cmx]# cmxctl config qlesspyworker cleanRedis

QlessHistoryCleanupTask started

Deleted 0 qless-job-history records that were idle for 1209600 seconds.

Found 0 SMA-job records, deleted all.

QlessHistoryCleanupTask completed

Cisco CMX Commands

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config reload

cmxctl config reload

To forcefully generate a configuration file, use the cmxctl config reload command.

cmxctl config reload

None

Command Default

Examples

The following example shows how to forcefully generate a configuration file:

[cmxadmin@cmx]# cmxctl config reload

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: WARNING Skipping confd config file.

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/analytics.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/cassandra/cassandra-env.sh in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/cassandra/cassandra.yaml in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/collectd.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/configuration.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/connect.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/halo.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/haproxy.cfg in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/influxdb.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/location.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/matlabengine.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/nmsplb.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/nmspproxy.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/postgresql.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/redis_6379.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/redis_6380.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: INFO Target config

/opt/cmx/etc/redis_6381.conf in sync

2015-03-10T17:45:50Z cmx-vmdev117 -verbose[17174]: ERROR template: redis.template.conf:15:20: executing "redis.template.conf" at <getv ($tag | printf ...>: error calling getv: key does not exist

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config rfid timeout

cmxctl config rfid timeout

To set the timeout for maintaining RFID tags in Cisco CMX, use the cmxctl config rfid timeout command.

cmxctl config rfid timeout { get | set value }

Syntax Description get Displays the timeout value.

set value Sets the timeout value that Cisco CMX maintains RFID tags before expiring them. The time range is 60 to 10800 seconds. The default value is 300 seconds.

Command Default

Command Modes

Command History

Usage Guidelines

None.

CMX admin user

Release Modification

Cisco CMX Release 10.3.1

This command was introduced.

We recommend that you set the RFID tag timeout value below 600 seconds. An ideal RFID tag timeout value is 300 seconds. The RFID timeout must be set to a range between 60 - 600 seconds irrespective of your longest

RFID tag's chirp interval.

Example

The following example shows how to set the timeout for RFID tags, and then verify the setting:

[cmxadmin@cmx]# cmxctl config rfid timeout set

Need to include a timeout within 60 to 10800 seconds

[cmxadmin@server]# cmxctl config rfid timeout set 300

[cmxadmin@server]# cmxctl config rfid timeout get

300 seconds

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config set

cmxctl config set

To set a config key for a Cisco CMX service, use the cmxctl config set command.

cmxctl config set { analytics | cache_6378 | cache_6379 | cache_6380 | cache_6381 | cache_6382

| hyperlocation | location | matlabengine | metrics | nmsplb }

Syntax Description analytics agent cache_6378 cache_6379 cache_6380 cache_6381 cache_6382 cache_6383 cache_6385 cassandra configuration connect database haproxy hyperlocation location matlabengine metrics nmsplb

Performs analytics on calculated location data.

Manages Cisco CMX system lifecycle. Starts, stops, and monitors all the services running in Cisco CMX.

Caches the service used by location service.

Caches the service used by analytics service.

Enables cassandra database service used by the location service for historical data.

Configures nodes and clusters.

Enables connect services.

Enables the database service used by analytics and configuration service.

Enables the TCP or HTTP load balancer gateway to all service APIs.

Enables hyperlocation.

Enables location service to compute location.

Provides access point heatmap for location service.

Collects system metrics.

Enables the load balancer service used for distributing

Network Mobility Services Protocol (NMSP) messages to location services.

Cisco CMX Command Reference Guide, Release 10.6.3

cmxctl config set

Command Default

Command Modes

Command History

None.

CMX admin user

Release

Cisco CMX Release

10.5

Cisco CMX Release

10.4

Modification

Additional options were documented.

This command was introduced.

Example

This example shows how to generate a key for the service location .

[cmxadmin@cmx]# cmxctl config set location key 2512

{"key": "2512"}

Change will take effect on service restart.

Restart the service.

[cmxadmin@cmx]# cmxctl restart location

Done

The nodeagent service is currently running with PID: 3299

Attempting to restart Location

............

Service Location has successfully restarted

To verify the key, use the cmxctl config get location command:

[cmxadmin@cmx]# cmxctl config get location

{

"services": {

"location": {

"key": "2512",

"maxdirectmemory": "1536M",

"maxnewsize": "800M",

"mem": "6144M"

}

Cisco CMX Commands

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config smartlicense enable

cmxctl config smartlicense enable

To enable Smart License in Cisco CMX, use the cmxctl config smartlicense enable command.

Syntax Description

Command Default

Command Modes

Command History cmxctl config smartlicense enable

This command has no arguments or keywords.

None.

CMX admin user

Release

Cisco CMX Release

10.6.3

Modification

This command was introduced.

Usage Guidelines

Examples

A Cisco Smart account is mandatory to enable smart license. Once enabled, you cannot disable smart license.

The following example shows how to enable smart license:

[cmxadmin@server]# cmxctl config smartlicense enable

Once Smart License is Enabled, It cannot be disabled ! ! !

To use Smart License, you must first setup a Cisco Smart Account

Prerequisite: Please make sure you have smart account enabled before proceeding.

Do you want to Enable Smart License [yes/no] ? [yes] :

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config smartlicense register

cmxctl config smartlicense register

To register Cisco CMX product instance with smart acccount, use the cmxctl config smartlicense register command.

Syntax Description

Command Default

Command Modes

Command History cmxctl config smartlicense register

This command has no arguments or keywords.

None.

CMX admin user

Release

Cisco CMX Release

10.6.3

Modification

This command was introduced.

Usage Guidelines

Examples

Use the product instance registration token ID from CSSM tool to register product instance.

The following example shows how to register product instance:

[cmxadmin@server]# cmxctl config smartlicense register

Copy the product instance registration Token Id from CSSM tool and paste it below

Please Enter Token Id : XYZ

Do you want to use your Hostname as Product instance Name [yes/no] ? [no]: yes

Registration started with Token Id : XYZ

Registration is in progress ...

Product Instance Registered Successfully

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config smartlicense status

cmxctl config smartlicense status

To check the smart license status of Cisco CMX, use the cmxctl config smartlicense status command.

Syntax Description

Command Default

Command Modes

Command History cmxctl config smartlicense status

This command has no arguments or keywords.

None.

CMX admin user

Release

Cisco CMX Release

10.6.3

Modification

This command was introduced.

Usage Guidelines

Examples

Use this command to check the license compliance status and smart account details.

The following example shows how to check smart license status:

[cmxadmin@server]# cmxctl config smartlicense status

Registration Status : Registered

Registration Date : Thu Oct 22 00:15:58 PDT 2020

License Compliance : Out of Compliance

Out of Compliance Start Date : Thu Oct 22 00:16:01 PDT 2020

Smart Account Name : InternalTestDemoAccount.cisco.com

Virtual Account : CMX_Test

Product Instance Name : CMX Virtual Platform

Is Authorization Failed : False

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config smartlicense renewauthorization

cmxctl config smartlicense renewauthorization

To renew authorization manually, use the cmxctl config smartlicense renewauthorization command.

This command has no arguments or keywords.

Syntax Description

Command Default

Command Modes

Command History cmxctl config smartlicense renewauthorization

None.

CMX admin user

Release

Cisco CMX Release

10.6.3

Modification

This command was introduced.

Usage Guidelines

Examples

Use this command to manually renew the authorization of Smart License in Cisco CMX by communicating with CSSM.

The following example shows how to renew authorization manually:

[cmxadmin@server]# cmxctl config smartlicense renewauthorization

Do you want to Renew Authorization Manually [yes/no] ? [no]: yes

Authorization Renewal is in progress ..-

Product Authorization Renewed Successfully

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config smartlicense renewregistration

cmxctl config smartlicense renewregistration

To renew Cisco CMX product registartion manually, use the cmxctl config smartlicense renewregistration command.

Syntax Description

Command Default

Command Modes

Command History cmxctl config smartlicense renewregistration

This command has no arguments or keywords.

None.

CMX admin user

Release

Cisco CMX Release

10.6.3

Modification

This command was introduced.

Usage Guidelines

Examples

Use this command to manually renew the registration ID and certificate with CSSM. This is optional as Cisco

CMX automatically does this from backend.

The following example shows how to renew product registration manually:

[cmxadmin@server]# cmxctl config smartlicense renewregistration

Do you want to Renew Registration Manually [yes/no] ? [no] : yes

Registration Renewal is in progress ...

Product Registration Renewed Successfully

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config smartlicense reregister

cmxctl config smartlicense reregister

To re-register Cisco CMX product instance manually, use the cmxctl config smartlicense reregister command.

Syntax Description

Command Default

Command Modes

Command History cmxctl config smartlicense reregister

This command has no arguments or keywords.

None.

CMX admin user

Release

Cisco CMX Release

10.6.3

Modification

This command was introduced.

Usage Guidelines

Examples

Use this command to perform a forceful re-registration to override any existing registered instances. This deletes previously reported data in the Smart Account related to that particular instance.

The following example shows how to re-register product instance:

[cmxadmin@server]# cmxctl config smartlicense reregister

Re-register will override existing registered instance if any

Existing data like Reported license,Count etc. if any will be lost from Smart Account

Do you want to Re-register product instance Manually [yes/no] ? [no]: yes

Copy the product instance registration Token Id from CSSM tool and paste it below

Please Enter Token Id : XYZ

Do you want to use your Hostname as Product Instance Name [yes/no] ? [no]: yes

Re-registration started with Token Id : XYZ

Re-registration is in progress ...

Product Instance Re-registered Successfully

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config smartlicense deregister

cmxctl config smartlicense deregister

To deregister product instance manually, use the cmxctl config smartlicense deregister command.

Syntax Description

Command Default

Command Modes

Command History cmxctl config smartlicense deregister

This command has no arguments or keywords.

None.

CMX admin user

Release

Cisco CMX Release

10.6.3

Modification

This command was introduced.

Usage Guidelines

Examples

Use this command to deregister Cisco CMX product instance from CSSM.

The following example shows how to deregister product instance:

[cmxadmin@server]# cmxctl config smartlicense deregister

Do you want to de-register this product instance [yes/no] ? [no] : yes fee-registration is in progress ...

Product Instance De-registered Successfully

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config smartlicense secondaryudi

cmxctl config smartlicense secondaryudi

To configure secondary UDI on Cisco CMX primary for a High Availability setup, use the cmxctl config smartlicense secondaryudi command.

cmxctl config smartlicense secondaryudi

Syntax Description

This command has no arguments or keywords.

Command Default

None.

Command Modes

CMX admin user

Command History Release

Cisco CMX Release

10.6.3

Modification

This command was introduced.

Use the secindary UDI and serial number to configure secondary UDI in Cisco CMX primary setup.

Usage Guidelines

Examples

The following example shows how to configure secondary UDI:

[cmxadmin@server]# cmxctl config smartlicense secondaryudi

Please enter secondary’s UDI : VMware Virtual Platform

Please enter secondary’s serial number : 123ABC-XXX-YYY

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config uptimethreshold

cmxctl config uptimethreshold

To configure system uptime threshold, use the cmxctl config uptimethreshold command.

cmxctl config uptimethreshold { getthresholddays | setthresholddays value }

Syntax Description getthresholddays Displays uptime threshold in days to generate an alert.

setthresholddays value Sets uptime threshold, in days, to generate an alert. The default setting for system uptime threshold is 90 days. The valid range is 1 to 365 days.

Command Default

Command Modes

Command History

None.

CMX admin user

Release Modification

Cisco CMX Release 10.6.3

This command was introduced.

Usage Guidelines

Examples

Use this command to configure a threshold for system uptime. An alert is generated when the system uptime crosses the configured threshold value.

The following example shows how to set the system uptime threshold:

[cmxadmin@cmx]# cmxctl config uptimethreshold setthresholddays

Days after which alerts gets generated [1-365] [90]: 100

Changed the Threshold Days Setting for System Uptime Successfully.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config verify

cmxctl config verify

To verify the Cisco Connected Mobile Experiences (Cisco CMX) installation and configuration, use the cmxctl config verify command.

Command Default

Command Modes cmxctl config verify

None.

CMX admin user

Examples

The following example shows how to verify the Cisco CMX installation and configuration:

[cmxadmin@cmx]# cmxctl config verify

Verifying node configuration...

NetworkManager: unrecognized service

Consul v0.4.1

Consul Protocol: 2 (Understands back to: 1) confd 0.6.0

+-----------------+--------------------------------+------------+-------------------------+

| module | check | passed | msg

+=================+================================+============+========================+

| netman_stopped | NetworkManager service is not | Success |

| | running | |

+-----------------+--------------------------------+------------+-------------------------

--+

| | nsul:5577/api/services/matlabe | | /opt/cmx/var/log

| | ngine/status | |

+-----------------+--------------------------------+------------+-------------------------+

| database | connect to database port:5432 | Success |

+-----------------+--------------------------------+------------+-------------------------+

| consul_dns | 127.0.0.1 (consul) is present | Success |

| | as dns server in | |

| | /etc/resolv.conf | |

+-----------------+--------------------------------+------------+-------------------------

--+

| etchost_hacks | consul service hostnames not | Success |

| | static in /etc/hosts | |

+-----------------+--------------------------------+------------+-------------------------+

| | l:5556/api/services/analytics/ | | /opt/cmx/var/log

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl config verify

| | status | |

+-----------------+--------------------------------+------------+-------------------------+

| hostname_ping | ping to hostname:cmx-master-1 | Success |

+-----------------+--------------------------------+------------+-------------------------

--+

| | :5555/api/services/location/st | | /opt/cmx/var/log

| | atus | |

+-----------------+--------------------------------+------------+-------------------------

--+

| confd_installed | Confd is installed | Success |

+-----------------+--------------------------------+------------+-------------------------+

| consul_installe | Consul is installed | Success |

| d | | |

+-----------------+--------------------------------+------------+-------------------------

--+

| | 001/api/services/nmsplb/status | | /opt/cmx/var/log

+-----------------+--------------------------------+------------+-------------------------+

| | onsul:6000/api/services/config | | /opt/cmx/var/log

| | uration/status | |

+-----------------+--------------------------------+------------+-------------------------+

| cassandra | connect to cassandra port:9042 | Success |

+-----------------+--------------------------------+------------+-------------------------+

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl debug

cmxctl debug

To create a debug tarball in the current directory, use the cmxctl debug command.

Command Default

Command Modes

Command History cmxctl debug

None.

CMX admin user

Release Modification

Cisco CMX Release 10.4

This command is depreciated.

Usage Guidelines

The debug tarball that is created will be approximately 300 MB in size, and takes at 90 seconds to complete.

This command should to be run using the cmxadmin (non-root) account. This commnd is depreciated in Cisco

CMX release 10.4 and we recommend that you use cmxos techsupport command.

Examples

The following example shows how to create a debug tarball in the current directory:

[cmxadmin@cmx]# cmxctl debug running locally

Dumping debug information...

[localhost] Executing task 'dump_config' cp: cannot stat `/opt/cmx/share/upgrade.answers': No such file or directory

[localhost] Executing task 'dump_state' running 'ps aux' running 'ifconfig -a' running 'cmxctl status' running 'ulimit -a' running 'ps -u root,postgres -o %cpu,%mem,cmd' running 'netstat -o -n -a' running 'df -h' running 'ntpdate -d 172.19.28.250' running 'consul members'

[localhost] Executing task 'dump_apis' getting /api/config/v1/clusters getting /api/config/v1/nodes

[localhost] Executing task 'dump_hosts' pinging configuration.service.consul

pinging location.service.consul

pinging 6379.cache.service.consul

pinging 6380.cache.service.consul

pinging 6381.cache.service.consul

pinging database.service.consul

pinging analytics.service.consul

pinging halo.service.consul

Done.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl disable

cmxctl disable

To disable a service, use the cmxctl disable command.

cmxctl disable { consul | qlesspyworker | cassandra | iodocs | cache_6382 | cache_6383 | cache_6380

| cache_6381 | cache_6384 | cache_6385 | influxdb | metrics | confd | cache_6379 | cache_6378 | haproxy | database | analytics | connect | gateway | location | configuration | matlabengine | hyperlocation | nmsplb | agent }

Syntax Description analytics agent cache_6378 cache_6379 cache_6380 cache_6381 cache_6382 cache_6383 cache_6385 cassandra confd configuration connect consul database haproxy hyperlocation location matlabengine metrics

Performs analytics on calculated location data.

Manages Cisco CMX system lifecycle. starts, stops, and monitors all the services running in Cisco CMX.

Caches the service used by location service.

Caches the service used by analytics service.

Enables cassandra database service used by the location service for historical data.

Internal service.

Configures nodes and clusters.

Enables connect services.

Internal service.

Enables the database service used by analytics and configuration service.

Enables the TCP or HTTP load balancer gateway to all service

APIs.

Enables hyperlocation.

Enables location service to compute location.

Provides access point heatmap for location service.

Collects system metrics.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl disable nmsplb influxdb iodocs qlesspyworker gateway

Enables the load balancer service used for distributing Network

Mobility Services Protocol (NMSP) messages to location services.

Enables database services used for storing statistics from various services.

Enables online document service for REST API offered by various services.

Internal service.

Enables gateway services that establishes secure bidirectional communication with Cisco CMX Cloud applications.

Command Default

Command Modes

None

CMX admin user

Examples

The following example shows how to disable the cassandra database service:

[cmxadmin@cmx]# cmxctl disable cassandra

Done

The nodeagent service is currently running with PID: 31776

Stopping cassandra process...

Done

Successfully shutdown cassandra Process.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands

cmxctl dump

To create a configuration tarball in the current directory, use the cmxctl dump command.

Command Default

Command Modes cmxctl dump

None

CMX admin user

Examples

The following example shows how to create a configuration tarball in the current directory:

[cmxadmin@cmx]# cmxctl dump running locally

Dumping configuration information...

[localhost] Executing task 'dump_config'

Done.

cmxctl dump

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl enable

cmxctl enable

To enable a service, use the cmxctl enable command.

cmxctl enable { consul | qlesspyworker | cassandra | iodocs | cache_6382 | cache_6383 | cache_6380

Syntax Description analytics agent cache_6378 cache_6379 cache_6380 cache_6381 cache_6382 cache_6383 cache_6384 cache_6385 cassandra confd configuration connect consul database haproxy hyperlocation location matlabengine

Performs analytics on calculated location data.

Manages Cisco CMX system lifecycle. starts, stops, and monitors all the services running in Cisco CMX.

Caches the service used by location service.

Caches the service used by analytics service.

Enables cassandra database service used by the location service for historical data.

Internal service.

Configures nodes and clusters.

Enables connect services.

Internal service.

Enables the database service used by analytics and configuration service.

Enables the TCP or HTTP load balancer gateway to all service

APIs.

Enables hyperlocation.

Enables location service to compute location.

Provides access point heatmap for location service.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl enable metrics nmsplb influxdb iodocs qlesspyworker gateway

Collects system metrics.

Enables the load balancer service used for distributing Network

Mobility Services Protocol (NMSP) messages to location services.

Enables database services used for storing statistics from various services.

Enables online document service for REST API offered by various services.

Internal service.

Enables gateway services that establishes secure bidirectional communication with Cisco CMX Cloud applications.

Command Default

Command Modes

Command History

None.

CMX admin user

Release

Cisco CMX Release 10.6

Modification

This command was introduced in a release prior to

Cisco CMX Release 10.6.

Examples

The following example shows how to enable analytics service:

[cmxadmin@cmx]# cmxctl enable analytics

The nodeagent service is not running.

Agent is not running, starting it now.

Starting nodeagent Process...

Retrying..

Done

Started nodeagent service with PID: 31027

Cisco CMX Command Reference Guide, Release 10.6.3

cmxctl heterarchy

cmxctl heterarchy

To manage the deployment hierarchy, use the cmxctl heterarchy command.

cmxctl heterarchy { backup | rebuild | repair | restore | retire | verify }

Syntax Description backup Backs up the deployment hierarchy.

rebuild Rebuilds the deployment hierarchy.

repair restore

Repairs the deployment hierarchy.

Restores the deployment hierarchy.

retire verify

Retires the deployment hierarchy.

Verifies the deployment hierarchy.

Command Default

Command Modes

Command History

None

CMX admin user

Release Modification

Cisco CMX Release 10.2

This command was introduced.

Example

The following example shows how to verify the heterarchy:

[cmxadmin@cmx]# cmxctl heterarchy verify

Verifying heterarchy...

Checking user levels

Heterarchy is healthy.

Cisco CMX Commands

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl influxdb wipe

cmxctl influxdb wipe

To wipe the influx database, use the cmxctl influxdb wipe --silent command.

cmxctl influxdb wipe --silent

Syntax Description silent Silently wipe the influx database

Command Default

Command Modes

Command History

None.

CMX admin user

Release Modification

Cisco CMX Release 10.3

This command was introduced.

The following example shows how to wipe the influx database:

[cmxadmin@cmx]# cmxctl influxdb wipe

This command will wipe the Influx database. All system metric data will be erased.

Do you want to continue?: y

Stopping influxdb Process...

executing shutdown

Retrying..

Retrying...

Retrying....

Done

Successfully shutdown influxdb Process.

Cleaning Influx database directories

Configuring InfluxDB

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl jobs

cmxctl jobs

To configure recurring background jobs, use the cmxctl jobs command.

cmxctl jobs { cancel jobname | list | run jobname | runnow jobname }

Syntax Description cancel jobname Cancels a scheduled job.

list Lists all the scheduled jobs.

run jobname runnow jobname

Runs a job at a specified time.

Triggers a one-time run of the job.

Command Default

Command Modes

Command History

None.

CMX admin user

Release

Cisco CMX Release

10.2

Modification

This command was introduced.

Usage Guidelines

The Apache Cassandra database stores location history data. Pruning should be performed to maintain disk usage. Cisco CMX 10.2 introduces the option to prune database size. The default disk-pruning task runs at an interval of 90 days. You can also use the cmxctl jobs runnow cleanupcassandra command to run an on-demand job of cleaning up the Cassandra database, which is a normal scheduled task that runs once every two days.

Examples

The following example shows how to run a background job:

[cmxadmin@cmx]# cmxctl jobs run LocationIndexCleanup submitted the job, verify using cmxctl jobs list.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl metrics notification

cmxctl metrics notification

To generate notification metrics for a Cisco Connected Mobile Experiences (Cisco CMX) file, use the cmxctl metrics notification command.

Command Default

Command Modes

Usage Guidelines cmxctl metrics notification

None

CMX admin user

The notification keyword provides metrics for notification.

Examples

The following example shows how to generate metrics for a Cisco CMX file:

[cmxadmin@cmx]# cmxctl metrics notification

+--------------------------------+------------+------------+-----------------+------------+

FailureRate |

+================================+============+============+=================+===========+

+--------------------------------+------------+------------+-----------------+------------+

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl node

cmxctl node

To manage node installation, use the cmxctl node command.

cmxctl node { sslmode | { enable | { --key key-file-location | --pem pem-file-location } | disable }}

Syntax Description sslmode enable

Enables or disables Secure Sockets Layer (SSL).

Enables Secure Sockets Layer (SSL).

--key key-file-location Location of the SSL key file.

--pem pem-file-location Location of the SSL pem file.

disable Disables Secure Sockets Layer (SSL).

Command Default

Command Modes

Usage Guidelines

Command History

None.

CMX admin user

Before initiating the import process, ensure that you have a self-signed or a Certificate Authority (CA)-signed certificate and the key file. The certificate and the key file must have minimum global read permissions (0644).

Starting from Cisco CMX Release 10.3.1, you can install a new Cisco CMX certificate by using the key and pem keywords. For example:

[cmxadmin@cmx]# cmxctl node sslmode enable --pem /home/cmxadmin/cert.pem --key

/home/cmxadmin/host.key

Release Modification

Cisco CMX Release 10.3.1

This command was modified. The sslmode enable keyword was modified.

Cisco CMX Release 10.3.0

This command was introduced.

Examples

The following example shows how to manage node installation:

[cmxadmin@cmx]# cmxctl node sslmode enable --pem <pem-file-location> --key <key-file-location> enabling ssl ssl enabled

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl restart

cmxctl restart

To restart a Cisco Connected Mobile Experiences (Cisco CMX) service, use the cmxctl restart command.

cmxctl restart { consul | qlesspyworker | cassandra | iodocs | cache_6382 | cache_6383 | cache_6380

Performs analytics on calculated location data.

Manages Cisco CMX system lifecycle. Starts, stops, and monitors all the services running in Cisco CMX.

Caches the service used by location service.

Caches the service used by analytics service.

Enables cassandra database service used by the location service for historical data.

Internal service.

Configures nodes and clusters.

Enables connect services.

Internal service.

Enables the database service used by analytics and configuration service.

Enables the TCP or HTTP load balancer gateway to all service

APIs.

Enables hyperlocation.

Enables location service to compute location.

Provides access point heatmap for location service.

Collects system metrics.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl restart nmsplb influxdb iodocs qlesspyworker gateway

Enables the load balancer service used for distributing Network

Mobility Services Protocol (NMSP) messages to location services.

Enables database services used for storing statistics from various services.

Enables online document service for REST API offered by various services.

Internal service.

Enables gateway services that establishes secure bidirectional communication with Cisco CMX Cloud applications.

Command Default

Command Modes

None

CMX admin user

Examples

The following example shows how to restart a Cisco CMX service:

[cmxadmin@cmx]# cmxctl restart database

Done

The nodeagent service is currently running with PID: 16718

Stopping postgres Process...

Successfully shutdown postgres Process.

Starting postgres Process...

Done

Started postgres service with PID: 25702

Exception while notifying CE

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl stack

cmxctl stack

To generate the jstack for a java service, use the cmxctl stack command.

cmxctl stack { cmx_service }

Syntax Description cmx_service Lists all Cisco CMX services. The services include: location, analytics, configuration, matlabengine, and nmsplb.

Command Default

Command Modes

Command History

None

CMX admin user

Release Modification

Cisco CMX Release 10.2

This command was introduced.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl start

cmxctl start

To start a Cisco Connected Mobile Experiences (Cisco CMX) service, use the cmxctl start command.

cmxctl start { consul | qlesspyworker | cassandra | iodocs | cache_6382 | cache_6383 | cache_6380

Performs analytics on calculated location data.

Manages Cisco CMX system lifecycle. starts, stops, and monitors all the services running in Cisco CMX.

Caches the service used by location service.

Caches the service used by analytics service.

Enables cassandra database service used by the location service for historical data.

Internal service.

Configures nodes and clusters.

Enables connect services.

Internal service.

Enables the database service used by analytics and configuration service.

Enables the TCP or HTTP load balancer gateway to all service

APIs.

Enables hyperlocation.

Enables location service to compute location.

Provides access point heatmap for location service.

Collects system metrics.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl start nmsplb influxdb iodocs qlesspyworker gateway

Enables the load balancer service used for distributing Network

Mobility Services Protocol (NMSP) messages to location services.

Enables database services used for storing statistics from various services.

Enables online document service for REST API offered by various services.

Internal service.

Enables gateway services that establishes secure bidirectional communication with Cisco CMX Cloud applications.

Command Default

Command Modes

None

CMX admin user

Examples

The following example shows how to display the status for the consul service:

[cmxadmin@cmx]# cmxctl start consul

Done

The nodeagent service is currently running with PID: 16718

Done

The analytics service is already running with pid: 1099

Done

Exception while notifying CE

Done

The location service is already running with pid: 16005

Done

Exception while notifying CE

Done

The configuration service is already running with pid: 16165

Done

Exception while notifying CE

Done

The matlabengine service is already running with pid: 1251

Done

Exception while notifying CE

Done

The nmsplb service is already running with pid: 1377

Done

Exception while notifying CE

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl status

cmxctl status

To view the status of one or all Cisco Connected Mobile Experiences (Cisco CMX) services, use the cmxctl status command.

cmxctl status { analytics | agent | cache_6378 | cache_6379 | cache_6380 | cache_6381 | cache_6382

| cache_6383 | cache_6385 | cassandra | configuration | confd | consul | database | haproxy | location | matlabengine | metrics | nmsplb | influxdb | iodocs | qlesspyworker }

Performs analytics on calculated location data.

Manages Cisco CMX system lifecycle. starts, stops, and monitors all the services running in Cisco CMX.

Caches the service used by location service.

Caches the service used by analytics service.

Enables cassandra database service used by the location service for historical data.

Internal service.

Configures nodes and clusters.

Enables connect services.

Internal service.

Enables the database service used by analytics and configuration service.

Enables the TCP or HTTP load balancer gateway to all service

APIs.

Enables hyperlocation.

Enables location service to compute location.

Provides access point heatmap for location service.

Collects system metrics.

Cisco CMX Command Reference Guide, Release 10.6.3

Cisco CMX Commands cmxctl status

Command Default

Command Modes

Usage Guidelines nmsplb influxdb iodocs qlesspyworker gateway

Enables the load balancer service used for distributing Network

Mobility Services Protocol (NMSP) messages to location services.

Enables database services used for storing statistics from various services.

Enables online document service for REST API offered by various services.

Internal service.

Enables gateway services that establishes secure bidirectional communication with Cisco CMX Cloud applications.

None.

CMX admin user

After installing the ISO file on the Cisco MSE 3355 or 3365, use the cmxctl status command to check if the

CMX services are running. If they are not running, use the cmxctl start command.

Examples

The following example shows how to display the status for the consul service:

[cmxadmin@cmx]# cmxctl status consul

Done

The nodeagent service is currently running with PID: 6190

+----------------+---------------+---------+----------------+