CLI commands

Use netflowscout COMMAND --help for flags supported by the current executable. This page maps user workflows to commands rather than replacing version-specific help.

Deployment and diagnostics

Command	Purpose
version / support	Version and executable digest / support matrix
init --lang en	First-install wizard: select capture/outputs, validate and confirm before saving
setup --lang en	Guided preflight, confirmed service start and real business acceptance
applications	Running application/systemd inventory without args or environment
strategy create	Generate and validate detection DSL, optional replay, new file only
explain	Stage evidence, missing-event diagnosis and next actions
events	Bounded rotated-file metadata filters and per-event delivery receipts
configure	Generate new main/endpoint configuration and rules without overwriting
check --config FILE	Validate complete configuration, Wasm, schemas, rules, business settings
doctor --config FILE	Preflight permissions, interface, directories, credential names, optional endpoints
status --component all	Unified main/analyzer/selected-endpoint status
onboard	Wait for selected readiness, optionally verify synthetic/real traffic
verify	Synthetic pipeline or new business observations and optional event receipts
diagnose --out FILE	Private diagnostic archive without raw content
tui	Read-only terminal management; --control enables confirmed changes

Select endpoints with --endpoint-config FILE or --endpoint-dir DIR. Status reports by default; --require-ready returns nonzero when unready. Zero targets does not prove business activity. See verification.

Run and replay

netflowscout run --config netflowscout.json
netflowscout analyze --config netflowscout.json
netflowscout endpoint --config endpoint.json
netflowscout replay --config netflowscout.json --input observations.ndjson
netflowscout stream-replay --stream /run/netflowscout/streams.sock --input stream.pb

Run, analyze, and endpoint are separate processes, normally supervised by systemd. NDJSON replay directly inputs observations. Stream-replay sends frames to a running analyzer. For PCAP, use analyze --pcap traffic.pcap with a paired run --replay-clock, independent WAL, and network source. Keep historical input separate from the online pipeline.

Raw evidence

netflowscout recording list --config CONFIG --event-id EVENT_ID
netflowscout recording export --config CONFIG --event-id EVENT_ID --out NEW_DIRECTORY
netflowscout recording replay --config CONFIG --event-id EVENT_ID
netflowscout recording pin --config CONFIG --id CAPTURE_ID --for 168h
netflowscout recording unpin --config CONFIG --id CAPTURE_ID

Locate, export, dry-run, and protect evidence by event or capture episode. See recording for selectors, retention, and boundaries.

Rules and plugins

netflowscout rules test --config CONFIG --input FILE --format ndjson
netflowscout plugin list --config CONFIG
netflowscout plugin info --config CONFIG
netflowscout plugin verify --config CONFIG --directory PACKAGE
netflowscout plugin test --config CONFIG --input FILE --format stream --expect golden.ndjson

Rules test accepts ndjson/pcap/stream and optional compare-rules. Plugin test performs actual parsing replays. Neither sends events externally. See plugin development for creation, installation, and rollback.

Upgrade and offline import

sudo netflowscout upgrade --package PACKAGE
sudo netflowscout rollback
netflowscout queue import --path NEW_WAL --input EXPORT --sinks file,dataway

Queue import accepts a validated offline NDJSON export and requires a nonexistent destination. It does not move an active WAL. Legacy SQLite migration needs stopped services, backups, and the dedicated exporter; renaming a database path to a WAL filename is not migration.