Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › CLI › Operator Commands

Operator Commands

zwallctl operator commands (fleet, inspect, maintenance)

SharedStatus: SUPPORTED as implemented cobra. Updater/signing-key documented as present-but-not-production.Audience: operator

Global flags and login: Auth and config. Rules/blocks: Rule workflows. Maps: Local maps. License CLI is Enterprise-only and is provided separately to Enterprise customers.

Inspect 

zwallctl status [--agent ID] [--all]
zwallctl ping [host]
zwallctl version
zwallctl list
zwallctl list-rules
zwallctl list-agents
zwallctl list-events [--hours 24] [--limit 100]
zwallctl info IP
zwallctl agent-info ID
zwallctl rule-info ID
zwallctl log [lines] [--lines 50]
zwallctl grep IP
zwallctl check [check-name]
zwallctl stats

status uses dashboard stats and optional per-agent status. --all also lists Agents. ping GETs /api/v1/health. stats is local eBPF stats_map, no HTTP. log --follow prints not implemented. check GETs /api/v1/system/sanity-check.

Expected: table/JSON; cobra Error: + exit 1 on failure. 401 → login. Connection refused → check Manager URL and port.

Service-adjacent 

zwallctl start [--agent]
zwallctl stop [--agent]
zwallctl restart --agent ID | --all

start/stop are not implemented (print systemd). restart POSTs /api/v1/agents/:id/restart — Hosting 409.

Local rule profiles (files on the operator workstation) 

zwallctl profile-save NAME
zwallctl profile-restore NAME
zwallctl profile-list
zwallctl profile-delete NAME

Save/restore talks to /api/v1/rules then local files. This is not database backup.

Reset / CLI backup (warnings) 

zwallctl reset
zwallctl backup [file] [-o path]

reset deletes rules and posts cleanup-logs clear_blocked_ips — destructive; database and Agent connections preserved per command text.

backup POSTs /api/v1/maintenance/backup. The handler returns success without pg_dump. Do not use as the dump. Use backup_db.sh.

Secrets 

zwallctl secret-list
zwallctl secret-generate NAME --output PATH
zwallctl secret-rotate

Edition split: Enterprise rotate is explanatory (setup.sh custody; pending final acceptance). Community rotate [jwt|db|all] is live API.

Signing keys / updater (Enterprise present, NOT production upgrade) 

zwallctl signing-key create PUBLIC_KEY_B64 [--default]
zwallctl signing-key list [--status]
zwallctl signing-key revoke ID --reason TEXT
zwallctl update check
zwallctl update apply --release-id ID ...
zwallctl update status --campaign-id ID
zwallctl update rollback --campaign-id ID
zwallctl upgrade   # alias of update apply

Documented so operators are not surprised. NOT_SUPPORTED as the production upgrade path. See Upgrades overview.