Virtual Appliance CLI

Use the Virtual Appliance command-line interface to administer services, datastores, platform operations, licenses, applications, and diagnostics.

The appdcli utility is included with the Virtual Appliance package. Commands are hierarchical. Select a top-level command, its required child command, and any arguments or options.

Syntax

CODE 
appdcli <command> <child-command> [options] [arguments]

Square brackets identify optional input. Angle brackets identify values that you supply. Do not enter the brackets.

To display top-level help, run appdcli --help. To display help for a command, run appdcli <command> --help.

Command categories

Service management commands

Start, stop, synchronize, upgrade, and check the health of Virtual Appliance services.

Start and synchronize services

CODE 
appdcli start <service> [profile]
appdcli sync <service> [profile]

Use one of the following service values:

Value Description
all All service groups.
appd Core Splunk AppDynamics services.
aiops Anomaly Detection and Root Cause Analysis services.
secureapp Cisco Secure Application services.
atd Automated Transaction Diagnostics services.
ai-insights AI Insights and AI Assistant services.
log-connect Splunk Log Connect services.
mcp Model Context Protocol services.

The optional profile value is small, medium, large, or xlarge.

Stop services

CODE 
appdcli stop <service>

Use any service value listed for start except a profile. Use appdcli stop operators to stop Kubernetes operators.

Display status

CODE 
appdcli status application [--node-url <url>]
appdcli status infrastructure

The application value displays application-service health. Use the --node-url option to override the base URL for application health checks. The infrastructure value displays infrastructure-component status.

Update a Virtual Appliance

CODE 
appdcli upgrade <patch-file> [--ssh-user <user>] [-y|--yes]

The update package must have the .patch extension. The default SSH user is appduser. The command previews the update contents and requests confirmation unless you specify --yes. For more information, see Update Virtual Appliance with the Patch.

Datastore and infrastructure commands

Display datastore health, recover the MySQL cluster, list Kafka topics, and inspect registry images.

MySQL

CODE 
appdcli mysql status [--extended] [--watch <seconds>] [--strict]
appdcli mysql restore
Option Description
--extended Display detailed status, performance, configuration, and replication diagnostics.
--watch Refresh continuously at the specified interval. The minimum is 2 seconds.
--strict Return a failure exit code when an available cluster is degraded.
Note: Use appdcli mysql restore to recover the MySQL cluster from an outage. This operation is separate from datastore backups under appdcli backup mysql.

PostgreSQL

CODE 
appdcli postgres status [--extended] [--sample-seconds <seconds>] [--top <count>] [--show-query-text]
Option Description
--extended Display active work, top query IDs, table health, CPU throttling, configuration, and replication diagnostics.
--sample-seconds Set the CPU-throttling sample duration. The default is 10 seconds and the minimum is 2 seconds.
--top Set the maximum number of queries and tables. The default is 10.
--show-query-text Include truncated SQL text. Query IDs are displayed by default.

Kafka

CODE 
appdcli kafka status [--extended] [--sample-seconds <seconds>] [--top <count>] [--topic <name>]
appdcli kafka list-topics <application-credential-id>

Extended status includes topic growth, consumer lag, retention, and configuration. The sampling default is 10 seconds and the minimum is 2 seconds. Use --top to limit displayed topics and consumer groups, or --topic to analyze one topic.

For list-topics, use an application credential identifier such as aiops or secapp.

Container registry

CODE 
appdcli registry list-images

This command displays the images and tags in the local container registry.

Platform operations commands

Back up and restore the platform, manage service placement, and audit or rotate certificates.

Platform backup and restore

CODE 
appdcli platform backup
appdcli platform restore <filename>

Create a platform backup before an upgrade. Supply the platform backup file when you restore.

Scale platform services

CODE 
appdcli platform scale out --node <name-or-IP> [--node <name-or-IP> ...] --service <service>
appdcli platform scale in --node <name-or-IP> [--node <name-or-IP> ...] --service <service>

Repeat --node or provide a comma-separated node list. Supported service values are es and elasticsearch.

Dedicate a Controller node

CODE 
appdcli platform dedicate-node --node <name-or-IP> --service controller
appdcli platform controller-info

The dedicate-node command dedicates a ready, schedulable node to the Controller service. The controller-info command displays Controller placement, pod, and readiness details.

Manage certificates

CODE 
appdcli platform certificates audit
appdcli platform certificates rotate-leaf
appdcli platform certificates rotate-root-ca

The audit command reports expiration dates and severity for cert-manager certificates. In hybrid mode, it also reports customer-managed external certificates as read-only.

The rotate-leaf command rotates cert-manager leaf certificates but skips trust anchors. Services continue to hold old certificates in memory until they are restarted. The command asks whether to stop and start installed services.

Warning: The rotate-root-ca command changes the platform root CA and, when the default ingress certificate is enabled, the ingress certificate. External agents or clients that trust the previous certificates lose connectivity until you distribute the new trust anchor.

After root-CA rotation, run appdcli platform certificates rotate-leaf so that leaf certificates are signed by the new CA. Distribute the new root CA and ingress certificate to every external truststore. For more information, see Manage Virtual Appliance Certificates.

Datastore backup commands

Manage Elasticsearch, PostgreSQL, and MySQL backups and restores.

Elasticsearch snapshots

Syntax Description
appdcli backup elasticsearch create-fs-repo <repository> Create a file-system repository.
appdcli backup elasticsearch create-s3-repo <repository> Create an Amazon S3 repository.
appdcli backup elasticsearch delete-repo <repository> Delete a repository.
appdcli backup elasticsearch list-repos List repositories.
appdcli backup elasticsearch create-snapshot <repository> <snapshot> [indices ...] Create a snapshot. Omit indices to use the command default.
appdcli backup elasticsearch delete-snapshot <repository> <snapshot> Delete a snapshot.
appdcli backup elasticsearch list-snapshots <repository> List snapshots in a repository.
appdcli backup elasticsearch restore-snapshot <repository> <snapshot> [indices ...] Restore a snapshot. Specify indices to restore only those indices.

PostgreSQL snapshots

CODE 
appdcli backup postgres create-snapshot <repository>
appdcli backup postgres restore-snapshot <repository>

MySQL XtraBackup

Syntax Description
appdcli backup mysql full [--pod <pod>] Create a full backup. The default pod is appd-mysql-0.
appdcli backup mysql incr [--pod <pod>] Create an incremental backup. Use the same pod that was used for the full backup.
appdcli backup mysql restore [--from-chain <timestamp>] [--from-incr <timestamp|full>] [--staging-path <path>] Restore a backup chain. The latest chain and all incrementals are used by default. Manual cluster recovery is required afterward.
appdcli backup mysql list List XtraBackup resources.
appdcli backup mysql delete <backup-name> Delete an XtraBackup resource.
appdcli backup mysql list-chains List backup chains, sizes, and incremental backups.
appdcli backup mysql delete-chain <timestamp> [--force] Delete a backup chain. Use --force to allow deletion of the latest chain without confirmation.
Note: The SQL-dump commands create-snapshot <repository> and restore-snapshot <repository> <snapshot> are deprecated. Use XtraBackup commands for new backups.

For more information, see Back Up and Restore the Virtual Appliance.

Component, application, and diagnostic commands

Bootstrap components, manage licenses and credentials, administer the Controller, and collect support information.

Bootstrap components

Syntax Description
appdcli bootstrap core Bootstrap Core Splunk AppDynamics components.
appdcli bootstrap hybrid Bootstrap a hybrid deployment.
appdcli bootstrap authn Bootstrap authentication components.
appdcli bootstrap atd Bootstrap Automated Transaction Diagnostics components.
appdcli bootstrap log-connect Bootstrap Splunk Log Connect components.

Manage licenses

CODE 
appdcli license controller <license-file>
appdcli license eum <license-file>

To apply a MAC address-based Controller license to a specific cluster node, set appdController.nodeLocked to true in the global.yaml.gotmpl file before applying the license.

Manage access keys and API tokens

CODE 
appdcli access-key controller <key>
appdcli access-key eum <key>
appdcli access-key mcp

The Controller and EUM commands require the new key as an argument. The MCP command displays the current Model Context Protocol API token and asks whether to rotate it. If you rotate the token, the command displays the new token and services pick it up automatically.

Warning: Treat displayed access keys and API tokens as secrets. Do not copy them into documentation, tickets, or logs.

Manage the Controller

Syntax Description
appdcli controller restart Restart the Controller.
appdcli controller sync-passwords Synchronize Controller passwords from encrypted secrets. Use this command only for non-hybrid Controller deployments.
appdcli controller list-java [--jre-home <directory>] List detected Java home directories or inspect a custom JRE directory.
appdcli controller actions-list List custom actions.
appdcli controller actions-sync Reset and synchronize custom actions after manual changes.
appdcli controller actions-verify [--directory <directory>] Verify custom-action XML files and directory mappings.
appdcli controller actions-run [action] [--all] [--print-xml] [--print-actions] Run custom actions, display the custom-action XML, or display action names.
appdcli controller actions-add <directory> [script] [--bulk] [--no-indent] Add one action or use --bulk to add several. The --no-indent option leaves custom.xml unformatted.
appdcli controller actions-delete [action] [--all] Delete one custom action or all custom actions.

Collect a support bundle

CODE 
appdcli support-bundle

The command collects diagnostic information across cluster nodes as the appduser SSH user and requests a password for each node.

Secure Application commands

Pass diagnostic, configuration, data-feed, and test-agent commands to Cisco Secure Application.

CODE 
appdcli secureapp <command> [arguments]

Available commands

Command Description
checkAgentAuth Verify agent authentication by using the agent account key.
checkApi Check the Secure Application API.
checkAuthToken Verify that the Controller can create authentication tokens for the admin user.
checkDeps Check Secure Application dependencies before installation.
checkHybridControllerTls Check the hybrid Controller TLS connection for the Secure Application client.
checkHybridMysqlTls Check the hybrid MySQL TLS connection for the Secure Application client.
checkIngressSAN Check ingress-certificate SANs used for agent and user authentication.
debugReport Collect logs and Kubernetes resources, excluding secrets, for offline debugging.
getSecureApplications Display the default Secure Application enablement setting.
health Run dependency checks and additional diagnostic tests.
insecureApplications Turn off Secure Application by default for applications.
licenseCheck Check that the license contains Secure Application Units.
numAgentReports Display the number of processed Agent Reports.
restartFeedProcessing Restart data-feed processing to make newly uploaded data available sooner.
secureApplications Enable Secure Application by default for applications.
setDownloadPortalCredentials Set credentials for automatic daily data-feed downloads.
setFeedKey Set the license key for an uploaded air-gapped data feed.
showConfig Display the observed Secure Application configuration.
startTestAgent Start the test-agent Java application with active APM and Secure Application agents.
stopTestAgent Stop the test-agent Java application.
uploadFeed Upload an air-gapped data feed from the local file system.
versions Display version information for troubleshooting.

Command examples

CODE 
appdcli secureapp setDownloadPortalCredentials <username>
appdcli secureapp setFeedKey <feed-key-path-or-->
appdcli secureapp uploadFeed <feed-file>

For setFeedKey, specify a file path or use - to read the key from standard input. The Secure Application utility handles password entry for setDownloadPortalCredentials.

Note: Before you run checkDeps, health, or licenseCheck, run appdcli start secureapp.

Troubleshoot Virtual Appliance CLI messages

Interpret expected messages from licensing and Secure Application commands.

A Virtual Appliance CLI command reports an error or uses unexpected certificate wording.

The message can describe an optional component that is not installed or a known wording defect.

Match the message to the following guidance.
  • If Controller license processing reports Deployment 'onprem-proxy-server' not found in namespace 'cisco-secureapp'. Check Hybrid Mode. and Secure Application is not installed, ignore the message.
  • If checkDeps reports controller endpoint not found in hybrid mode, ignore the message.
  • In Virtual Appliance 25.10, checkHybridMysqlTls can report Failed ingress cert.... Interpret the message as Failed MySQL cert.