> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/installation/commands.md).

# Commands

The openiam-cli command surface, plus the systemd units and log locations behind it.

`openiam-cli` is the operational interface to the platform. It is installed with the package and is on the path.

## Platform

| Command                  | Does                                                                                                                      |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------- |
| `openiam-cli init`       | Builds the deployment — configures every tier and starts the platform. Run once, on a new host                            |
| `openiam-cli start`      | Starts the platform services                                                                                              |
| `openiam-cli stop`       | Stops the platform services                                                                                               |
| `openiam-cli status`     | Reports each service and its application health                                                                           |
| `openiam-cli sessions`   | Lists active user sessions                                                                                                |
| `openiam-cli log`        | Recent output from the platform start-up log                                                                              |
| `openiam-cli log <name>` | Recent log output for one service. `<name>` is the log name in the table under [*Logs*](#logs), not the systemd unit name |
| `openiam-cli upgrade`    | Upgrades an existing deployment. Covered in the *Upgrade Guide*                                                           |
| `openiam-cli autoinit`   | Unattended build, driven by the values in `env.conf` rather than prompts                                                  |

Stopping and starting the platform, for example after a configuration change:

{% code overflow="wrap" %}

```bash
openiam-cli stop && openiam-cli start
```

{% endcode %}

## Connectors and source adapters

**The name comes before the verb.** Both commands take the form `openiam-cli connector <name> <action>`:

| Command                                                                       | Does                                         |
| ----------------------------------------------------------------------------- | -------------------------------------------- |
| `openiam-cli list-connectors`                                                 | Lists installed connectors                   |
| `openiam-cli connector`                                                       | The same list, with a reminder of the syntax |
| `openiam-cli connector <name> start`                                          | Starts a connector                           |
| `openiam-cli connector <name> stop`                                           | Stops a connector                            |
| `openiam-cli connector <name> status`                                         | Reports a connector's state                  |
| `openiam-cli connector <name> log`                                            | Recent log output for a connector            |
| `openiam-cli connector <name> enable`                                         | Enables the connector to start with the host |
| `openiam-cli connector <name> disable`                                        | Stops it starting with the host              |
| `openiam-cli list-source-adapters`                                            | Lists installed source adapters              |
| `openiam-cli source-adapter <name> start\|stop\|status\|log\|enable\|disable` | The same set, for a source adapter           |

The name is the connector's filename without its extension, exactly as `list-connectors` reports it. For example:

{% code overflow="wrap" %}

```bash
openiam-cli connector ldap-connector-rabbitmq status
```

{% endcode %}

Running `openiam-cli connector` with no name prints the installed list, which is the quickest way to check a name you are unsure of.

## Three-node deployments

| Command                          | Does                                                         |
| -------------------------------- | ------------------------------------------------------------ |
| `openiam-cli init_vault_cluster` | Joins the secret store into a cluster across the three hosts |

## Starting with the host

**The platform starts itself after a host restart.** The package installs a systemd timer for the platform and one per service. About four minutes after boot the platform's timer checks the infrastructure tier and brings the secret store up; the service timers follow a minute later, once the tier beneath them is ready.

{% code overflow="wrap" %}

```bash
systemctl list-timers 'openiam*' --all --no-pager
```

{% endcode %}

**Expected:** the platform timer and one per service, all enabled. Allow roughly five minutes after a restart before treating a quiet platform as a fault.

**Stop the platform before restarting the host** — `openiam-cli stop`. The secret store seals when it stops, which is how it protects credentials at rest, and a clean stop is what brings it back unsealed without intervention.

## Removing a deployment

{% code overflow="wrap" %}

```bash
openiam-cli stop
/usr/local/openiam/utils/uninstall.sh
```

{% endcode %}

This removes the platform, its bundled components and the service accounts. **It removes data as well as software** — take a backup first if there is anything you want to keep. [*Back up and restore*](/installation/rpm/rpm-single-node/back-up-and-restore.md) covers what to keep and how to bring it back.

## Systemd units

Every service runs as a systemd unit, so the host's normal tooling applies.

| Unit                            | Service                              |
| ------------------------------- | ------------------------------------ |
| `openiam-esb`                   | Enterprise service bus               |
| `openiam-auth`                  | Authorization manager                |
| `openiam-idm`                   | Identity management                  |
| `openiam-auditlog`              | Audit log manager                    |
| `openiam-batchtask`             | Batch task manager                   |
| `openiam-workflow`              | Workflow                             |
| `openiam-business-rule`         | Business rule manager                |
| `openiam-groovy`                | Groovy manager                       |
| `openiam-email`                 | Email manager                        |
| `openiam-device`                | Device manager                       |
| `openiam-reconciliation`        | Reconciliation                       |
| `openiam-synchronization`       | Synchronisation                      |
| `openiam-certification-manager` | Access certification                 |
| `openiam-privacy-manager`       | Privacy manager                      |
| `openiam-sas`                   | SafeNet authentication, when enabled |
| `openiam-idp`                   | Identity provider                    |
| `openiam-webconsole`            | Webconsole                           |
| `openiam-selfservice`           | Self-service                         |
| `openiam-selfservice-ext`       | Self-service, external               |
| `openiam-reportviewer`          | Report viewer                        |
| `openiam-ui-static`             | Static interface assets              |
| `openiam-connector@<name>`      | A connector instance                 |
| `openiam-adapter@<name>`        | A source adapter instance            |

Common operations:

{% code overflow="wrap" %}

```bash
systemctl status openiam-esb
systemctl restart openiam-auth
systemctl enable openiam-connector@ldap-connector-rabbitmq
journalctl -u openiam-idm -f
```

{% endcode %}

Two more units carry user traffic. `httpd` is the reverse proxy — the entry point users reach, running Apache with the OpenIAM module. `nginx` is the interface router behind it, which the installation configures and which routes each path to the interface service that serves it.

Infrastructure components run as their own units: `cassandra`, `janusgraph`, `rabbitmq-server`, `redis`, `opensearch` or `elasticsearch`, `openiam-vault`, `consul`, and `mariadb` where installed locally.

## Reading a credential from the secret store

Several checks in this guide need the cache or search tier's password. **They are in the secret store, not in a file** — read them from there rather than keeping a copy:

{% code overflow="wrap" %}

```bash
sudo /usr/local/openiam/utils/vault/vault.fetch.property.sh vault.secret.redis.password
```

{% endcode %}

The properties the verification pages use:

| Property                           | Used by                                     |
| ---------------------------------- | ------------------------------------------- |
| `vault.secret.redis.password`      | The cache checks                            |
| `vault.secret.opensearch.username` | The search tier checks                      |
| `vault.secret.opensearch.password` | The search tier checks                      |
| `vault.secret.jdbc.username`       | The database connection for the core schema |

To set the variables the verification commands expect, for the length of your shell session:

{% code overflow="wrap" %}

```bash
V=/usr/local/openiam/utils/vault/vault.fetch.property.sh
export REDIS_PASSWORD="$(sudo $V vault.secret.redis.password)"
export OPENSEARCH_USER="$(sudo $V vault.secret.opensearch.username):$(sudo $V vault.secret.opensearch.password)"
```

{% endcode %}

**Anything on a command line is visible to every local user through the process list.** Setting the variables once, as above, keeps the values out of the commands you then run — and `unset` them, or close the session, when you are finished.

## Checking the platform is healthy

{% code overflow="wrap" %}

```bash
# Services running
pgrep -c -u openiam java

# Application health, per front-end service
curl -s http://localhost:8082/webconsole/actuator/health | jq -r '.status'

# Infrastructure
nodetool status
rabbitmqctl status
curl -sk https://localhost:8200/v1/sys/seal-status | jq '.sealed'
```

{% endcode %}

[*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md) has the full sequence.

## Logs

All service logs are in `/usr/local/openiam/logs/`. **The log name is the component's own name, which is not always the same as the systemd unit name** — this table is the mapping, and the same name is what `openiam-cli log <name>` expects.

| Systemd unit                    | Log file                    |
| ------------------------------- | --------------------------- |
| `openiam-esb`                   | `openiam-esb.log`           |
| `openiam-idm`                   | `idm.log`                   |
| `openiam-idp`                   | `idp.log`                   |
| `openiam-auth`                  | `auth-manager.log`          |
| `openiam-auditlog`              | `audit-log-manager.log`     |
| `openiam-batchtask`             | `batch-task-manager.log`    |
| `openiam-business-rule`         | `business-rule-manager.log` |
| `openiam-certification-manager` | `certification-manager.log` |
| `openiam-device`                | `device-manager.log`        |
| `openiam-email`                 | `email-manager.log`         |
| `openiam-groovy`                | `groovy-manager.log`        |
| `openiam-privacy-manager`       | `privacy-manager.log`       |
| `openiam-reconciliation`        | `reconciliation.log`        |
| `openiam-synchronization`       | `synchronization.log`       |
| `openiam-workflow`              | `workflow.log`              |
| `openiam-webconsole`            | `webconsole.log`            |
| `openiam-selfservice`           | `selfservice.log`           |
| `openiam-selfservice-ext`       | `selfservice-ext.log`       |
| `openiam-reportviewer`          | `reportviewer.log`          |
| `openiam-ui-static`             | `openiam-ui-static.log`     |
| `openiam-connector@<name>`      | `<name>.log`                |
| `openiam-adapter@<name>`        | `<name>.log`                |

Everything else:

| What              | Where                                                               |
| ----------------- | ------------------------------------------------------------------- |
| Installation      | `/usr/local/openiam/init.log`                                       |
| Platform start-up | `/var/log/openiam-start.log`, or `openiam-cli log`                  |
| Upgrade           | `/usr/local/openiam/upgrade.log`                                    |
| Reverse proxy     | `/var/log/httpd/mod_openiam_error_log` and `mod_openiam_access_log` |
| Interface router  | `/var/log/nginx/`                                                   |
| Unit-level        | `journalctl -u openiam-<unit>`                                      |

**Log rotation is configured by the package.** `/etc/logrotate.d/openiam` rotates everything in `/usr/local/openiam/logs/` daily or at 10 MB, keeping five compressed generations. Equivalent policies ship for the graph, storage and search tiers. Change the retention there if your organisation requires longer.

**Treat the installation and upgrade logs as sensitive.** They record the deployment's configuration.

## File locations

| Path                                  | Contains                       |
| ------------------------------------- | ------------------------------ |
| `/usr/local/openiam/`                 | The platform                   |
| `/usr/local/openiam/env.conf`         | Deployment-level configuration |
| `/usr/local/openiam/conf/properties/` | Generated service properties   |
| `/usr/local/openiam/services/bin/`    | Service binaries               |
| `/usr/local/openiam/connectors/bin/`  | Connector binaries             |
| `/usr/local/openiam/logs/`            | Service logs                   |
| `/usr/local/openiam/jdk/`             | The bundled Java runtime       |
| `/usr/local/openiam/version`          | The installed version          |

## Related

* [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md)
* [*Troubleshoot*](/installation/rpm/rpm-single-node/troubleshoot.md)
* [*Settings*](/installation/settings.md)

*Applies to OpenIAM 2026.8.1.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/installation/commands.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.