SDK and CLI reference
Every command of the xpologClient.jar SDK: connection parameters, settings and security users, accounts (SSH, Remote XPLG, S3), scan and Log Sync tasks, folders and logs including Windows Event Logs, AppTag time zones, license, restart and patches; plus the command-line update package.
What you will do: configure one or many deployments from scripts instead of the console.
The SDK is a Java client, xpologClient.jar, that runs on any machine with a Java runtime and HTTP/S access to the server; for HTTPS the .keystore file shipped with the SDK must sit next to the jar. The XPLG downloads (the jar, the keystore zip and example scripts) are linked from the wiki's SDK page.
Connection
java -cp xpologClient.jar com.xpolog.sdk.client.XpoLogSDKClient \ -xpologURL https://<host>:30443/logeye -user <user> -password <password> -api <command> <parameters>
xpologURL is mandatory; user and password are mandatory once security is active. Scripts define the two parts once — JAVA_RUN for the Java call and XPLG_CONN for the connection — and write %JAVA_RUN% %XPLG_CONN% on Windows or $JAVA_RUN $XPLG_CONN on Linux before each command; the examples below use the Linux form. Wrap every value that contains a space in quotes.
Settings and security
| Command | Parameters | Example |
|---|---|---|
settings | httpPort, sslPort, shutdownPort, ajpPort; agentMode true/false; activateSecurity true/false; activateSystemTimeZone, activateDynamicTimeZone, activateAppTagsTimeZone true/false (the user time-zone mode) | -api settings -httpPort 30304 -sslPort 30444 -ajpPort 8010 -shutdownPort 8096 -agentMode true -activateSecurity true |
settings (AppTag time zone) | appTags (comma-separated, as defined), timeZone (a Java time zone, or Default); applies only when the time-zone mode is AppTags | -api settings -timeZone "America/New_York" -appTags "APPTAG1, APPTAG2" |
securityUsers | name, userPassword, displayName (mandatory for a new user); override; userPolicy; selectedGroupsList (;-separated) | -api securityUsers -name ops -userPassword <pw> -displayName "Ops User" -userPolicy ViewOnly -selectedGroupsList "ops;All" -override true |
Accounts
| Command | Parameters | Example |
|---|---|---|
addSSHAccount | name; hostName; conType SFTP (default) or SCP; port (22); username, userPassword or privateKeyPath; description; override; enabled | -api addSSHAccount -name "web-01" -hostName 10.0.0.11 -conType SFTP -port 22 -username xplg -userPassword <pw> -override true -enabled true |
addRemoteXpoLogAccount | name; hostName; conType HTTP (default) or HTTPS; port; context (logeye); isCollected true = Agent Mode, false = proxy mode (default true); username, userPassword; description; override; enabled | -api addRemoteXpoLogAccount -name "agent-win-01" -hostName 10.0.0.21 -conType HTTPS -port 30443 -context logeye -isCollected true -username <user> -userPassword <pw> -override true -enabled true |
addExternalAccount | externalMediaType s3 (lower case); name; ema_custom_accessKey, ema_custom_secretKey; description; override; enabled | -api addExternalAccount -externalMediaType "s3" -name "archive-bucket" -ema_custom_accessKey "<key>" -ema_custom_secretKey "<secret>" -override true |
enableAccount | name; enabled true/false | -api enableAccount -name "web-01" -enabled false |
removeAccount | name | -api removeAccount -name "web-01" |
Tasks
| Command | Parameters | Example |
|---|---|---|
executeTask | name (case-sensitive) | -api executeTask -name "Nightly scan" |
executeScanTask | Run an Add Logs Directory scan once: name, id (avoids re-creating logs on repeated runs), parentFolderPath (ROOT->…), accountName (mandatory for SSH), scanPath, plus any ScanConfiguration parameter as -<param> <value> (scanMethod, timeZone, directoriesToInclude, filesToExclude, …) | -api executeScanTask -name "SCANNER_SDK" -id "SCAN12345" -parentFolderPath "ROOT->Servers" -accountName web-01 -scanPath "/var/log/" -scanMethod 0 -timeZone GMT -filesToExclude "*.zip,*.gzip,*.tar*" |
addScanTask | The same, saved as a scheduled task: add cron (Unix cron expression), override, assignedCollectionPolicy | -api addScanTask -name "SCANNER_SDK" -id "SCAN12345" -parentFolderPath "ROOT->Servers" -accountName web-01 -scanPath "/var/log/" -cron "0 * * * * ? *" -assignedCollectionPolicy "Default" |
addSyncLogTask | A Flux Log Sync task: name; configFilePath (the task XML); createConfiguration true/false; parentFolderPath; cron; assignedNode (the cluster node that runs it); override — see Sync task reference | -api addSyncLogTask -name "Sync site A" -configFilePath /opt/xplg/sync-a.xml -override true -cron "0/10 * * * * ? *" |
Folders and logs
| Command | Parameters | Example |
|---|---|---|
addLog | logName; logPath (ROOT->…, without the log name); filesPath (absolute path with optional name pattern, or for a Remote XPLG log its path in the remote tree); patterns (several separated by XPLG_SDK_SEP) or template; accountName (mandatory for SSH and Windows network sources); collectionPolicy (exact name); appTags (comma-separated) and overrideAppTags; timezone, charset; dataFilterQuery (empty clears it); override; to rename or move an existing log, newLogName or newLogPath with override true | -api addLog -logName "messages" -logPath "ROOT->Servers->web-01" -filesPath "/var/log/messages{string}" -template "Linux messages" -accountName web-01 -appTags "Linux OS" |
addLog (Windows Event Logs) | Needs an XPLG instance on Windows: winEventFileType (Application, Security, System, …); host (default localhost); unc true to read the .evtx file directly (faster, needs permissions) or filesPath to a custom .evtx location (never both); accountName for a Windows authentication account when the service account is not enough; logName, logPath, collectionPolicy, appTags, timezone, override | -api addLog -logName "Application" -logPath "ROOT->Windows Events->dc-01" -winEventFileType "Application" -host dc-01 -accountName win-collector -override true -appTags "Windows Event Logs" |
addFolder | folderPath | -api addFolder -folderPath "ROOT->Servers->web-02" |
removeMember | folderPath (removes the folder and everything in it) or logPath | -api removeMember -logPath "ROOT->Servers->web-01->messages" |
License, restart and patches
| Command | Parameters | Example |
|---|---|---|
license | files — the .lic file (relative or absolute path) | -api license -files license.lic |
restart | — | -api restart |
addPatch | type api; files — the patch zip; writeErrors false to ignore the connection error thrown while the server restarts | -api addPatch -type api -files /tmp/patch.zip -writeErrors false |
Typical scripts
- Onboard a server in a dynamic environment:
addSSHAccount, thenaddScanTask(orexecuteScanTask) under its folder — the logs appear and are collected without the console. - Decommission but keep the data:
enableAccount -enabled falseso XPLG stops connecting while retention keeps what was collected. - Decommission and drop the data:
removeAccountandremoveMember -folderPathon the server's folder. - Mass rollout: silent installations, then
settings(ports, Agent Mode, security) andsecurityUserson each instance — see Agent Mode.
The command-line update package
For V7 patches the wiki provides CLI_Update.zip with applyPatch.sh (Linux) and applyPatch.bat (Windows): put the patch zip and the package in one directory, extract the package, edit the script's placeholders for your environment (the README explains the parameters) and run it; then confirm the build on PortX > System > About and validate as on Upgrades. The host that runs it needs Java and HTTP/S access to every instance; a valid V7 license is required, and behind a load balancer publish from one node directly.
Next: Endpoint index
Source: XPLG wiki, pages 1597014018, 1597014014, 1602191443, 1594131988, 2054684673 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1597014018).
