Collector CLI (kilasec)
Every collector ships a read-only kilasec CLI for on-box troubleshooting: health, live sessions, the running policy, active probes, and a redacted support bundle — with firewall-style show / test / request verbs.
It runs inside the collector container and talks to the collector's loopback management API, so there is nothing to install or configure:
sudo docker exec -it kilasec-collector kilasec # interactive shell
sudo docker exec kilasec-collector kilasec show status # one-shotNothing here changes policy or configuration. Policy is edited in the console; the CLI shows what the collector is actually running.
Shell
Bare kilasec opens an interactive shell. The prompt is the collector's hostname, so several SSH tabs stay distinguishable.
- TAB completes and lists candidates;
?lists the valid next keywords at any point (show ?,show system ?). - Unambiguous prefixes expand, in the shell and one-shot:
sh sess a→show session all,t conn→test connectivity. - History persists across sessions; arrow keys work.
- Ctrl-C aborts the current line, not the shell.
exit,quit, orlogoutleaves. help(or--helpone-shot) prints the full command list.
Output modifiers
Pipe any command's output through one or more modifiers, JunOS / IOS style:
| Modifier | Effect |
|---|---|
| match <re> (alias include) | Keep lines matching the regex. |
| no-match <re> (aliases except, exclude) | Drop lines matching the regex. |
| begin <re> | Start output at the first matching line. |
| count | Print the number of lines instead. |
| last [n] | Keep the last n lines (default 10). |
kilasec> show events | match deny | last 5
kilasec> show session all | countModifiers don't combine with -f (a live stream has no end).
show
| Command | What it shows |
|---|---|
show status | Collector health, policy name and version, rule count, last-hour decision summary, load shedding if active, and the most recent diagnostics. |
show version | Image and version, policy version, and any auto-update revert or boot-failure breadcrumbs. |
show session all | Active agent sessions (last 15 minutes by default): user, IP, duration, calls, denies, model(s), and per-session cost. Flags: --window <sec>, --json. |
show session id <key> | One session in detail: activity span, distinct and repeated actions from the data plane's live counters, models, hosts, matched rules, and the session's recent decisions. The key can be the bare agent name. |
show running-config | Running policy and scope versions plus the data-plane config, with anything named like a secret masked. |
show policy | The rulebase as a numbered table: direction, action, match summary, profile, hit count, and disabled flag. --json prints the raw policy. |
show events | The most recent decisions (-n <count>, default 20). show events -f follows the live decision stream and reconnects if it drops. |
show diag | The collector's diagnostics timeline — the same entries as Logs → Collector in the console. |
show counters | Aggregate counters as JSON (--window <sec>, default 3600). Alias: show stats. |
show logs <proc> | Tail a collector process's log: dp, mgmt, pac, userid, or dirsync. -n <lines> (default 50), -f to follow. |
show system resources | Host and collector CPU / memory, plus a per-process table (data plane, management plane, PAC, User-ID, directory sync). |
show system disk | Free space on the collector's data directory and a per-item size breakdown. |
show user-id config | How the on-box User-ID listeners are configured (syslog port and allowed sources, mapping TTL). Console-configured agentless polling is under Identity → User-ID. |
show user-id status | Each domain controller's last successful poll and the actual last error, plus syslog and push counters. |
show user-id mapping [ip] | The recent IP → user table, or the mapping for one IP. |
test
Active probes. They evaluate or connect; they never change anything.
| Command | What it does |
|---|---|
test policy match --agent <name> [--host <h>] [--tool <t>] [--model <m>] [--action <a>] [--direction request|response] | Evaluates the running policy for a hypothetical request and prints the verdict and the matching rule (or <default>). Give at least one of --host, --tool, --model. |
test scope <host> | Whether traffic to that host is intercepted or passes through uninspected. |
test connectivity | The on-box preflight: data plane listening, TLS-inspection CA validity, enforcing (not degraded), cloud reachable, collector token accepted, clock skew vs. the cloud, file-descriptor limit, and disk space. Each failure carries an AFW-### code with its fix; exits non-zero if any check fails. |
test user-id [--dc <dc>] | Polls the domain controller(s) once and prints the underlying WinRM failure — authentication vs. the Security-log access grant vs. network — instead of a generic sync error. |
test connectivity runs the same checks as Run checks on the console's Health page; use the CLI when the collector can't reach the cloud to report.
request
| Command | What it does |
|---|---|
request support-bundle | Writes a redacted tarball to /var/lib/kilasec/support/kilasec-support-<timestamp>.tgz and prints the path. It contains status, version, the connectivity preflight, resources, disk, diagnostics, running config, counters, policy, scope, and the process logs. Values of anything named like a token, secret, password, or key, and any private-key block, are replaced with [REDACTED]. |
request support-bundle --include-events | Also includes the last 500 decision events. Off by default because events carry hostnames and usernames. |
request sync | Waits up to one sync interval and reports whether the policy version changed. |
/var/lib/kilasec is mounted from the host, so the bundle is already on the host at the same path — attach it to your support ticket from there.
Short forms
The flat aliases from the first release still work: kilasec status, sessions, config, policy, events, diag, stats, version.