netconfd-pro(1)

NAME
netconfd-pro - YANG-based NETCONF-over-SSH server

SYNOPSIS

   netconfd-pro [parameter=value...]

   netconfd-pro --help [brief | normal | full]

   netconfd-pro --version

DESCRIPTION
netconfd-pro is a YANG-based NETCONF server, which can be used with an SSH server such as OpenSSH. This version of netconfd-pro supports the YANG data modeling language defined in RFC 6020 and RFC 7950.

Refer to the online user manual for full details on using the netconfd-pro server:

https://docs.yumaworks.com/en/latest/netconfd/index.html

USAGE
Parameters can be entered in any order, and have the form:

   [start] name [separator [value]]

where:

    start == 0, 1, or 2 dashes (foo, -foo, --foo)

    name == parameter name

         Parameter name completion will be attempted
         if a partial name is entered.

    separator == whitespace or equals sign (foo=bar, foo bar)

    value == string value for the parameter.

         Strings with whitespace need to be double quoted
         (--foo="some string")

Some examples of valid command line parameters:

   foo=3
   -foo=3
   --foo=3
   foo 3
   foo=fred
   --foo "fred flintstone"

Partial parameter names can be entered if they are unique.

OPTIONS

--access-control=enum
    Controls how the yuma-nacm access control model will be enforced during server operation.

    Enum enforcing: All configured access control rules will be enforced.

    Enum permissive: All configured access control rules will be enforced for write and execute requests. All read requests will be allowed, unless the requested object contains the 'nacm:very-secure' extension. In that case, all configured access control rules will be enforced.

    Enum disabled: All read, write, and execute requests will be allowed, unless the object contains the 'nacm:secure' or 'nacm:very-secure' extension. If the 'nacm:secure' extension is in effect, then all configured access control rules will be enforced for write and execute requests. If the 'nacm:very-secure' extension is in effect, then all configured access control rules will be enforced for all requests. Use this mode with caution.

    Enum off: All access control enforcement is disabled. Use this mode with extreme caution.

--allow-leaflist-delete-all=boolean
    If 'true', then the delete-all operation is enabled for deleting instances of leaf-list objects. If 'false', then the delete-all operation is not enabled for deleting instances of leaf-list objects. The default is 'false'.

--allow-list-delete-all=boolean
    If 'true', then the delete-all operation is enabled for deleting instances of list objects. If 'false', then the delete-all operation is not enabled for deleting instances of list objects. The default is 'false'.

--allowed-user=string
    Name of a user that is allowed to have access to the server via network management sessions. If any configured then the user name must be in this list, unless the user is the superuser account. (type NcxName) Zero or more allowed users can be specified.

--alt-names=boolean
    Defines the alternate name search mode that should be used when resolving YANG node names in leafs or leaflists using the UrlPath data type.

--annotation=string
    This parameter identifies a YANG module that should only be checked for deviation statements used as annotations. These will be collected and applied to the real module(s) being processed. Annotations are similar to deviations except they are not advertised to the client. They are hidden and used to keep tool-specific YANG extensions out of the real YANG modules. Zero or more 'annotation' parameters may be present.

--audit-log=filespec
    Filespec for the server audit log file to use in addition to the normal log file or STDOUT.

--no-audit-log
    Flag indicating that no audit log should be created. Relevant if fileloc-fhs=true, otherwise no audit log is created unless 'audit-log' is set.

--audit-log-append
    If present, the audit log will be appended not over-written. If not, the audit log will be over-written. Only meaningful if the 'audit-log' parameter is also present.

--audit-log-candidate=boolean
    If 'true', then transactions to the candidate datastore will be recorded in the audit log. If 'false', then transactions to the candidate datastore will not be recorded in the audit log. The default is 'true'.

--audit-log-console-level=enum
    Sets the minimum logging level needed to log datastore audit records to the server console log. This does not affect output to the audit log. The default is 'debug'.

         off:    suppress all console audit-log output
         error:  generate console audit output for error level
         warn:   generate console audit output for warn level
         info:   generate console audit output for info level
         debug:  generate console audit output for debug level
         debug2: generate console audit output for debug2 level
         debug3: generate console audit output for debug3 level
         debug4: generate console audit output for debug4 level

--audit-log-events=bits
    Configures the audit log events that will be saved as audit records to the audit log. This does not affect debug logging to the server console log. The default is 'edit-running'.

         edit-candidate:
               Save candidate datastore edit events in the audit log.
               If the --audit-log-candidate parameter is set to true,
               or the <candidate> datastore is not present, then this
               bit will be ignored.
         edit-running:
               Save running datastore edit events in the audit log
         update-startup
               Save startup datastore update events in the audit log.
               If the <startup> datastore is not present then this
               bit will be ignored.
         client-session:
               Save client session start and end events in the audit log
         control-session:
               Save YControl session start and end events in the audit log
         acm-write-error:
               Save access control write access denied events in the audit log
         acm-exec-error
               Save access control execute access denied events in the audit log
         rpc-summary
              Save <rpc> summary records in the audit log.
         edit-data
              Add plain display output of the data that is being
              edited in an edit transaction. This bit has no affect
              unless the edit-candidate or edit-running bit is
              also set.

              Note that this added data could represent a security risk
              since it could expose sensitive configuration data contents.
              Use this option with caution!
         rpc-error
              Add an audit record for an RPC operation that causes
              an 'rpc-error' element to be returned to the client.

              If the 'rpc-summary' bit is enabled, then an rpc-error
              report will be added to the RPC summary records that
              have a 'status' or 'error'.

              If the 'rpc-summary' bit is not enabled then an RPC summary
              with rpc-error report will be added for RPC operations
              that cause an error to be returned.

--audit-log-level=enum
    Sets the minimum logging level needed to log datastore audit records to the audit log. This does not affect debug logging to the server console log. The default is 'info'.

         off:    suppress all audit-log output
         error:  generate audit output for error level
         warn:   generate audit output for warn level
         info:   generate audit output for info level
         debug:  generate audit output for debug level
         debug2: generate audit output for debug2 level
         debug3: generate audit output for debug3 level
         debug4: generate audit output for debug4 level

--audit-log-localtime
    If true, the audit log will include timestamps in the local time zone. If false, it will not include in the local time zone.

--autodelete-pdu-error=boolean
    If true, then configuration nodes provided in the edit payload (e.g., <config> element) that are conditional on 'when' statements must evaluate to true or else an operation-failed error will be returned. If false, then such 'false when' will be silently removed from the target datastore. The default is true.

--binary-display-maxlen=number
    The maximum number of bytes to display when dumping the contents of a binary value. Normally a message will be displayed showing the name and length.

    If this parameter is set to a value greater than zero then a standard 8-byte per line hex dump of the binary type will also be displayed for a maximum number of bytes set by this parameter. The default is zero.

--bundle=name-string
    The name of a SIL bundle to load at boot-time. A SIL bundle is 1 SIL library for multiple YANG modules. Zero or more bundles can be loaded, similar to the module parameter. Use the make_sil_bundle script to generate the SIL code for a SIL bundle.

--callhome-reconnect=boolean
    If 'true' the server will attempt to start a new callhome connection if the client closes the session. If 'false' the server will not attempt to start a new callhome session after the client closes the session. The default is 'false'.

    Be careful that the server is running with proper permissions because a successful connection that fails during authentication will cause a reconnect loop if this parameter is set to 'true'.

--callhome-retry-interval=uint16
    Specifies the number of seconds to wait after a connect attempt to the callhome server has failed before attempting another connect attempt to that server. The default is 60.

--callhome-retry-max=uint16
    Specifies the number of retry attempts the server should attempt to the callhome server before giving up. The value 0 indicates the server should never give up. The default is 10.

--callhome-server=string
    Specifies a callhome/SSH server that this server should attempt to initiate a callhome connection at boot-time. This string has the format:
         <server-id> '@' <server-addr> [ ':' <port-num> ]

            server1@192.168.0.101
            server1@192.168.0.101:12040

--callhome-sshd-command=string
    Specifies the command string used to invoke the SSH server when a callhome session is initiated. The default is "/usr/sbin/sshd".

--callhome-sshd-config=string
    Specifies the SSH server configuration file to use when invoking the SSH server when a callhome session is initiated. The default config file to use is a dynamic string using the pattern ch_sshd_config.<client>. It is located in the $HOME/.yumapro directory.

--callhome-subsys-command=string
    Specifies the netconf subsystem to use in the default ch_sshd_config files to specify the NETCONF subsystem for the incoming NETCONF session expected on the callhome session. The default is "/usr/sbin/netconf-subsystem-pro".

--callhome-tls-server=string
    Specifies a callhome/TLS server that this server should attempt to initiate a callhome connection at boot-time. This string has the format:
         <server-id> '@' <server-addr> [ ':' <port-num> ]

            server1@192.168.0.101
            server1@192.168.0.101:12040

--cert-default-user=string
    The username to use if no username mapping is found for a NETCONF over TLS session. This parameter is non-standard and should only be used for debugging. This parameter is not available unless image is built with DEBUG=1 parameter.

--cert-usermap=string
    Each entry specifies a certificate to user name mapping for NETCONF over TLS sessions. A mapping is a structured string using the form <user>@<fingerprint>. The 'user' field is the case-sensitive user name for the mapping.

    The 'fingerprint' field is a hex-string representation of the SHA-1 fingerprint for the X.509 certificate. It does not have to be complete. Usually 6 bytes should be sufficient to ensure uniqueness. The hex digits are not case-sensitive. At least 6 hex digits must be provided. A maximum of 20 hex digits can be provided.

    Example: admin@60:C8:5C:08:82:55

--confdir=string
    Specifies the CLI parameter configuration directory to use for extra configuration files. The server will check this directory for files that end with the suffix '.conf' and process them similar to the main configuration file. Other files will be ignored.

    Files will be processed in alphabetical order. The server will keep the first value set if a CLI leaf parameter is set multiple times.

    The CLI parameters are set in the following order:

        1) netconfd-pro command line
        2) --config file or /etc/yumapro/netconfd-pro.conf
        3) --confdir files or /etc/yumapro/netconfd-pro.d/

    If the --no-config parameter is present in step (1) then steps (2) and (3) will be skipped, and this parameter will be ignored. If this parameter is encountered in step (3) it will be ignored.

    Extra configuration files in step (3) have the exact same syntax as the configuration file used in step (2).

    Example extra config file testmods.conf:

         netconfd-pro {
           module acme-test1
           module acme-test2
           log-level debug2
           message-indent 1
           idle-timeout 0
         }

--config=filespec
    The name of the configuration file to use. The default config file is /etc/yumapro/netconfd-pro.conf will be not be checked if this parameter is present.

--no-config
    If present, then no configuration file will be loaded, even if the default configuration file is present.

--convert-subtree-filter=boolean
    If set to 'true' then subtree filters for retrieval operations might be converted to XPath expressions for processing.

    The subtree filtering algorithm has a minor flaw which can cause subtree containment nodes to be printed in the output even though a nested selection filter does not match. A containment node should be completely pruned from the result no selection filters within it produce a match. This only affects data that needs to be retrieved by the server with a GET2 callback.

    This issue has been fixed by converting a subtree filter to XPath and processing as if it were an XPath filter. If this parameter is set to 'true' then the conversion will be attempted. The conversion will be skipped if any of the following conditions are true
         - output format is not XML
         - input format is not XML
         - subtree filter contains any attribute match expressions
    This bugfix is not enabled by default because it might change filter output which was previously incorrect, but a client might be relying on the incorrect output anyway.

--create-empty-npcontainers=boolean
    An empty non-presence container has no meaning in NETCONF/YANG so it may be created by the server. In particular, the presence of the container node with no child nodes is semantically equivalent to the absence of the container node. This is the default style.

    If this parameter is set to false, then the server will not create empty NP containers.

--create-empty-npcontainers-ro=boolean
    If the create-empty-npcontainers parameter is set to 'true' then this parameter is not relevant and ignored.

    Otherwise this parameter controls whether empty non-presence containers will be created if there are no default child nodes but there are read-only child nodes.

    If this parameter is set to 'false', then the server will not create empty NP containers in this case.

    If this parameter is set to 'true', then the server will create empty NP containers in this case.

    This parameter MUST be set to 'true' for proper server XPath evaluation.

    The default is 'false'.

--datapath=list
    Internal file search path for configuration data files. Overrides the YUMAPRO_DATAPATH environment variable. This parameter affects the search for the startup configuration file (default: startup-cfg.xml).

--db-lock-retry-interval=number
    The number of milli-seconds to wait before attempting to get a DB-Config-Lock from the DB-API subsystem. The range is 10 .. 60000 milli-seconds. The default is 500 milli-seconds.

--db-lock-timeout=number
    The total number of seconds to wait before giving up on a DB-Config-Lock from the DB-API subsystem. The value zero indicates that no retries will be attempted if the lock is busy. The maximum timeout is 3600 seconds. The default timeout is 30 seconds.

--default-style=enum
    Selects the type of filtering behavior the server will advertise as the 'basic' behavior in the 'with-defaults' capability. The server will use this default handling behavior if the 'with-defaults' parameter is not explicitly set.

    Also, when saving a configuration to NV-storage, this value will be used for filtering defaults from the saved configuration.
      Enum values:
         report-all: report all values
         trim: remove leafs containing the YANG
            default value
         explicit: report only the nodes that have
            been created by the client or the server.
            This is the default value.

--deviation=string
    This parameter identifies a YANG module that should only be checked for deviation statements for external modules. These will be collected and applied to the real module(s) being processed.

    Deviations are applied as patches to the target module. Since they are not identified in the target module at all (ala imports), they have to be specified explicitly, so they will be correctly processed. Zero or more instances of this parameter are allowed.

--disable-imported-ok=boolean
    This parameter specifies whether the server should disable objects that are only imported, and not loaded via module or bundle parameter.

    These modules are marked as conformance-type='import' the YANG Library.

    Old behavior is 'false' which incorrectly adds all objects from the module into the schema tree and datastores.

    New behavior is to mark these objects as disabled in the obj_is_aneabled() function.

    Added in 23.10T-9 NOTE: Default is 'true' which is a change server behavior! MUST set to 'false' to preserve the old incorrect behavior.

--errmsg=string
    Specifies a replacement string for a specific error number. Can specify error message for 1 specific language.

    The 'num' component must match the <error-number> found in status_enum.h. New error enums are always added at the end of the list, so the numbers will not change.

    The 'lang' component should use the ISO-639-1 code Max length is 7 characters.

    The string has the format: '<num>:<lang>:error string'
      where:
          <num> = error number to use for error message
          <lang> = language code (en for English)
          error string = error string text

      Example:
           Replace error 117 (ERR_WB_WRITE_FAILED) 'db write failed'
           errmsg='117:en:The database could not be written'

--errmsg-lang=string
    Specifies the language code for the error-message language. This is only relevant if there are errmsg parameters for multiple languages loaded in the program. This value should use the ISO-639-1 code. The default is 'en'.

--eventlog-size=number
    Specifies the maximum number of notification events that will be saved in each notification replay buffer. Each event stream has its own replay buffer. The oldest entries will be deleted first. The default value is 1000.

--event-stream=string
    Specifies the name of a NETCONF event stream that should be created by the server. Each event stream has its own subscriptions and notification replay buffer. Each event stream has the same replay buffer size, using the shared eventlog-size parameter.

    Each generated notification is sent to one event stream. The YANG module instrumentation will select an event stream to use or the default event stream will be used. Copies of the same notification can be sent to multiple event streams. If the event-stream specified by the instrumentation is not available, then a warning will be generated in the log and the default event stream will be used instead.

    The default event stream is named 'NETCONF'. It cannot be replaced or removed. No other event stream can have this name. The standard NETCONF notification events are always sent to this event stream, unless there is an event-stream-map assigning the module to a different event stream.

--event-stream-map=string
    Each entry specifies a module name to event-stream mapping for notification handling. A mapping is a structured string using the form <module-name>@<stream-name>.

    The 'module-name' field is the case-sensitive module name for the mapping.

    The 'stream-name' field is the case-sensitive stream name for the mapping. It must match an 'event-stream' parameter or the default 'NETCONF'. Note there is no need to define a mapping for the 'NETCONF' stream since it will be picked if no other stream is selected.

    The built-in notifications such as 'replayComplete' and 'notificationComplete' are subscription-specific and always sent only to the subscription, not the event stream. Therefore these notifications are not affected by this parameter.

--feature-disable=module:feature
    Identifies a feature which should be considered disabled. Zero or more entries are allowed.

--feature-enable-default=boolean
    If true (the default), then features will be enabled by default. If false, then features will be disabled by default.

--feature-enable=module:feature
    Identifies a feature which should be considered enabled. Zero or more entries are allowed.

--fileloc-fhs=boolean
    If true, then the server should use Filesystem Hierarchy Standard (FHS) directory locations to create and store server data. May need to run as root.

    The FHS server log file will be created by default unless the 'log' parameter is used, then that location will be used instead.

    The FHS audit log file will be created by default unless the 'audit-log' parameter is used, then that location will be used instead. If the 'no-audit-log' parameter is present then no audit log will be created.
                  File Type     Example
                  ----------------------------------------------------
                  server log:  /var/log/netconfd-pro/server.log
                  audit log:   /var/log/netconfd-pro/audit.log
                  config file: /var/lib/netconfd-pro/startup-cfg.xml
                  TXID file:   /var/lib/netconfd-pro/startup-cfg-txid.txt
                  backups:     /var/lib/netconfd-pro/backups/backup1.xml
                  PID file:    /var/run/netconfd-pro/netconfd-pro.pid
                  AF socket:   /var/run/netconfd-pro/ncxserver.sock
    If false then the server will use $HOME/.yumapro and other file locations to store server data.
                  File Type     Example
                  ----------------------------------------------------
                  server log:  STDOUT; no server log created by default
                  audit log:   STDOUT; no audit log created by default
                  config file: $HOME/.yumapro/startup-cfg.xml
                  TXID file:   $HOME/.yumapro/startup-cfg-txid.txt
                  backups:     $HOME/.yumapro/backups/backup1.xml
                  PID file:    $HOME/.yumapro/netconfd-pro.pid
                  AF socket:   /tmp/ncxserver.sock

--ha-enabled=boolean
    Specifies whether the YP-HA protocol should be enabled, allowing High Availability Datastore Replication mode to be supported. If this parameter is enabled then the ha-server-key and ha-server pool must be configured. The default is false.

--ha-initial-active=string
    Specifies the server name for the initial YP-HA active server. This is ignored unless ha-enabled=true. There is no default.

    This parameter is used to hardwire the initial High Availability roles instead of setting it in the yp-system init1 or init2 callback functions. If this parameter is the same as 'server-id' then this server will be the initial YP-HA active server.

    This parameter is intended for debug mode only. The real operational mode should use signalling only to set the HA mode. Otherwise if the server reboots it will use the configured HA mode, which may not be correct if it has been changed during runtime. There is no default for ha-initial-active parameter.

--ha-port=number
    NOT IMPLEMENTED! DO NOT USE! Specifies the default port to use for YP-HA protocol messages. Unless otherwise specified, this port number will be used by a standby server attempting to connect to the active server. (This parameter is not used yet). The type is inet:port-number. The default value is 8088,

--ha-server=string
    Specifies a server in the YP-HA server pool. This string has the format:
         <server-id> '@' <server-addr> [ ':' <port-num> ]

            server1@192.168.0.101
            server1@192.168.0.101:12040

    The server running with this configuration must be listed in the ha-server pool. The server-id parameter must be match the entry for this server. There must be at least 2 entries present to configure an HA server pool. This must be done if the ha-enabled parameter is set to 'true'. This string matches the server-id for the server. There is no default for this parameter.

--ha-server-key=string
    Specifies the magic string the standby server must present to the active server during registration. Used to prevent servers from going the wrong HA pool. If not set then the active server will reject the YP-HA connection. This parameter must be set if the ha-enabled parameter is set to 'true'. There is no default for ha-server-key.

--ha-sil-standby=boolean
    Specifies whether the edit callbacks such as SIL, SIL-SA and HOOK instrumentation will be invoked if the server is operating in HA standby mode The default is false.

--hello-timeout=number
    Specifies the number of seconds that a NETCONF session may exist before the client hello PDU is received. A session will be dropped if no hello PDU is received before this number of seconds elapses.

    If this parameter is set to zero, then the server will wait forever for a hello message, and not drop any sessions stuck in 'hello-wait' state.

    The hello timer starts when a session is started within the server, and therefore using a session resource that counts against the 'max-sessions' limit.

    For NETCONF over SSH sessions the session starts after the SSH session is setup and the 'netconf' subsystem is invoked. The SSH server has its own timeout values for maximum session startup time. For NETCONF over TLS sessions the session starts when the TCP connection is accepted.

    Setting this parameter to zero may permit denial of service attacks, since only a limited number of concurrent sessions are supported by the server. (range 0 | 10 .. 3600). The default value is 600 seconds (10 minutes).

--help
    Print this help text and exit. The help-mode choice (--brief, --normal, or --full) may also be present to control the amount of help text printed. This parameter can be modified with the 'brief' and 'full' parameters.
       > netconfd-pro --help --brief
       > netconfd-pro --help --full

--hide-module=module-name
    Each usage specifies the name of a module to hide from advertisements to client sessions. If the specified module name is loaded into the server, then this parameter will cause it to be omitted from the following data structures:
             - YANG 1.0 <hello> message
             - /netconf-state/schemas/schema list
             - /modules-state/module list
    This parameter will prevent the client from knowing about the hidden module. If an advertised module imports a hidden module then it is very likely a client will not be able to use the advertised module because of the missing imports.

    This parameter can be dangerous! It does not prevent loading or enabling of the module. The SIL code is responsible for not returning any data to a client using a hidden module.

    Use of this parameter violates conformance to NETCONF, RESTCONF, and the YANG Library. Use with caution, only for modules that are not accessible by clients.

--highres-event-time=boolean
    If set to 'true' then the 'eventTime' leaf value in all <notification> messages will contain a microseconds field. If 'false' then this field will not contain a microseconds field.

    This field is always 6 digits long and represents a fraction of one second as the number of microseconds.

    Note: the default behavior is different than the low resolution format used in previous releases. The date-and-time data type includes this optional field so a client should accept the value. The default is 'true'.

--home=dirspec
    Directory specification for the home directory to use instead of HOME. Note: This parameter cannot be set in the netconfd-pro.conf config file. Only the command line or environment variable can be used.

--idle-timeout=number
    Specifies the number of seconds that a session may remain idle without issuing any RPC requests. A session will be dropped if it is idle for an interval longer than this number of seconds.

    Sessions that have a notification subscription active are never dropped.

    If this parameter is set to zero, then the server will never drop a session because it is idle. (range 0 | 10 .. 360000). The default value is 3600 seconds (1 hour).

--import-version-bestmatch=boolean
    Specifies if the bestmatch search feature should be used for import resolution when no revision-date field is specified in the import-stmt.

    If 'true' then the server will scan the module search path during startup and determine the most recent revisions of each module. If a module is loaded or imported and no revision date is specified then the bestmatch revision will be used.

    This feature requires some additional memory and bootup processing time. It should be avoided if possible. The module search path on the server should only contain the modules and revisions that are needed by the server.

    If set to 'false', then the bestmatch feature will not be enabled. It is possible for the server to find and load the wrong version of a module during imports processing. For example, while loading module A, it imports module B. Then module B is loaded but a revision is specified (e.g., --module=B@2019-06-20). This can cause errors during callback registration such as 'definition not found' or 'segment not found', depending on how the module has changed. The default is 'false'.

--indent=number
    Number of spaces to indent (0..9) in formatted output. The default is 2 spaces.

--insecure-ok=boolean
    Specifies if insecure NETCONF over TLS should be allowed. If true then X.509 certificates will be accepted even if they cannot be verified. Used for debugging only! This parameter is only available if the image was built with the DEBUG=1 parameter.

--library-mode=boolean
    If true, then the server will operate in YANG module library mode. It will find all the YANG modules and make them available for <get-schema> operations. The default is false.

    The following NETCONF operations are available when the server is operating in library mode:

          ietf-netconf:get
          ietf-netconf:get-config
          ietf-netconf-monitoring:get-schema
          yuma-system:restart
          yuma-system:shutdown

--loadpath=pathlist
    Directory load path for YANG or YIN modules. This will be checked before the modpath setting if present when finding modules. After all module and bundle parameters have been processed, this load path will be checked and the server will attempt to load any modules not already loaded. Overrides the YUMA_LOADPATH environment variable. There is no default for the loadpath parameter.

--log=filespec
    Filespec for the log file to use instead of STDOUT. If this string begins with a '~' character, then a username is expected to follow or a directory separator character. If it begins with a '$' character, then an environment variable name is expected to follow. If this parameter is used on the command line then the --log-append parameter must also be present on the command line if append mode is desired.

--no-log
    Flag indicating that no main log file will be created. This is usually only relevant if --fileloc-fhs is 'true'. In this case the default log file will not be created. The --log-level parameter will be set to 'none'. This parameter will be ignored if the --log parameter is set. This parameter has no affect on the audit-log or syslog logging.

--log-append
    If present, the log will be appended not over-written. If not, the log will be over-written. Only meaningful if the log parameter is also present.

--log-backtrace=number
    If present, log output will include traceback detail for each log message, subject to further filtering by --log-backtrace-level and/or log-backtrace-stream qualifiers. Bit values:

         error:  print errors
         warn:   print warnings
         info:   print generally interesting trace info
         debug:  print general debugging trace info
         debug2: print verbose debugging trace info
         debug3: print very verbose debugging trace info
         debug4: print maximum debugging trace info

--log-backtrace-detail
    If present in conjunction with --log-backtrace log messages will include 'detailed' backtrace information (if supported by the compiler).

--log-backtrace-level=bits
    Indicates for which debug level(s) backtrace info will be generated. Param string is an XSD list: a double quoted series of whitespace separated (level) strings like error warn debug

--log-backtrace-stream=bits
    Indicates in which log stream(s) backtrace info will be included. Param string is an XSD list: a double quoted series of whitespace separated (log stream) strings like logfile syslog

--log-console
    Duplicate log messages via STDOUT or log file when log-syslog

--log-event-drops
    Indicates if a log entry would be generated when a notification is dropped because the specific notification events are disabled with an event-filter configuration entry.

--log-header=string
    Indicates in which log stream(s) backtrace info will be included. Param string is an XSD list: a double quoted series of whitespace separated (log stream) strings like logfile syslog

--log-highres-datetime=boolean
    If set to 'true' then a log timestamp string will contain a microseconds field. If 'false' then this field will not contain a microseconds field.

    This field is always 6 digits long and represents a fraction of one second as the number of microseconds. The log-header parameter is affected by this setting. The default is false.

--log-level=enum
    Sets the debug logging level for the program.

--log-mirroring
    Duplicate log messages via STDOUT or log file when log-syslog is configured

--log-pthread-level=enum
    Sets the pthreads debug logging level for the program. The log-levels are additive.

         off:    suppress all errors
         error:  print errors
         warn:   print warnings
         info:   print generally interesting trace info
         debug:  print general debugging trace info
         debug2: print verbose debugging trace info
         debug3: print very verbose debugging trace info
         debug4: print maximum debugging trace info

--log-stderr
    Output log-level error messages via STDERR rather than STDOUT

--log-suppress-ctrl
    If present, strip certain control characters from output in order to modify log formatting.

--log-syslog
    If present, direct log messages to syslog instead of STDOUT or log filespec.

--log-syslog-level=enum
    Sets the syslog debug logging level for the program. The log-levels are additive.

         off:    suppress all errors
         error:  print errors
         warn:   print warnings
         info:   print generally interesting trace info
         debug:  print general debugging trace info
         debug2: print verbose debugging trace info
         debug3: print very verbose debugging trace info
         debug4: print maximum debugging trace info

--log-vendor
    If present, log messages will be directed to a customer-written and registered callback function. This functionality is defined by an API specified in the YumaWorks API Reference Manual. In the absence of a registered callback, this parameter will direct logging messages to syslog in order to facilitate standalone testing.

--log-vendor-level=enum
    Sets the vendor debug logging level for the program. The log-levels are additive.

         off:    suppress all errors
         error:  print errors
         warn:   print warnings
         info:   print generally interesting trace info
         debug:  print general debugging trace info
         debug2: print verbose debugging trace info
         debug3: print very verbose debugging trace info
         debug4: print maximum debugging trace info

--match-names=enum
    Defines the search mode that should be used when resolving YANG node names in leafs and leaf-lists using the UrlPath data type. Enum values:

         exact:
            The name must exactly match the node name
            for all characters in both name strings.
         exact-nocase:
            The name must match the node name
            for all characters in both name strings.
            Strings are not case-sensitive.
         one:
            The name must exactly match the first N
            characters of just one node name, which
            must be the only partial name match found.
         one-nocase:
            The name must exactly match the first N
            characters of just one node name, which
            must be the only partial name match found.
            Strings are not case-sensitive.
         first:
            The name must exactly match the first N
            characters of any node name. The first one
            found will be used.
         first-nocase:
            The name must exactly match the first N
            characters of any node name. The first one
            found will be used. Strings are not
            case-sensitive.

--max-burst=number
    Specifies the maximum number of notifications that should be sent to one session, within a one second time interval. The value 0 indicates that the server should not limit notification bursts at all. The default value is 10.

--max-cli-sessions=number
    Specifies the maximum number of concurrent CLI sessions that can be active at one time. The value 0 indicates that no artificial session limit should be used. The max-sessions parameter has precedence. Range [0 .. 1024] The default value is 0.

--max-chunk-size=number
    Specifies the size of session buffer that should be used in the server. This will affect the size on a NETCONF 1.1 chunk sent to any client or subsystem session.

    Setting this parameter to a high value can cause fragmentation of IP packets. First available 24.10T-6.

    Will apply to all NETCONF packets sent to the client. This includes Push updates over the UDP-Notif transport protocol. If the MTU is 1500, then typically, there will be 1472 bytes available for the UDP payload.

    If a 'max-segment-size' leaf is not set for a UDP-Notif receiver then this value will be used as the default.

    This range is restricted to 9000 in the 24.10T release train. It may be changed in a future release. The default is 1400.

--max-getbulk=number
    Specifies the maximum number of getbulk entries to request from a GET2 callback. This value will be used in the get2cb 'max_entries' field. The value 0 is used to indicate there is no max and the GET2 callback can return as many getbulk entries as desired. This is the default for leaf-list GET2 callbacks. The default is 10.

--max-lock-hold-time=number
    Specifies the maximum number of seconds to allow a session to hold a global NETCONF datastore lock.

    If zero, then no maximum lock hold time will be used. This is the behavior specified by RFC 6241.

    If non-zero, then the standard will not be followed. Instead, a global lock will be released if held by a session too long. This timeout only applies to the 'lock' operation. Partial locks are not affected at all by this parameter.

    If a lock is released, then the locking session will not be warned or notified in anyway. An 'info' log entry is generated such as:

        Max Lock Hold Time timeout for datastore running
        Locked by session 3 at 2023-03-21T23:35:55Z

    If a session has an active notification subscription, or if the client sends at least one request periodically, then the '--idle-timeout' parameter will not be enforced. It is possible for a NETCONF session to hold a global datastore lock indefinitely.

    This parameter allows the datastore lock time to be configured so it does not depend on the '--idle-timeout' parameter setting.

    Using this parameter with a value greater than zero will violate RFC 6241 procedures for the 'lock' operation. A minimum lock hold time of 5 seconds is allowed.

        - If a timeout occurs the datastore lock will be
          dropped, but the session will not be dropped.

        - If an edit is in progress, it will not be
          affected. Only the NETCONF lock will be
          released.

        - The server will output an 'info' log message
          if a datastore lock is released by the server
          due to the lock hold time exceeding this value.
    The data type used is an unsigned short integer.

            type uint16 {
              range "0 | 5 .. max";
            }
            units seconds;
            default 0;

--max-sessions=number
    Specifies the maximum number of concurrent sessions that can be active at one time. The value 0 indicates that no artificial session limit should be used. (range 0 .. 1024). The default is 8.

--max-strlen=number
    The maximum number of bytes in length that will be accepted for a quoted string, by the internal token parser. This affects YANG and JSON input processing. Set this value to allow large binary leafs to be parsed by the server. This value includes 1 byte for the string termination character. The range is 65536 to INT_MAX. The default is 262144 (256K).

--max-per-user-sessions=string:number
    Specifies the maximum number of concurrent sessions that can be active at one time by the specified user.

    This parameter will override the 'max-user-sessions' parameter for the specified username, if both are present.

    The max-sessions parameter has precedence, so setting this parameter higher than 'max-sessions' will have no effect.

    This parameter does not apply to YControl sessions. Zero or more entries are allowed. The length of each parameter must be between 3 and 1029 characters. The value is a formatted string and it must not contain any whitespace.

             username:number

    The username field must be between 1 and 1024 characters, and must not contain a colon ':' character.

    The username field must be followed by a single colon ':' character, which must be followed by the number field.

    This value will be compared to the username assigned to a client session when it is started. The client session will be dropped if the session limit is exceeded.

    The number field must be between 0 and 1024. This must be in decimal with no leading zeroes, and must contain between 1 and 4 characters. The value 0 indicates that no artificial session limit should be used for the specified user.

    Invalid entries will cause the server to terminate with an error.

    A duplicate username will be ignored and a warning will be printed to the log.

    Available starting in 23.10-5.

               Example:
                  - limit total client sessions to 10
                  - limit total number of sessions by a single user to 2
                  - except user 'admin1', and a limit of 5 for usr 'admin2':

                   max-sessions 10
                   max-user-sessions 2
                   max-per-user-sessions admin1:0
                   max-per-user-sessions admin2:5

--max-user-sessions=number
    Specifies the maximum number of concurrent sessions that can be active at one time by one user. The value 0 indicates that no artificial session limit should be used.

    The max-sessions parameter has precedence, so setting this parameter higher than 'max-sessions' will have no effect. This parameter does not apply to YControl sessions. The max value is 1024. The default value is 0.

--message-indent=number
    The number of spaces to indent for each level of output in a protocol message, e.g. NETCONF request. The value zero means no indent, just line feeds. The value -1 means no indent and no line feeds either. (range -1 .. 9) [d:-1]

--modpath=list
    Directory search path for YANG and YIN files. Overrides the YUMAPRO_MODPATH environment variable.

--module=string
    YANG or YIN source module name to load at startup. The server will attempt to load the specified module and its corresponding server instrumentation library (SIL) .

    If this string represents a filespec, ending with the .yang or .yin extension, then only that file location will be checked.

    If this string represents a module name, then the module search path will be checked for a file the .yang or .yin extension.

    If this string begins with a '~' character, then a username is expected to follow or a directory separator character. If it begins with a '$' character, then an environment variable name is expected to follow.

          ~/some/path ==> <my-home-dir>/some/path

          ~fred/some/path ==> <fred-home-dir>/some/path

          $workdir/some/path ==> <workdir-env-var>/some/path

--module-tagmap=string
    Specifies a module tag mapping for use in module tags registry. The format is <modname>@<tag-string>. Examples:
         ietf-system@ietf:system-management
         openconfig-system@vendor:openconfig:system-management
         example-system@vendor:example.com:system-management

--netconf-capability=uri
    Specifies a URI value that should be added to the server NETCONF <hello> message as a NETCONF <capability> URI and monitoring data in the /netconf-state/capabilities container. type inet:uri; No default value.

--netconf-tls-address=string
    Specifies the IP address to listen on for NETCONF over TLS messages. The default is '0.0.0.0'.

--netconf-tls-certificate=string
    Contains the file path specification for the file containing the server SSL certificate, used for the NETCONF over TLS protocol. The default is '$HOME/.ssl/netconfd-pro.crt'.

--netconf-tls-key=string
    Contains the file path specification for the file containing the server SSL private key, used for the NETCONF over TLS protocol. The default is '$HOME/.ssl/netconfd-pro.key'.

--netconf-tls-port=number
    Specifies the TCP port to listen for NETCONF over TLS messages. The default is 6513.

--netconf-tls-trust-store=string
    Contains the file path specification for the file containing the server SSL trust-store, or the path specification for the directory to use for finding trusted certificates. If the default value is used and the file is not found, then the default directory location '/etc/ssl/certs' will be used. The default is '$HOME/.ssl/trust-store.pem'.

--no-nvstore
    If present, the server should not load or save using the normal APIs during transaction management. The 'start' choice will be ignored (e.g., --no-startup)) and the server will not attempt to load a startup-cfg.xml file. Transactions will not be saved to NV-storage at all. Any external NV-storage callbacks will be ignored. Use this mode if NV-load and NV-storage are handled internally and not via the startup-cfg.xml file. The default is not present.

--port=number
    Specifies the TCP ports that the server will accept connections from. These ports must also be configured in the /etc/ssh/sshd_config file for the SSH master server to accept the connection and invoke the netconf subsystem.

    Up to 4 port numbers can be configured.

    If any ports are configured, then only those values will be accepted by the server.

    If no ports are configured, then the server will accept connections on the netconf-ssh port (tcp/830).

--protocols=bits
    Specifies which NETCONF protocol versions the server will attempt to use. The empty set is not allowed. The values 'netconf1.0' and 'netconf1.1' are supported. The default is to enable both NETCONF protocol versions.

--push-max-operational=number
    Specifies the maximum number of on-change push subscriptions that can be in use at once for the <operational> datastore. The value zero will disable on-change subscriptions for the <operational> datastore. Setting this parameter to a high value can increase the resources used by the server. Use with extreme caution. The default value is 4.

--push-max-periodic=number
    Specifies the maximum number of periodic push subscriptions that can be in use at once. The value zero will disable periodic subscriptions. Setting this parameter to a high value can increase the resources used by the server. Use with extreme caution. The default value is 16.

--push-min-dampening=number
    Specifies the minimum value for the 'dampening-period' parameter that will be accepted for an on-change push subscription. The units are centiseconds. The value 100 is equal to 1 second. Setting this parameter to a low value can increase the resources used by the server. Use with extreme caution. The default value is 100.

--push-min-period=number
    Specifies the minimum value for the 'period' parameter that will be accepted for a periodic push subscription. The units are centiseconds. The value 100 is equal to 1 second. Setting this parameter to a low value can increase the resources used by the server. Use with extreme caution. The default value is 100.

--push-simop-enabled=boolean
    Specifies if the simulated on-change push subscriptions should be enabled for the <operational> datastore. The value false will disable simulated on-change subscriptions for the <operational> datastore. Real on-change subscriptions reported from subsystems are not affected by this parameter. The default value is true.

--push-simop-patch-update=boolean
    Specifies the notification message that should be used for a simulated on-change push subscription. If 'true' then the standard <push-change-update> notification will be used for the report. This format uses YANG Patch to report individual edits. If 'false' then the standard <push-update> notification will be used for the report. This will make the subscription similar to a periodic subscription, except that an update is only sent when the content changes. This is not conformant with RFC 8641 requirements. Real on-change subscriptions reported from subsystems are not affected by this parameter. The default value is true.

--push-simop-period=number
    Specifies the value for the 'period' parameter that will be used for simulated operational on-change push subscription. The current value will be checked periodically using this parameter value. If an update is sent then the dampening-period for this subscription will be enforced. The units are centiseconds. The value 100 is equal to 1 second. Setting this parameter to a low value will increase the resources used by the server. Use with extreme caution. The default value is 500.

--remove-schema-aug-leafs=boolean
    Remove the 'conformance' and 'module-type' leafs from the /netconf-state/schemas/schema list. The deprecated leafs are added if --with-yumaworks-system is true. They will be removed from the 22.10 release train when the status is changed to obsolete. This parameter will be forced to the value 'true' if the server is built with the REMOVE_SCHEMA_AUG_LEAFS=1 compile flag.

    The default is 'false' to maintain backward compatibility with previous releases. The value 'true' should be used since the information from these deprecated leafs is available in the YANG Library data structures.

--restconf-capability=uri
    Specifies a URI value that should be added to the server as monitoring data in the /restconf-state/capabilities container. type inet:uri; No default for the restconf-capability parameter

--restconf-default-encoding=string
    Specifies the default response encoding to use if the incoming request does not have an indication of preferred content type (e.g., no Content-Type header, no Accept header). Values are 'xml' and 'json'. The default is 'json'.

--restconf-server-url=uri
    The starting string for the server URL to use in Location header lines returned by RESTCONF. The default is 'http://localhost'.

--restconf-strict-headers=boolean
    If set to 'true' the server will only accept requests with normative Accept and Content-Type headers entries specified in the RFC 8040. The Accept header must not be empty; otherwise the 'not acceptable' error will be returned.

     Normative Accept header:
      application/yang-data+xml,application/yang-data+json;q=0.9

     Normative Content-Type header:
      application/yang-data+xml
      application/yang-patch+json

    If set to 'false', the server will try to accept not normative header entries.

     Acceptable not normative Accept headers:
      application/xml,application/json;q=0.9

     Acceptable not normative Content-Type headers:
      application/xml
      application/json
      text/xml
    The default is false.

--return-empty-npcontainers=boolean
    If set to 'true' then empty configuration NP containers that do not have any read-only child nodes are returned in retrieval operations.

    An empty NP container is defined an a non-presence container that has no child nodes or only child nodes that are empty NP containers.

    The container is not empty if it has:

        -  any child nodes besides empty NP containers
        -  any default child nodes
        -  any read-only child node

    Normally these empty NP containers are returned only if the 'with-defaults' retrieval parameter or 'default-style' CLI parameter is 'report-all'.

    If this parameter is 'false' then empty NP containers will not be returned in retrieval operations at all.

    Introduced in 23.10-6.

    The default setting is 'true' for backward compatibility but the recommended setting is 'false'.

--return-error-with-data=boolean
    Controls whether <rpc-error> nodes will be returned in RPC output for retrieval operations

          - get
          - get-data on <operational>

    If true, and if a GET2 callback returns an error, an <rpc-error> will be returned after all data has been returned. Make sure the client is capable of handing this non-standard extension to the <rpc-reply> element encoding.

    If 'false', then no RPC errors will be returned in addition to data, for these operations. The default value is 'false'. Introduced in 23.10T-7

--return-status=boolean
    If 'true', then the server will exit with a return status that represents a status code, found in ncx/status_enum.h. If 'false' then the value zero will be returned by the server. The default is 'false'.

--running-error=enum
    If 'stop', then errors in the running configuration will be treated as fatal errors. If 'continue', the server will attempt to continue if any validation errors are found in the running configuration at startup. The default is 'stop'.

--runpath=pathlist
    Internal file search path for executable modules. Overrides the YUMAPRO_RUNPATH environment variable.

--save-owners=boolean
    Indicates if owner names should be saved as meta-data in the configuration data. Use 'with-owners' parameter to retrieve. Default is false.

--server-id=string
    Server Identifier string to use for this server. Used in YControl and SIL-SA messages to identifier the server to all subsystems. Used in YP-HA to identify this server in the YP-HSA server pool. (type nt:NcxName). The default is 'server1'.

--server-root=string
    Specifies the Server Root Identifier string to use for this server. Used to run the server in Multi-Instance Mode. Every server running on the same host must have a unique server-root value. If this leaf is not present, then the server will run in Single-Instance Mode. If this parameter is provided then the --fileloc-fhs` parameter must also be provided (if it is set to 'true').

--session-sync-mutex
    If present, force synchronous request processing (pthread version only). Default is not to force synchronous request processing.

--sil-cc-callback-all=boolean
    If 'true', the server will invoke Commit Completeness callbacks for all edit transactions, not just for the <commit> operation. The following operations will cause Commit Completeness callbacks to be invoked:

               - <commit>
               - <copy-config>
               - <edit-config>
               - <load-config>  (internal boot)
               - <load-config>  (confirmed commit timeout)
               - <restore>
               - <validate>

    All Commit Completeness callbacks are invoked if the target is the <running> datastore.

    The Validate Complete Callback is invoked for the <candidate> datastore only if the --sil-validate-candidate parameter is set to 'true'.

    The Apply Complete, Commit Complete, and Rollback Complete callbacks are only invoked if the target is the <running> datastore.

    The callback input parameters may be different for each operation. Refer to the YumaPro Developer Manual for details.

    If 'false', the server will invoke Commit Completeness callbacks only for the <commit> operation.

    The default is 'false'. Introduced in 22.10-8.

--sil-delete-children-first=boolean
    If 'true', the server default behavior will be to treat all data deletion operations as if the ncx:sil-delete-children-first extension is present. A child node will be checked for a SIL callback before it is deleted.

    If 'false' the server default behavior will be to invoke SIL callbacks for deletion of child nodes only if the ncx:sil-delete-children-first extension is present. The default is 'false'.

--sil-invoke-false-when-deletes=boolean
    If 'true' then a SIL or SIL-SA callback will be invoked for false-when auto-deletion data nodes during the edit transaction. If 'false' then a SIL or SIL-SA callback will not be invoked for false-when auto-deletion data nodes. The default is 'false'. Introduced in 23.10-12.

--sil-invoke-for-defaults=boolean
    If 'true' then a SIL or SIL-SA callback will be invoked for default data nodes during the edit transactions. If 'false' then a SIL or SIL-SA callback will not be invoked for default data nodes. The default is 'true'.

--sil-missing-error=boolean
    If 'true' then when a module is loaded, but the SIL library code for the module is not found, an error will be returned instead of a warning printed.

    If 'false' then when a module is loaded, but the SIL library code for the module is not found, no error will be returned. Instead, only a warning will be printed. The default is 'false'.

--sil-prio-reverse-for-deletes=boolean
    If set to 'true' this parameter for netconfd-pro dictates that the SIL priority for DELETE operations will be reversed. This parameter can be used to delete leafref nodes with referenced by node in reverse order. If 'false' then the SIL priority will not be reversed. The default is "false".

--sil-root-check-first=boolean
    If 'true', the server will perform a YANG validation check before the SIL validate callbacks are invoked for an edit-config operation. This is always done for a load-config or commit operation. If 'false', the server will invoke the SIL validate callbacks before performing a YANG validation check. Instead the validation will be done before the SIL apply callback. The default is 'true'.

--sil-skip-global-edit-validate
    If set to 'true', the server skips the Global Edit callbacks invocation for the Validate Phase. If 'false', the server invokes the Global Edit callbacks for the Validate Phase as usual. The default is 'false'.

--sil-skip-global-edit-apply
    If set to 'true', the server skips the Global Edit callbacks invocation for the Apply Phase. If 'false', the server invokes the Global Edit callbacks for the Apply Phase as usual. The default is 'false'.

--sil-skip-load
    If present, the server will not invoke the SIL callbacks during initial system initialization when the startup configuration file is loaded into the running datastore.

--sil-test-get-when=boolean
    If 'true', the server will evaluate 'when' statements for GET2 callback requests for config=false nodes. If 'false' then the SIL or SIL-SA callback is expected to test the 'when' condition internally somehow and return a no-instance error if the condition is 'false'. The default value is 'false'.

    This parameter can be overridden by the ywx:sil-test-get-when YANG extension. If that extension is found for an operational data node then its value will be used instead of this parameter.

--sil-validate-candidate=boolean
    If 'true', the server will invoke the VALIDATE phase for SIL and SIL-SA callbacks when each edit is made to the candidate datastore.

    If 'false', the server will not invoke the VALIDATE phase for SIL and SIL-SA callbacks when each edit is made to the candidate datastore.

    Transaction performance will be improved if the extra VALIDATE phase callbacks are skipped. Acceptance of an individual edit to the candidate does not mean the SIL or SIL-SA will accept that edit when combined with all edits (during the commit operation).

    In either case the server will invoke the VALIDATE phase callbacks when an attempt to commit the candidate datastore is done or when a <validate> operation is done on the candidate datastore.

--simple-json-names=boolean
    If true, the server will NOT output name of the module in which the data node is defined. If false, a namespace-qualified member name will be used for all members of a top-level JSON object and then also whenever the namespaces of the data node and its parent node are different.

--sm-config=string
    Specifies the XML or JSON file to read which contains the configuration data needed to create desired mount-points. This config file controls what is in the YANG Library for each mount-point label. If this parameter is set then the file must be found and be valid or the server will exit with an error. If --with-schema-mount=false this parameter is ignored.

--sm-config-encoding=enum
    Specifies the Schema Mount Config file encoding. Based on this encoding the server will parse the config file accordingly.
      Enum values:
        json:
           Identify JSON encoding.
        xml:
           Identify XML encoding.

--snmp-agent-role=enum
    Specifies the SNMP agent role. The default is 'master'.
      Enum values:
        master:
           A 'master' agent that is available on the standard transport
           address and that accepts SNMP protocol messages.
        subagent:
           An agent acting in a subagent role performs the
           following functions:
               -  Initiates AgentX sessions with the master agent
               -  Registers MIB regions with the master agent
               -  Instantiates managed objects
               -  Binds OIDs within its registered MIB regions to actual
                  variables
               -  Performs management operations on variables

--snmp-subagent-priority=number
    Specifies SNMP subagent priority. A value between 1 and 255, used to achieve a desired configuration when different sessions register identical or overlapping regions. The default is 127. In the master agent's dispatching algorithm, smaller values of priority take precedence over larger values.

--socket-address=IP-address
    Specifies the IPv4 address to listen on when the socket-type parameter is set to 'tcp'. Ignored if the socket-type is 'aflocal'. The default is '0.0.0.0'.

    Note that this parameter specifies the IP address for internal <ncx-connect> protocol messages. The server will accept NETCONF sessions over SSH, as specified in the OpenSSH config file.

--socket-port=port-number
    Specifies the TCP port number to listen on when the socket-type parameter is set to 'tcp'. Ignored if the socket-type is 'aflocal'. The default is 2023.

    Note that this parameter specifies the port number for internal <ncx-connect> protocol messages. The server will accept NETCONF sessions over SSH, specified with the 'port' parameter (e.g. 830).

--socket-type=enum
    Specifies which type of socket the server should create for incoming <ncx-connect> protocol sessions. The default is 'aflocal'.

    Note that this parameter specifies the socket type for internal <ncx-connect> protocol messages. The server will use TCP connections for NETCONF sessions over SSH.
      Enum values:
        aflocal:
           An AF_LOCAL socket will be used for incoming sessions.
        tcp:
           An AF_INET socket will be used for incoming sessions.

--startup=filespec
    The full or relative filespec of the startup config file to use. If present, overrides the default startup config file name 'startup-cfg.xml', This will also override the YUMAPRO_DATAPATH environment variable and the datapath CLI parameter, if the first character is the forward slash '/', indicating an absolute file path. If this parameter is present, then the --no-startup and --factory-startup parameters cannot be present. This is the default, which will cause startup-cfg.xml to be used if not present.

--no-startup
    If present, do not load the startup config file. Use only factory default values instead. Does not affect the startup.cfg file, if present. If this parameter is present, then the --startup or --factory-startup parameter cannot be present.

--factory-startup
    Force the system to use the factory configuration and delete the startup config file if it exists. Force the NV-storage startup to contain the factory default configuration. If this parameter is present, then the --no-startup and --startup parameters cannot be present.

--startup-error=enum
    If 'stop', then any errors in the startup configuration will be treated as fatal errors. If 'continue', the server will attempt to continue if any errors are found in the database loaded from NV-storage to running at boot-time.

--startup-factory-file=filespec
    The full or relative filespec of the factory startup config file to use. If the --factory-startup parameter is used, or no startup file is specified or found, then the server will look for this filespec. If found, then it will copied to the startup config file used to load the server.

    If the value represents a relative filespec then the server will check the server data file search path for the first matching filespec.

    If this parameter is set and the filespec is not found then the server will exit with an error. If the default filespec is not found then an empty datastore will be used to load the running configuration datastore at boot-time. The default is 'factory-startup-cfg.xml'.

--startup-prune-ok=boolean
    If set to 'true' then the server will prune unknown data nodes from the startup configuration instead of treating this as an error. A log_info message will be printed. If other known data nodes depend on the pruned nodes, then an error may occur anyway. If so, the 'startup-error' parameter will determine how this is handled.

    If set to 'false' then unknown data nodes found in the startup configuration will cause an error.

    Unknown data nodes can occur if modules were previously loaded dynamically, or if a YANG feature is configured from enabled to disabled. The default is 'false'.

--startup-skip-validation=boolean
    If set to 'true' then the server will skip all YANG validation of the startup configuration when it is loaded into the running configuration at boot-time. This should make the server boot faster but it assumes the startup configuration is already valid. Only the initial startup load operation is affected by this parameter.

    This parameter affects the 'root check' only. This includes the following datastore validation:
        - must
        - when (see note)
        - leafref path
        - unique
        - min-elements
        - max-elements
        - mandatory

    This parameter does not affect 'default' processing or 'when' statement processing for default nodes. It does affect 'when' statement processing for nodes provided in the startup configuration.

    It is possible that any invalid configuration will need to be fixed before any edits can be made to the <running> datastore. The full datastore can be checked using the <validate> operation.

    If the startup configuration is completely valid such that all validation tests would have passed, then this parameter should be safe to use. If the startup configuration contains data that does not pass the affected validation tests, then it may not be safe to use this parameter.

    This is extremely dangerous and can lead to incorrect processing of datastore editing operations. The server does not validate the complete datastore unless the <validate> operation is used. Any <edit-config> and <commit> operations done on a datastore that contains invalid YANG data may produce incorrect results. It is possible that edits will fail because the server detects invalid nodes from the startup during processing of the requested edit.

    The <restore> operation is not affected by this parameter. It is possible to save an invalid configuration that cannot be restored. Use the <validate> operation before using the <backup> operation to ensure a backup configuration can be restored later.

    If set to 'false' then startup validation is not skipped. The default is 'false'.

--subdirs=boolean
    If false, the file search paths for modules, scripts, and data files will not include sub-directories if they exist in the specified path.

    If true, then these file search paths will include sub-directories, if present. Any directory name beginning with a dot (.) character, or named CVS, will be ignored. This is the default mode.

--subsys-timeout=uint16
    The number of seconds to wait for a response from a sub-system before declaring a timeout. The value '0' indicates that no timeout should be used. The default is 30 seconds.

--superuser=string
    The user name to use as the superuser account. Any session associated with this user name will bypass all access control enforcement. See yuma-nacm.yang for more details. There is no default value.

--system-notifications=bits
    Indicates which YANG module(s) should be used for system notifications.
        bit ietf: Use ietf-netconf-notifications module.
        bit yuma: Use yuma-system module.

--system-sort-type=enum
    Indicates the sort type for system-ordered configuration lists and leaf-lists.

    This parameter is ignored if 'system-ordered' is set to 'false'. Otherwise this parameter determines the default sort order.

    The YANG extension 'ywx:sort-type' can be used to override this default setting to select the setting for a specific list or leaf-list object. The default value is 'off'.

    Added in 23.10-6 release.
       enum off: No sorting will be done
       enum ascending: Entries will be sorted in ascending order.
       enum descending: Entries will be sorted in descending order.

--system-sorted=boolean
    Indicates whether ordered-by system leaf-lists and lists will be kept in sorted order. Depends also on the system-sort-type setting.

--target=enum
    Specifies the database to use as the target of edit-config operations.
      Enum values:
        running:
          Write to the running config and support the
          :writable-running capability.
        candidate:
          Write to the candidate config and support the
          :candidate and :confirmed-commit capabilities.

--tcp-connect-timeout=uint16
    The number of seconds to wait for a TCP connect operation to complete before timing out.

          -  The value zero indicates that blocking mode
             should be used.

          -  A non-zero value indicates the timeout value
             for the 'connect' function in non-blocking mode.
             The connect may timeout before this number of
             seconds, but should not be longer.

    The default value is 10 seconds. Introduced in 22.10-6.

--tcp-keepalive-count=uint16
    This parameter is used for the TCP Keepalive Count parameter (TCP_KEEPCNT).

    If TCP Keepalives are enabled, then the requested number of consecutive TCP Keepalive messages that can be missed will be set according to this value. It is ignored otherwise.

    If set to 0 then the system default TCP Keepalive Count parameter will be used.

    If set to a value between 3 and 65535, then that value will be used for the TCP Keepalive Count parameter. The default is 0. Added in 25.10-7

--tcp-keepalive-enabled=boolean
    If 'true' then TCP Keepalives will be enabled for TCP sockets created by the server. Uses setsockopt function to set SO_KEEPALIVE socket option.

    If 'false' then TCP Keepalives will not be enabled for TCP sockets created by the server. The default is 'false'. Added in 25.10-7.

--tcp-keepalive-interval=uint16
    This parameter is used for the TCP Keepalive Interval parameter (TCP_KEEPINTVL). It is also used for the TCP Keepalive Idle parameter (TCP_KEEPIDLE).

    If TCP Keepalives are enabled, then the requested interval to send them will be set according to this value. It is ignored otherwise.

    If set to 0 then the system default TCP Keepalive Idle and Interval parameters will be used.

    If set to a value between 5 and 65535, then that value will be used for the TCP Keepalive Idle and Interval parameters. Units are seconds. The default is 0. Added in 25.10-7.

--tls-autosan-mode=boolean
    If 'true' then the client certificate will be checked for a X509v3 Subject Alternative Name field. If found, and it contains a valid username string, then this string will be used as the user name for the session.

    This is only done after the --cert-usermap CLI parameters and yumaworks-cert-usermap module are checked for a configured cert-to-name entry, and none is found.

    If 'false' then the SAN fields will not be checked automatically.

    The default value is 'false'. Introduced: 24.10-12.

--tls-cipherlist=string
    The cipherlist parameter to use to configure the server using the SSL_CTX_set_cipher_list function in openssl. This parameter is passed directly and not checked.

    Warning! For Advanced OpenSSL Users Only!

    Refer to the OpenSSL documentation for all details and support. OpenSSL problems due to use of this parameter are not supported.

     - https://www.openssl.org/docs/man1.0.2/man3/
       SSL_set_cipher_list.html

     - https://www.openssl.org/docs/man1.0.2/man1/ciphers.html

     - https://www.openssl.org/docs/manmaster/man1/openssl-ciphers.html

     - https://www.iana.org/assignments/tls-parameters/
       tls-parameters.xhtml#tls-parameters-4

--tls-common-auth=boolean
    Specifies if TLS Common Authentication mode should be used instead of the required Mutual Authentication mode. This mode is intended as a temporary measure if client certificates cannot be properly generated and installed at the moment.

    If 'true', then the server will not send a Certificate Request to the client. No client certificate will be received or checked. The username 'admin' will be assigned to the session.

    Warning! Setting this parameter to 'true' violates the NETCONF standard! No client verification will be done! Any client will be accepted.

    If 'false' then normal mutual authentication will be done.

    There are no operations to change this parameter at run-time. The server must be re-booted with this parameter changed to switch between authentication modes. The default is 'false'. Introduced 24.10-4.

--tls-crl-missing-ok=boolean
    If true then a missing CRL Distribution Points within a client or CA certificate will be ignored. Not relevant unless tls-crl-mode is set to 'client' or 'ca'. If false, and CRL verification is enabled for the certificate, the TLS session will not be accepted. The default is false.

--tls-crl-mode=enum
    Specifies how Certificate Revocation List checking should be done for NETCONF over TLS sessions. This has no affect unless --with-netconf-tls=true is set. The default is 'off'.
      Enum values:
        off:
          Do not use CRL verification when verifying any certificates.
        client:
          Use CRL verification when verifying client certificates.
        ca:
          Use CRL verification when verifying client and CA certificates.

--tls-debug=boolean
    Enable extra NETCONF over TLS session debugging. Used with the --log-level parameter to increase the amount of debugging info printed. The default is false.

--tls-deprecated-ok=boolean
    Allow deprecated versions of TLS to be used in NETCONF over TLS sessions.

    If 'true' then any TLS version used will be accepted. If 'false' then only TLS versions 1.2 and 1.3 will be accepted.

    The default value is false, which is not backward-compatible with server versions prior to YumaPro version 22.10-3.

--tls-v1.3-only=boolean
    Require TLS version 1.3 to be used for NETCONF over TLS sessions.

    If 'true' then only TLS version 1.3 will be accepted and the 'tls-deprecated-ok' parameter will be ignored.

    If 'false' then only TLS versions 1.2 and 1.3 will be accepted, unless the 'tls-deprecated-ok' parameter is set to 'true'.

    The default is 'false'. Introduced in 25.10-4.

--trim-whitespace=boolean
    If true, then trim leading and trailing whitespace from XML string nodes. If false, adhere to the standard and do not trim any leading or trailing whitespace. The server previously would trim whitespace but no longer does this by default. This leaf must be set to trim this whitespace now. The default is 'false'.

--usexmlorder
    If present, then XML element order will be enforced. Otherwise, XML element order errors will not be generated if possible. Default is no enforcement of strict XML order.

--user-parm=string
    Optional user parameter that can be accessed by the server instrumentation code within netconfd-pro.

    This parameter has no defined purpose or structure. It can be accessed with the 'agt_get_user_parm' API function from agt.h. The length is 1 .. 8192 chars. There is no default.

--version
    Print the program version string and exit.

--wait-datastore-ready=boolean
    Determines if client sessions will be available even if the running datastore is not ready to use yet.

    For example, if SIL-SA bundles are used then the server must wait until all of them have been loaded (by subsystems) before the startup configuration can be loaded into the running datastore. The running datastore is not ready to use in this state.

    If 'true' then client sessions will be locked until the datastores are ready. Protocol operations that do not access the datastores can be used in this state.

    If 'false' then client session connections will be rejected until the datastores are ready.

    The default is 'false' only to be backwards-compatible. The 'true' setting should be used in most cases.

--warn-error=boolean
    Control whether all warnings are elevated to errors. The default value is false.

--warn-idlen=number
     Control whether identifier length warnings will be generated. The value zero disables all identifier length checking. If non-zero, then a warning will be generated if an identifier is defined which has a length is greater than this amount. range: 0 | 8 .. 1023. The default value is 64.

--warn-linelen=number
    Control whether line length warnings will be generated. The value zero disables all line length checking. If non-zero, then a warning will be generated if the line length is greater than this amount. Tab characters are counted as 8 spaces. range: 0 | 40 .. 4095. The default value is 72.

--warn-off=number
    Control whether the specified warning number will be generated and counted in the warning total for the module being parsed. range: 1000 .. 1999. This parameter may be entered zero or more times.

--warn-off-yang=boolean
    Control whether all YANG warnings are enabled or disabled.

--warn-up=number
    Control whether the specified warning number will be elevated to an error and counted in the error total for the module being parsed. range: 1000 .. 1999. This parameter may be entered zero or more times.

--watcher-interval=number
    Specifies the sleep interval between ypwatcher program attempts to check availability of the server. Provided value is in seconds. The server does not accept the value of 0 for this parameter. The minimal acceptable value is 1 second. The default value is 10.

--no-watcher
    Control the ypwatcher program. If present, do not launch ypwatcher program. If this parameter is present, then the --watcher-interval parameter cannot be present.

--wildcard-keys=boolean
    Set to 'true' if UrlPath targets for GET operations are allowed to replace key values with the dash '-' character to indicate that all instances of that key are requested. Set to false to treat the '-' character as a plain character if entered as a key value in a UrlPath string.

--with-callhome=boolean
    This feature is only available if the server image is built with the flags WITH_CALLHOME=1. If set to 'true', then the IETF Callhome for SSH feature will be enabled. If set to 'false', then this feature will be disabled and the following CLI parameters will be ignored:
                 - callhome-retry-max
                 - callhome-retry-interval
                 - callhome-server
                 - callhome-sshd-command
                 - callhome-sshd-config
                 - callhome-subsys-command
                 - callhome-tls-server
    The default is 'false'.

--with-canonical=boolean
    If set to 'true', then the server will automatically convert XML and JSON input parameters to the canonical format for the YANG data type, if possible.

    The following built-in YANG data types are affected:
         - ipv6-address
         - ipv6-address-no-zone
         - domain-name
         - phys-address
         - mac-address
         - hex-string
         - uuid
    Any canonical callbacks for user-defined data types are also affected by this parameter. Internal values can be manually converted to canonical format using the val_set_canonical API. The default is 'true'.

--with-config-id=boolean
    If set to 'true', then the YumaWorks :config-id capability will be enabled. This is used to help cache device configurations. It is an enterprise capability URI, not a standard YANG module URI. If set to 'false', then the YumaWorks :config-id capability will be disabled. The default value is true.

--with-confirmed-commit=boolean
    If set to 'true', then the :confirmed-commit capability will be enabled and advertised to clients. If set to 'false', then the :confirmed-commit capability will not be enabled or advertised to clients. If the --target=running parameter is used then this parameter is ignored. First release: 24.10-2 The default is 'true'.

--with-db-lock=boolean
    If set to 'true', then the server will use the DB-API DB-Config-Lock service for all configuration edit transactions to the <running> datastore. All client edits will be require this lock be granted or it will fail. The server will use the db-lock-retry-interval and db-lock-timeout CLI parameters to control how lock retries will be done. If set to 'false', the DB-Config-Lock will not be used by the server. The default is 'false'.

--with-error-number=boolean
    If set to 'true', then the <error-info> element will include the proprietary <error-number> element. If set to 'false', then the <error-info> element will not include the proprietary <error-number> element. This leaf corresponds to the error status enumerations defined in 'status_enum.h'. The default is 'true'. Added in 22.10-8.

--with-factory-datastore=boolean
    If set to 'true', then the ietf-factory-default module will be loaded and enabled. Otherwise, this module will not be loaded.
         -   Provides the 'fd:factory-default' NMDA datastore enum;
             Not useful unless --with-nmda='true' also set.

         -   Provides the '<factory-reset>' protocol operation.
             Use with caution! Causes factory reset of entire device!

    The default is 'false'. Introduced in 25.10-4.

--with-fsync=boolean
    If set to 'true', the server will flush data to disk when saving the startup configuration, providing better protection against data loss during power failure. If set to 'false', the flush will be skipped to improve performance. The default value is false. Introduced in 23.10-19.

--with-gnmi=boolean
    This feature is only available if the server image is built with the flags WITH_GNMI=1. If set to 'true', then the gNMI protocol will be enabled. Otherwise, the gNMI protocol will not be enabled. The incoming connection will be dropped if the protocol is disabled. The default is false.

--with-grpc=boolean
    This feature is only available if the server image is built with the flags WITH_GRPC=1. If set to 'true', then the gRPC protocol will be enabled. Otherwise, the gNMI protocol will not be enabled. The incoming connection will be dropped if the protocol is disabled. The default is false.

--with-json-metadata=boolean
    If set to 'true', then RFC 7952 JSON Metadata will be enabled. If 'false', then RFC 7952 JSON Metadata will not be enabled. The default is 'true'. Added in 25.10-8.

--with-maintenance-mode=boolean
    If set to 'true', then allow the maintenance mode to be used. Otherwise, ignore all requests to place the server in maintenance mode. The default is true.

--with-modtags=boolean
    If set to 'true', then the module tags feature will be enabled. Otherwise, this feature will be disabled. If disabled, the module-tagmap parameter will be ignored and the ietf-module-tags module will not be loaded. The default is 'true'.

--with-netconf=boolean
    If set to 'true', then the NETCONF protocol will be enabled. Otherwise, the NETCONF protocol will not be enabled. The incoming connection will be dropped if the protocol is disabled. The default value is true.

--with-netconf-tls=boolean
    If set to 'true', then the NETCONF over TLS protocol will be enabled. Otherwise, the NETCONF over TLS protocol will not be enabled. An incoming connection will be dropped if the protocol is disabled. The default is set to false because the server will terminate if the server certificates are not found and this parameter is set to 'true'.

--with-new-notifs=boolean
    If set to 'true', then the new YANG Notifications from RFC 8639 will be used, even if --bundle=yang-push is not used. This will cause the 'ietf-subscribed-notifications' module to be loaded into the server at boot-time.

    This parameter is ignored if any of the following are true:

          *   --with-notifications=false.
          *   Server not built with WITH_YANG_PUSH=1 compiler flag
          *   --bundle=yang-push is used

    The default is 'true'. Added in 23.10T-8.

--with-new-yanglib=boolean
    If set to 'true', then the new YANG Library from RFC 8525 will be used, even if --with-nmda=false. This will cause the '/yang-library' subtree to be present. It does not cause the '/modules-state' subtree to be removed. The default is 'true'. Added in 23.10T-8.

--with-nmda=boolean
    Enable or disable NMDA features. The default is 'false'. If set to 'true', then NMDA operations and YANG modules will be enabled:
      - ietf-datastores
      - ietf-origin
      - ietf-netconf-nmda

--with-notifications=boolean
    If set to 'true', then the :notification:1.0 and :interleave:1.0 capabilities will be enabled. Otherwise, these capabilities will not be enabled. The default is 'true'.

--with-ocpattern=boolean
    If true, then OpenConfig patterns will be checked. If the module name starts with the string 'openconfig-' then all pattern statements within that module are treated as POSIX patterns, not YANG patterns. If false, then the pattern statements in all modules will be checked as YANG patterns. The default value is false.

--with-schema-mount=boolean
    This feature is only available if the server image is built with the WITH_SCHEMA_MOUNT=1 compiler flag or the EVERYTHING=1 compiler flag. If set to 'true', then the Schema Mount feature will be enabled and the Schema Mount related YANG modules and SIL code will be loaded. Additional configuration will be required. The server needs to know which YANG modules should be mounted at a given mount-point. Refer to --sm-config parameter.

--with-regex-filter=boolean
    If set to 'true', the server will check content-match expressions in subtree filters for a special string indicating the match is a regular expression, not an exact string.

    If set to 'false', the server will not check content match tests for regular expression syntax.

    The default is 'true'. Introduced in 25.10-2.

        Languages:

          'r1' : YANG pattern syntax

          'r2' : POSIX (ocpattern) syntax

        Syntax:

          'r1' left-paren expression right-paren

          'r2' left-paren expression right-paren

          No extra whitespace is allowed at all.

        Example:

          Match a string starting with 'eth':  r1(eth.*)

--with-restconf=boolean
    If set to 'true', then the RESTCONF protocol will be enabled. Otherwise, the RESTCONF protocol will not be enabled. The incoming connection will be dropped if the protocol is disabled. The default value is true.

--with-rollback-on-error=boolean
    If set to 'true', then the NETCONF :rollback-on-error capability and feature will be enabled and advertised. Otherwise, this feature will not be enabled or advertised. The default is 'true'.

--with-snmp=boolean
    If set to 'true', then the SNMP protocol will be enabled. Otherwise, the SNMP protocol will not be enabled. incoming SNMP requests will be dropped if the protocol is disabled. The default value is false.

--with-startup=boolean
    If set to 'true', then the :startup capability will be enabled. Otherwise, the :startup capability will not be enabled. This capability makes the NV-save operation an explicit operation instead of an automatic save. The default value is false.

--with-support-save=boolean
    If set to 'true', then the yumaworks-support-save module will be loaded and enabled. Otherwise, this module will not be loaded. Ignored if the server image is not built with the WITH_SUPPORT_SAVE=1 compile flag. The default is true.

--with-term-msg=boolean
    If set to 'true', then the yumaworks-term-msg module will be loaded and enabled. Otherwise, this module will not be loaded. The <term-msg> notification is used by yp-shell for displaying terminal diagnostic messages. The default is true.

--with-url=boolean
    If set to 'false', then the :url capability will be disabled. Otherwise, the :url capability will be enabled. This capability allows local files to be stored as backups on the server. The default value is true.

--with-url-ftp=boolean
    If set to 'true', then the 'ftp' protocol scheme will be enabled for the 'url' capability. Ignored if the 'with-url' parameter is false. The default is 'false'.

--with-url-tftp=boolean
    If set to 'true', then the 'tftp' protocol scheme will be enabled for the 'url' capability. Ignored if the 'with-url' parameter is false. The default is 'false'.

--with-validate=boolean
    If set to 'true', then the :validate capability will be enabled. Otherwise, the :validate capability will not be enabled. This capability requires extensive memory resources. The default value is true.

--with-warnings=boolean
    If set to 'true', then setting the error-severity field to warning (instead of error) will be enabled. Otherwise, the error-severity field will be set to error, even if the server code tries to set it to warning. This is not compliant with the NETCONF protocol and tools may reject rpc-error data sent with an error-severity value of warning. The default value is false.

--with-yang-api=boolean
    OBSOLETE! NOT USED! If set to 'true', then the YANG-API protocol will be enabled. Otherwise, the YANG-API protocol will not be enabled. The incoming connection will be dropped if the protocol is disabled. The default value is false.

--with-yanglib-augmentedby=boolean
    If set to 'true', then the ietf-yang-library-augmentedby module will be loaded and enabled. Otherwise, this module will not be loaded.

    The --with-nmda or --with-new-yanglib parameter must be set to 'true' or this parameter will be have no affect and the module will not be loaded. The default value is true.

--with-yang-metadata=boolean
    If 'true' then the YANG compiler will load the 'ietf-yang-metadata' module and use any md:annotation statements that are found.

    If 'false' then this module will not be loaded and all 'md:annotation' statements will be ignored.

    Note that enabling this parameter will cause a YANG module to be rejected with errors if any annotations are found which do not conform to the definition in RFC 7952.

    This parameter must be entered in the command line to have any effect. Do not use this parameter in a config file since this is too late in the initialization process to change the setting. The default is true. Introduced in 25.10-3.

--with-yang-patch-running=boolean
    If set to 'true', the YANG-PATCH will be enabled when the server supports only the :writable-running capability. If 'false' then the YANG-PATCH requests will be rejected.

--with-yang-push2=boolean
    Control whether the YANG Push 2 functionality is enabled. Only relevant is WITH_YANG_PUSH=1 and WITH_YANG_PUSH2=1 are enabled in the server build.

    If set to 'true', then the configured notifications and UDP Notif protocol will be enabled for the XML and JSON encodings. The CBOR encoding is enabled if WITH_YANG_CBOR=1 is used in the server build.

    If set to 'false' then this functionality will not be enabled, even if 'bundle yang-push' is used. Ignored if YANG Push is not enabled as well. The default is 'true'.

--with-yang11-hello=boolean
    Control whether the NETCONF hello message should conform to the standard and leave out YANG 1.1 modules. If set to 'true', then leave out YANG 1.1 modules from <capability> used in <hello>. Also keep out of monitoring <capabilities> list. If 'false' then ignore the standard and advertise YANG 1.1 module capabilities

--with-yp-coap=boolean
    If set to 'true', then the YP-CoAP protocol will be enabled. Otherwise, the YP-CoAP protocol will not be enabled. This protocol is NOT SECURE. It SHOULD NOT be used unless privacy is provided by some other means. The default value is false.

--with-yp-coap-dtls=boolean
    If set to 'true', then the YP-CoAP over DTLS protocol will be enabled. Otherwise, the YP-CoAP over DTLS protocol will not be enabled. This protocol is secure. It SHOULD be used instead of YP-CoAP. The default value is false. (Not implemented yet)

--with-yp-shell=boolean
    If set to 'true', then the YP-SHELL protocol will be enabled. Otherwise, the YP-SHELL protocol will not be enabled. The incoming connection will be dropped if the protocol is disabled. The default value is true.

--with-yuma-system=boolean
    If set to 'true', then the yuma-system module will be loaded and enabled. Otherwise, this module will not be loaded. The default is 'false'.

--with-yuma-time-filter=boolean
    If set to 'true', then the yuma-time-filter module will be loaded and enabled. Otherwise, this module will not be loaded. The default is true.

--with-yumaworks-callhome=boolean
    If set to 'true', then the yumaworks-callhome module will be loaded and enabled. Otherwise, this module will not be loaded. If not enabled then the run-time configuration of CallHome servers will not be available. This parameter has no effect if the WITH_CALLHOME=1 option is not used when building the server binary. The default is 'true'.

--with-yumaworks-cert-usermap=boolean
    If set to 'true', then the yumaworks-cert-usermap module will be loaded and enabled. Otherwise, this module will not be loaded. This modules adds the ietf-cert-to-name TLS configuration to the server.

--with-yumaworks-compare=boolean
    If set to 'true', then the yumaworks-compare module will be loaded and enabled. Otherwise, this module will not be loaded. This module contains the <compare-config> operation. The default is true. Introduced in 25.10-4.

--with-yumaworks-config-change=boolean
    If set to 'true', then the yumaworks-config-change module will be loaded and enabled. Otherwise, this module will not be loaded. This modules adds data to the 'netconf-config-change' notification.

    This data represents a security risk since it is not subject to the same access control rules within a notification as within a datastore. NACM does not provide access control for the contents of a notification, only for the notification event type. Use this module with caution! Only allow a superuser administrator access to the 'netconf-config-change' notification if this module is used. The default is 'false'.

--with-yumaworks-event-filter=boolean
    If set to 'true', then the yumaworks-event-filter module will be loaded and enabled. Otherwise, this module will not be loaded. The default is true.

--with-yumaworks-event-stream=boolean
    If set to 'true', then the yumaworks-event-stream module will be loaded and enabled. Otherwise, this module will not be loaded. If disabled the /event-streams subtree will not be available. The default is 'true'.

--with-yumaworks-getbulk=boolean
    If set to 'true', then the yumaworks-getbulk module will be loaded and enabled. Otherwise, this module will not be loaded. If disabled the <get-bulk> operation will not be available. The default is true.

--with-yumaworks-ids=boolean
    If set to 'true', then the yumaworks-ids module will be loaded and enabled. Otherwise, this module will not be loaded. If not enabled then the extra transport types for netconfd-pro specific transports and control sessions will not be available. The default is true.

--with-yumaworks-lock=boolean
    If set to 'true', then the yumaworks-lock module will be loaded and enabled. Otherwise, this module will not be loaded. If disabled the <lock-all> and <unlock-all> operations will not be available. The default is true. Added 22.10-8.

--with-yumaworks-nmda=boolean
    If set to 'true', then the yumaworks-nmda module will be loaded and enabled. Otherwise, this module will not be loaded. Ignored if with-nmda=false. The default is true. Added 25.10-8.

--with-yumaworks-sm-yanglib=boolean
    If set to 'true', then the yumaworks-sm-yanglib module will be loaded and enabled. Otherwise, this module will not be loaded and the <get-sm-yanglib> operation will not be available. This parameter is ignored unless the Schema Mount feature is enabled and configured in the server. The default is true.

--with-yumaworks-system=boolean
    If set to 'true', then the yumaworks-system module will be loaded and enabled. Otherwise, this module will not be loaded. The <load>, <unload>, <load-bundle>, and <unload-bundle> operations will not be available. Other operations and data model augments will not be available. The default is true.

--with-yumaworks-templates=boolean
    If set to 'true', then the yumaworks-templates module will be loaded and enabled. Otherwise, this module will not be loaded. Ignored unless the server is built with the WITH_TEMPLATES=1 compiler flag. The default is true.

--xml-strict-namespaces=boolean
    Controls strict XML namespace validation for incoming NETCONF messages.

    If set to 'true', the server rejects requests containing any element whose effective namespace is missing (empty) or whose namespace URI is not recognized for the target NETCONF operation or YANG data model. The request is rejected with an <rpc-error> using error-tag 'unknown-namespace', including <bad-element> and <bad-namespace> in <error-info>, as defined in RFC 6241.

    If set to 'false' (default), the server operates in a permissive mode and does not fail a request solely due to missing or unexpected namespaces. Processing may continue and a debug message may be logged.

--yangapi-server-url=uri
    The starting string for the server URL to use in Location header lines returned by YANG-API. The default is 'http://localhost'.

--yang-sid-mode=enum
    The mode to use for the source of YANG SID assignments. This parameter has no effect unless the WITH_YANG_CBOR=1 make parameter is used in the build and the --with-yang-cbor parameter is set to 'true'.

            enum sid-file:
              Use YANG SID files for SID assignments
            enum lsid:
              Use LSID SID generation mode for SID assignments.
              Starting in 24.10T-6:
                   - SID files will be used if found, for each
                     module loaded.
                   - LSIDs will be generated only for the objects
                     in modules where no SID file was found.
                   - The starting point for LSID asignment is
                     implementation-specific.

    The default is is "sid-file".

--yp-coap-address=ip-address
    NOT SUPPORTED. DO NOT USE.
    The IP address that the YP-CoAP protocol will use to listen
    for incoming requests. This will also be used as the source
    address in YP-CoAP packets sent by the server.
    The type is inet:ip-address.  The default is "0.0.0.0".

--yp-coap-port=port-number
    NOT SUPPORTED. DO NOT USE.
    The UDP port number that the YP-CoAP protocol will use to listen
    for incoming requests. This will also be used as the source
    port number in YP-CoAP packets sent by the server.
    The type is inet:port-number. The default is 5683.

--yp-coap-dtls-port=port-number
    NOT SUPPORTED. DO NOT USE.
    The UDP port number that the YP-CoAP protocol will use to listen
    for incoming requests for CoAP over DTLS. This will also be used
    as the source port number in YP-CoAP packets sent by the server.
    The type is inet:port-number. The default is 5684

--yumapro-home=string
    Directory for the yumapro project root to use.
    If present, this directory location will
    override the YUMAPRO_HOME environment variable,
    if it is present.  If a zero-length string is
    entered, then the YUMAPRO_HOME environment variable
    will be ignored.
    Note: This parameter cannot be set in
    the netconfd-pro.conf config file.  Only the command line or
    environment variable can be used.

INPUT FILES
YANG modules can be loaded at startup with the '--module' command, or loaded at run-time with the 'load' operation.

SIL bundles can be loaded at startup with the '--bundle' command, or loaded at run-time with the 'load-bundle' operation.

RETURN VALUE
The server usually returns 0, even if it encountered an error. If the --return-status=true parameter is used then the server will exit with a return status that represents a status code, found in ncx/status_enum.h.

SEARCH PATH
When a module name is entered as input, or when a module or submodule name is specified in an import or include statement within the file, the following search algorithm is used to find the file:

  1) file is in the current directory
  2) YUMAPRO_MODPATH environment var (or set by modpath parameter)
  3) $HOME/modules directory
  4) $YUMAPRO_HOME/modules directory
  5) $YUMAPRO_INSTALL/modules directory OR
     default install module location, '/usr/share/yumapro/modules'

By default, the entire directory tree for all locations (except step 1) will be searched, not just the specified directory. The subdirs parameter can be used to prevent sub-directories from being searched.

Any directory name beginning with a dot character (.) will be skipped. Also, any directory named CVS will be skipped in directory searches.

ERROR LOGGING
By default, warnings and errors are sent to STDOUT.

A log file can be specified instead with the log' parameter.

Existing log files can be reused with the 'logappend' parameter, otherwise log files are overwritten.

The logging level can be controlled with the log-level parameter.

The default log level is 'info'. The log-levels are additive:

     off:    suppress all errors (not recommended!)
             A program return code of '1' indicates some error.
     error:  print errors
     warn:   print warnings
     info:   print generally interesting trace info
     debug:  print general debugging trace info
     debug2: print verbose debugging trace info
     debug3: print very verbose debugging trace info
     debug4: print maximum debugging trace info

ENVIRONMENT
The following optional environment variables can be used to control module search behavior:

HOME
    The user's home directory (e.g., /home/andy)

YUMAPRO_HOME
    The root of the user's YumaPro work directory (e.g., /home/andy/swdev/netconf)

YUMAPRO_INSTALL
    The root of the directory that netconfd-pro is installed on this system (default is, /usr/share/yumapro)

YUMAPRO_DATAPATH
    Colon-separated list of directories to search for data files. (e.g.: './workdir/data-files:/home/andy/data') The datapath parameter will override this environment variable, if both are present.

YUMAPRO_MODPATH
    Colon-separated list of directories to search for modules and submodules. (e.g.: './workdir/modules:/home/andy/test-modules') The modpath parameter will override this environment variable, if both are present.

CONFIGURATION FILES

netconfd-pro.conf
    YANG config file The default is: /etc/yumapro/netconfd-pro.conf

    An ASCII configuration file format is supported to store command line parameters.

    Do not specify the home or yumapro-home parameters in this file!!

    The config parameter is used to specify a specific config file, otherwise the default config file will be checked.

       - A hash mark until EOLN is treated as a comment
       - All text is case-sensitive
       - Whitespace within a line is not significant
       - Whitespace to end a line is significant/
         Unless the line starts a multi-line string,
         an escaped EOLN (backslash EOLN) is needed
         to enter a leaf on multiple lines.
       - For parameters that define lists, the key components
         are listed just after the parameter name, without
         any name,  e.g.,

                interface eth0 {
                  # name = eth0 is not listed inside the braces
                  ifMtu 1500
                  ifName mySystem
                }

    A config file can contain any number of parameter sets for different programs.

    Each program must have its own section, identifies by its name:

         # this is a comment
         yangdump-pro {
            log-level debug
            output "~/swdev/testfiles"
         }

         netconfd-pro {
            ...
         }

FILES
The following data files must be present in the module search path in order for this program to function:

  * YANG module library
    default: /usr/share/yumapro/modules/

DIAGNOSTICS
Internal diagnostics may generate the following type of message if any bugs are detected at runtime:

    [E0]
         filename.c:linenum error-number (error-msg)

AUTHOR
YumaWorks, Inc., <support at yumaworks.com>

SEE ALSO
netconf-subsystem-pro(1) restconf(1) yangcli-pro(1) yangdiff-pro(1) yangdump-pro(1) ypcontrol(1) yp-shell(1)