CLI reference

python -m src [flags]

Config push

Flag	Default	Description
--task NAME	GENERIC_TASK	Task label recorded in inventory (e.g. SNMPV3, SYSLOG, BACKUP)
--commands NAME	none	Command file prefix to load (e.g. snmpv3 → {vendor}/snmpv3.txt)
--ip IP	none	Single device IP — use with --vendor
--vendor VENDOR	cisco	cisco, cisco_wlc, wlc, nexus, alcatel, alcatel_wlc, aruba
--devices FILE	config/devices.csv	Device CSV file
--all	off	Force-load all of devices.csv, ignoring auto-retry
--retry	off	Retry failed devices from config/failed_devices.csv
--role ROLE	none	Filter by role column. Exact match, comma-separate for multiple
--workers N	1	Parallel SSH connections
--backup	off	Save full running-config per device to BACKUP/YYYY-MM/
--dry-run	off	Load and validate the device list without connecting
--validate	off	Validate device list and command files — no SSH connections
--log	off	Enable SSH session logging to LOGS/
--status-file FILE	none	Update Status column to Configured in a monitoring CSV
--retention DAYS	30	Backup retention in days (0 = keep all)
--format csv|json	csv	Summary output format

Neighbor discovery

Flag	Default	Description
--discover-lldp	off	Vendor-neutral LLDP walk from devices already in inventory
--discover-cdp	off	Cisco-only CDP walk
--apply	off	Append newly found devices. Without it, dry-run print only
--output-devices FILE	--devices	Write discoveries here instead, keeping a read-only core inventory
--export-atlas FILE	none	Also append discoveries in Atlas hosts-import CSV format
--role ROLE	core	Which existing devices to run discovery against. Exact match
--vendor VENDOR	CDP: cisco	Narrow source devices by vendor. Substring match
--ip IP	none	Single source device, for testing before a full run

Subnet discovery

Flag	Default	Description
--discover SUBNET	none	Scan one subnet, first three octets (e.g. 192.168.1)
--discover-all	off	Scan every subnet in config/discovery.csv
--diff-against FILE	config/devices.csv	Compare scan results against these CSVs. Comma-separate to merge
--capture-details	off	SSH into responding hosts, pull hostname/serial/model

Chassis / stack capture

Flag	Default	Description
--capture-core-stack	off	Per-unit serial, model, OS version, uptime. One row per physical unit
--output-cores FILE	core_stack_info.csv	Output CSV path
--capture-syslog	off	Capture current syslog server config to SYSLOG_CAPTURE/

Health, compliance, reporting

Flag	Description
--health-check	SSH reachability check — no metrics, no config changes. Ignores --workers
--healthcheck	Collect CPU/memory/virtual-chassis metrics, write CSV + HTML report to SUMMARY/
--notify	Send the health report via enabled notification channels (email/Telegram)
--baseline VENDOR|NAME	Run CIS-style compliance check against saved BACKUP/ configs
--report [FILE]	Generate report from a SUMMARY CSV (omit FILE for latest)
--pattern TEXT	With --report, confirm a config line landed in PRE_CHECK/POST_CHECK
--consolidate	Merge all SUMMARY CSVs into SUMMARY/CONSOLIDATED_SUMMARY.csv
--export FILE	Export network_inventory.db to CSV
--diff FILE1 FILE2	Compare two config files line by line

--role is an exact match

--role splits on commas into a set and tests for exact membership (src/neighbor_discovery.py:471). It is not a substring or prefix test, and it defaults to core for every discovery and capture flag.

If your inventory uses cisco_core, then --discover-lldp with no --role matches nothing and the run finishes in under a second with no error. Pass --role cisco_core,alcatel_core.

--vendor behaves differently: it is a case-insensitive substring test, so --vendor alcatel matches both alcatel and alcatel_wlc.

Workers guide

Each worker is one simultaneous SSH connection. Workers never share connections.

Workers	10,000 devices @ 30 s each
1 (default)	~83 hours
10	~8.3 hours
20	~4.2 hours
30	~2.8 hours
50	~1.7 hours

Caution

The default is 1, not 20. Every run is fully sequential unless you pass --workers N. Unreachable devices are far worse than the average, because each burns the full retry and backoff cost across every configured credential set.

Start with --workers 20. Set a permanent default in config.yaml:

execution:
  max_workers: 20

Examples

# Single device test
python -m src --task SNMPV3 --commands snmpv3 --ip 10.0.0.1 --vendor cisco

# Subset test before full rollout
python -m src --task SNMPV3 --commands snmpv3 --devices config/testdata_devices.csv

# Full rollout
python -m src --task SNMPV3 --commands snmpv3 --devices config/devices.csv --workers 20

# Retry failures
python -m src --task SNMPV3 --commands snmpv3 --retry --workers 10

# Backup all running-configs
python -m src --task BACKUP --commands backup --backup --devices config/devices.csv --workers 20

# Dry run — load and validate the device list without connecting
python -m src --task SNMPV3 --commands snmpv3 --devices config/devices.csv --dry-run

# Update monitoring CSV after successful run
python -m src --task SNMPV3 --commands snmpv3 --devices config/devices.csv --workers 20 --status-file data/dataswitches.csv

--dry-run does not print command bodies

--dry-run prints the device list and stops. It looks for command files at the legacy flat path config/{vendor}_{task}.txt, while the real push reads the nested config/{vendor}/{task}.txt (src/utils.py:499). The nested file exists, the flat one does not, so nothing prints.

Use --dry-run to check the device list, and --validate to check that command files resolve.