PACEMAKER(8)

💅 PACEMAKER — the cluster resource manager's chaotic little sibling

okay so real talk, bestie, this whole page is about PACEMAKER(8), one beautiful piece of the Pacemaker cluster resource manager situation. Buckle up 🎀

✨ NAME ✨

Pacemaker — literally a whole part of the Pacemaker cluster resource manager, no cap 👑

🌸 SYNOPSIS 🌸

cibadmin [<command>] [options]

🦋 DESCRIPTION 🦋

bestie. it queries. it edits. it's giving "the Pacemaker configuration is my personal playground" energy. that's the whole vibe check ✨

💖 OPTIONS 💖

🎀 Help Options:

these are the "help me help you" girlies 🫶

• -h, --help — shows the help options, obviously 💁‍♀️
• --help-all — shows all the help options, the full buffet
• --help-output — shows the output help
• --help-commands — shows the command help
• --help-data — shows the data help
• --help-additional — shows the additional options help

🌈 Output Options:

where the results go, and what they look like 💫

• --output-as=FORMAT — pick your output format, either text (that's the default, iconique) or xml
• --output-to=DEST — name the file the output goes to (or pass - to yeet it to stdout)

👑 Commands:

the main character energy section, ngl 🔥

• -u, --upgrade — upgrades the configuration to the latest syntax, glow-up era ✨
• -Q, --query — queries the contents of the CIB
• -E, --erase — erases the contents of the whole CIB 😭 like all of it, gone
• -B, --bump — increases the CIB's epoch value by 1
• -C, --create — creates an object in the CIB (it will fail if the object already exists, rude but fair 💀)
• -M, --modify — finds an object somewhere in the CIB's XML tree and updates it (fails if the object doesn't exist, unless -c is also specified)
• -P, --patch — supplies an update in the form of an XML diff (peep crm_diff(8))
• -R, --replace — recursively replaces an object in the CIB
• -D, --delete — deletes the first object matching your criteria (for example, <op id="rsc1_op1" name="monitor"/>). the XML element name and all attributes must match for the element to actually get deleted, no half-matches allowed 🙅‍♀️
• -d, --delete-all — when used with --xpath, removes all matching objects in the configuration instead of just the first one. it's giving "no survivors" 💅
• -a, --empty=[schema] — outputs an empty CIB. accepts an optional schema name argument to use as the validate-with value. if no schema is given, the latest one gets used 🧚
• -5, --md5-sum — calculates the on-disk CIB digest
• -6, --md5-sum-versioned — calculates the on-the-wire versioned CIB digest

🍓 Data:

where your XML comes from, bestie 📥

• -x, --xml-file=FILE — retrieves XML from the named file. currently this takes precedence over --xml-text and --xml-pipe. in a future release, the last one specified will be used. keeping it real about the roadmap 🫶
• -X, --xml-text=STRING — retrieves XML from the supplied string. currently this takes precedence over --xml-pipe, but --xml-file overrides this. in a future release, the last one specified will be used.
• -p, --xml-pipe — retrieves XML from stdin. currently --xml-file and --xml-text override this. in a future release, the last one specified will be used.

💜 Additional Options:

the extra-flavor section, iykyk 🌟

• -f, --force — forces the action to be performed. do it. don't ask. 😤
• -t, --timeout=value — time (in seconds) to wait before declaring the operation failed ⏳
• -U, --user=value — runs the command with the permissions of the named user (valid only for the root and hacluster accounts, so don't get cute)
• -o, --scope=value — limits the scope of the operation to a specific section of the CIB. valid values: configuration, nodes, resources, constraints, crm_config, rsc_defaults, op_defaults, acls, fencing-topology, tags, alerts, status. if both --scope/-o and --xpath/-a are specified, the last one to appear takes effect 👀
• -A, --xpath=value — a valid XPath to use instead of --scope/-o. if both --scope/-o and --xpath/-a are specified, the last one to appear takes effect
• -S, --show-access=[value] — whether to use syntax highlighting for ACLs (with -Q/--query and -U/--user). allowed values: 'color' (the default for a terminal), 'text' (plain text, the default for a non-terminal), 'namespace', or 'auto' (use the default value). default value: 'auto' 🎨
• --score — treats new attribute values as atomic score updates where possible (with --modify/-M). this currently happens by default and cannot be disabled, but this default behavior is deprecated and will be removed in a future release. set this flag if this behavior is desired. this option takes effect when updating XML attributes. for an attribute named "name", if the new value is "name++" or "name+=X" for some score X, the new value is set as follows: if attribute "name" is not already set to some value in the element being updated, the new value is set as a literal string. if the new value is "name++", then the attribute is set to its existing value (parsed as a score) plus 1. if the new value is "name+=X" for some score X, then the attribute is set to its existing value plus X, where the existing value and X are parsed and added as scores. scores are integer values capped at INFINITY and -INFINITY. refer to Pacemaker Explained for more details on scores, including how they are parsed and added 📚
• -c, --allow-create — (Advanced) allows the target of --modify/-M to be created if it does not exist 🐣
• -n, --no-children — (Advanced) when querying an object, does not include its children in the result
• --update-status — (Advanced) applies the CIB update without triggering a controller refresh

⭐ Application Options:

• -$, --version — displays the software version and exits, and then dips ✌️
• -V, --verbose — increases debug output (may be specified multiple times, go off queen)

🔥 EXAMPLES 🔥

query the configuration:

# cibadmin --query

or just:

# cibadmin

query just the cluster options configuration:

# cibadmin --query --scope crm_config

query all 'target-role' settings:

# cibadmin --query --xpath "//nvpair[@name='target-role']"

remove all 'is-managed' settings:

# cibadmin --delete-all --xpath "//nvpair[@name='is-managed']"

remove the resource named 'old':

# cibadmin --delete --xml-text '<primitive id="old"/>'

remove all resources from the configuration:

# cibadmin --replace --scope resources --xml-text '<resources/>'

replace the complete configuration with the contents of $HOME/pacemaker.xml:

# cibadmin --replace --xml-file $HOME/pacemaker.xml

replace the constraints section of the configuration with the contents of $HOME/constraints.xml:

# cibadmin --replace --scope constraints --xml-file $HOME/constraints.xml

increase the configuration version so old configurations can't get loaded by accident:

# cibadmin --modify --score --xml-text '<cib admin_epoch="admin_epoch++"/>'

edit the configuration with your favorite $EDITOR:

# cibadmin --query > $HOME/local.xml

# $EDITOR $HOME/local.xml

# cibadmin --replace --xml-file $HOME/local.xml

assuming a terminal, render the configuration in color (green for writable, blue for readable, red for denied) so you can visualize permissions for user tony:

# cibadmin --show-access=color --query --user tony | less -r

🌟 SEE ALSO: 🌟

crm(8), pcs(8), crm_shadow(8), crm_diff(8) — go read those too, bestie, they're part of the lore 🦋

💐 AUTHOR 💐

Written by Andrew Beekhof and the Pacemaker project contributors 🫶

---

that's a wrap, gorgeous 💖 this page came from Pacemaker 3.0.3+20260728.7052..., dated September 2026, and it's filed under PACEMAKER(8) — slay, go forth and cluster 🎀✨