SSSCTL(8)

💅 SSSCTL(8) — the sssctl glow-up (SSSD Manual pages, bestie)

okay so. picture this: you're deep in the SSSD trenches, you need to know what is even going on, and you do NOT have time for chaos. that's literally what sssctl is for. it lives in section 8 of the manual, and she is your girl. 🎀

---

✨ NAME ✨

sssctl — the SSSD control and status utility 🦋

---

✨ SYNOPSIS ✨

sssctl COMMAND [options]

---

✨ DESCRIPTION ✨

so basically, sssctl gives you one simple, unified way to pull info about SSSD's status — like which server is active, what servers got auto-discovered, which domains exist, and what objects are sitting in the cache. no running around in circles, no detective work, just answers. 🔍

and that's not all, bestie — she can also manage SSSD data files for troubleshooting, and the way she does it is safe to do while SSSD is still running. that's the part that's giving main character energy, honestly. 👑

---

✨ AVAILABLE COMMANDS ✨

want the full menu? just run sssctl with no parameters at all and she'll list every command she's got. 🌈

need help for one specific command? run:

sssctl COMMAND --help

and she'll spill the tea on that one only. 💖

---

✨ COMMON OPTIONS ✨

these cuties work with every single command, no exceptions, no gatekeeping. 🫶

• --debug LEVEL — turns on debugging and sets the level. SSSD speaks two whole dialects of "how much do you want to know":

the simple one is a decimal value from 0-9, which enables that level and every level below it. the comprehensive one is a hexadecimal bitmask, which lets you switch specific levels on or off individually — like if there's one particular level you want to suppress. iconic, honestly. 💅

here's the current roster of supported debug levels, exactly as they are:

• 0, 0x0010: Fatal failures. anything that would stop SSSD from starting up, or that makes it stop running.
• 1, 0x0020: Critical failures. an error that doesn't kill SSSD, but it's telling you at least one major feature is not going to work properly.
• 2, 0x0040: Serious failures. an error announcing that a particular request or operation has failed.
• 3, 0x0080: Minor failures. the errors that would percolate down to cause the operation failure of 2.
• 4, 0x0100: Configuration settings.
• 5, 0x0200: Function data.
• 6, 0x0400: Trace messages for operation functions.
• 7, 0x1000: Trace messages for internal control functions.
• 8, 0x2000: Contents of function-internal variables that may be interesting.
• 9, 0x4000: Extremely low-level tracing information.
• 10, 0x10000: Even more low-level libldb tracing information. Almost never really required.

so how do you log a bunch of bitmask levels at once? you literally just add their numbers together, like this:

Example: To log fatal failures, critical failures, serious failures and function data use 0x0270.

Example: To log fatal failures, configuration settings, function data, trace messages for internal control functions use 0x1310.

Note: The bitmask format of debug levels was introduced in 1.7.0.

Default: 0x0070 (i.e. fatal, critical and serious failures; corresponds to setting 2 in decimal notation) — that's where she lives unless you say otherwise. 🌸

---

✨ SEE ALSO ✨

go read these next, bestie, they're all part of the lore: sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5) sssd-systemtap(5)

---

✨ AUTHORS ✨

The SSSD upstream - https://github.com/SSSD/sssd/ 💜

---

and that's the whole page, no cap. this one came from the SSSD manual pages, dated 07/08/2026, and yeah — the original is filed under SSSCTL(8) by SSSD. slay, go check your status bestie 💖✨🎀