367 lines
9.6 KiB
Markdown
367 lines
9.6 KiB
Markdown
# Server Administration
|
|
|
|
## Table of Contents
|
|
|
|
- [ACL Management](#acl-management)
|
|
- [Client Management](#client-management)
|
|
- [Configuration](#configuration)
|
|
- [Replication Acknowledgment](#replication-acknowledgment)
|
|
- [Persistence](#persistence)
|
|
- [Replication](#replication)
|
|
- [Server Lifecycle](#server-lifecycle)
|
|
|
|
## ACL Management
|
|
|
|
Redis ACL (Access Control List) controls which clients can execute which commands and access which keys. Available since Redis 6.0.
|
|
|
|
### User Management
|
|
|
|
```bash
|
|
# Create/modify user with rules
|
|
redis-cli ACL SETUSER username [rule ...]
|
|
|
|
# Delete user
|
|
redis-cli ACL DELUSER username [username ...]
|
|
|
|
# List all users
|
|
redis-cli ACL LIST
|
|
|
|
# Get detailed user info
|
|
redis-cli ACL GETUSER username
|
|
|
|
# Show current authenticated user
|
|
redis-cli ACL WHOAMI
|
|
```
|
|
|
|
### ACL Rules
|
|
|
|
Rules are applied left-to-right and cumulative (unless using `reset`):
|
|
|
|
```
|
|
# Enable/disable user
|
|
on # Enable user
|
|
off # Disable user (default for new users)
|
|
reset # Remove all rules (clean slate)
|
|
|
|
# Password
|
|
>password # Add password (SHA256 hash stored)
|
|
<password # Remove password
|
|
#password # Add SHA256 hash directly
|
|
|
|
# Command permissions
|
|
+command # Allow specific command
|
|
-command # Deny specific command
|
|
+@category # Allow command category (e.g., +@string, +@read)
|
|
-@category # Deny command category
|
|
+@all # Allow all commands
|
|
-@all # Deny all commands (default)
|
|
+|command # Allow command with subcommand (e.g., +|config|get)
|
|
|
|
# Key permissions
|
|
~pattern # Allow key pattern (~* = all keys, default: nothing)
|
|
%R~pattern # Read permission on pattern
|
|
%W~pattern # Write permission on pattern
|
|
~RW~pattern # Read+Write permission (same as ~pattern)
|
|
allkeys # Alias for ~*
|
|
|
|
# Pub/Sub channel permissions (Redis 6.2+)
|
|
&pattern # Allow channel pattern
|
|
allchannels # Allow all channels
|
|
|
|
# Selectors (Redis 7.0+) — independent permission sets
|
|
(+command ~pattern) # Additional permission scope
|
|
```
|
|
|
|
### ACL SETUSER Examples
|
|
|
|
```bash
|
|
# Create admin user
|
|
redis-cli ACL SETUSER admin on >strongpassword ~* +@all
|
|
|
|
# Create read-only user
|
|
redis-cli ACL SETUSER readonly on >password ~* +@read -@all
|
|
|
|
# Create user with limited key access
|
|
redis-cli ACL SETUSER app1 on >password ~app1:* +@read +@string +@hash -@all
|
|
|
|
# Reset user completely and redefine
|
|
redis-cli ACL SETUSER myuser reset on >newpass ~cache:* +@read +get +set
|
|
|
|
# User with selectors (Redis 7.0+)
|
|
redis-cli ACL SETUSER multi on +GET allkeys (+SET ~app1:*)
|
|
```
|
|
|
|
### ACL Maintenance
|
|
|
|
```bash
|
|
# Dry-run: check if user can execute command
|
|
redis-cli ACL DRYRUN username command [arg ...]
|
|
|
|
# Generate random password
|
|
redis-cli ACL GENPASS [bits] # Default 256 bits
|
|
|
|
# Save ACLs to config file
|
|
redis-cli ACL SAVE
|
|
|
|
# Load ACLs from config file
|
|
redis-cli ACL LOAD
|
|
|
|
# View ACL audit log
|
|
redis-cli ACL LOG [count]
|
|
redis-cli ACL LOG RESET # Clear log
|
|
|
|
# List command categories
|
|
redis-cli ACL CAT [category] # Without arg: list categories
|
|
```
|
|
|
|
## Client Management
|
|
|
|
### Client Information
|
|
|
|
```bash
|
|
# List all connected clients
|
|
redis-cli CLIENT LIST [TYPE normal|master|replica|pubsub] [ID id [id ...]]
|
|
|
|
# Get info about current connection
|
|
redis-cli CLIENT INFO
|
|
|
|
# Get current client ID
|
|
redis-cli CLIENT ID
|
|
|
|
# Get client name
|
|
redis-cli CLIENT GETNAME
|
|
```
|
|
|
|
`CLIENT LIST` output fields include: `id`, `addr`, `laddr`, `fd`, `name`, `age`, `idle`, `flags`, `db`, `sub`, `psub`, `ssub`, `multi`, `qbuf`, `qbuf-free`, `argv-mem`, `multi-mem`, `obl`, `oll`, `omem`, `tot-mem`, `cmds`, `redir`, `user`, `resp`, `lib-name`, `lib-ver`, `watch`, `io-thread`.
|
|
|
|
### Client Control
|
|
|
|
```bash
|
|
# Set client name (for identification in CLIENT LIST)
|
|
redis-cli CLIENT SETNAME my-app-worker
|
|
|
|
# Disconnect client
|
|
redis-cli CLIENT KILL ADDR ip:port
|
|
redis-cli CLIENT KILL ID client-id
|
|
redis-cli CLIENT KILL TYPE normal|master|replica|pubsub
|
|
redis-cli CLIENT KILL USER username
|
|
redis-cli CLIENT KILL SKIPME yes|no # Skip current connection
|
|
redis-cli CLIENT KILL LADDR ip:port # Kill by local address
|
|
redis-cli CLIENT KILL MAXAGE max-age # Kill connections older than max-age seconds
|
|
|
|
# Pause/unpause all clients
|
|
redis-cli CLIENT PAUSE timeout [WRITE|ALL] # Milliseconds
|
|
redis-cli CLIENT UNPAUSE
|
|
|
|
# Unblock a client blocked on blocking command
|
|
redis-cli CLIENT UNBLOCK client-id [TIMEOUT|ERROR]
|
|
```
|
|
|
|
### Client Tracking (Server-assisted Client Caching, Redis 6.0+)
|
|
|
|
```bash
|
|
# Enable tracking
|
|
redis-cli CLIENT TRACKING ON [REDIRECT client-id] [PREFIX prefix [prefix ...]] [BCAST] [OPTIN] [OPTOUT] [NOLOOP]
|
|
|
|
# Disable tracking
|
|
redis-cli CLIENT TRACKING OFF
|
|
|
|
# Get tracking info
|
|
redis-cli CLIENT TRACKINGINFO
|
|
|
|
# Opt-in/out caching control
|
|
redis-cli CLIENT CACHING YES|NO
|
|
```
|
|
|
|
### Client Settings
|
|
|
|
```bash
|
|
# Set client info metadata
|
|
redis-cli CLIENT SETINFO LIB-NAME my-client
|
|
redis-cli CLIENT SETINFO LIB-VER 1.0.0
|
|
|
|
# No-touch mode (skip key last-access-time update)
|
|
redis-cli CLIENT NO-TOUCH ON|OFF
|
|
|
|
# No-evict mode (reject eviction during client operations)
|
|
redis-cli CLIENT NO-EVICT ON|OFF
|
|
```
|
|
|
|
## Configuration
|
|
|
|
### Reading Configuration
|
|
|
|
```bash
|
|
# Get specific parameter
|
|
redis-cli CONFIG GET maxmemory
|
|
|
|
# Get with glob patterns (Redis 7.0+ supports multiple)
|
|
redis-cli CONFIG GET *max*
|
|
redis-cli CONFIG GET maxmemory *timeout*
|
|
|
|
# Get all configuration
|
|
redis-cli CONFIG GET '*'
|
|
```
|
|
|
|
### Modifying Configuration
|
|
|
|
```bash
|
|
# Set parameter at runtime
|
|
redis-cli CONFIG SET maxmemory 100mb
|
|
redis-cli CONFIG SET maxmemory-policy allkeys-lru
|
|
redis-cli CONFIG SET timeout 300
|
|
|
|
# Set multiple parameters in one call (Redis 7.0+)
|
|
redis-cli CONFIG SET maxmemory 100mb maxmemory-policy allkeys-lru
|
|
|
|
# Write current config to redis.conf
|
|
redis-cli CONFIG REWRITE
|
|
```
|
|
|
|
Common runtime parameters:
|
|
```
|
|
maxmemory # Max memory (e.g., 100mb, 1gb, 0 = unlimited)
|
|
maxmemory-policy # Eviction: allkeys-lru, volatile-lru, allkeys-lfu, etc.
|
|
timeout # Client idle timeout (seconds, 0 = disabled)
|
|
save # RDB save schedule (e.g., "900 1 300 10 60 10000")
|
|
appendonly # AOF persistence: yes|no
|
|
appendfsync # AOF sync: always|everysec|no
|
|
notify-keyspace-events # Keyspace notifications (e.g., "Ex" for expired events)
|
|
```
|
|
|
|
### Reset Statistics
|
|
|
|
```bash
|
|
redis-cli CONFIG RESETSTAT # Reset INFO statistics counters
|
|
```
|
|
|
|
## Replication Acknowledgment
|
|
|
|
### WAIT
|
|
|
|
Block until write commands are confirmed by the specified number of replicas.
|
|
|
|
```bash
|
|
# Wait for 2 replicas to confirm, up to 5 seconds
|
|
redis-cli SET mykey myvalue
|
|
redis-cli WAIT 2 5000
|
|
# Returns: number of replicas that confirmed (integer)
|
|
|
|
# Fire and forget (don't wait)
|
|
redis-cli WAIT 0 0
|
|
```
|
|
|
|
Useful for ensuring data durability across replicas before proceeding. The count reflects replicas that acknowledged writes up to the moment WAIT was issued.
|
|
|
|
### WAITAOF (Redis 7.2+)
|
|
|
|
Block until writes are confirmed as fsynced to AOF on local and/or replica nodes.
|
|
|
|
```bash
|
|
# Wait for local fsync + 1 replica AOF confirmation, up to 5 seconds
|
|
redis-cli WAITAOF 1 1 5000
|
|
# Returns: local:aof_fsynced, replicated:aof_fsynced_count
|
|
```
|
|
|
|
Parameters:
|
|
- `numlocal` — required local AOF fsync count (0 = don't wait for local)
|
|
- `numreplicas` — required replica AOF fsync count (0 = don't wait for replicas)
|
|
- `timeout` — milliseconds (0 = wait forever)
|
|
|
|
## Persistence
|
|
|
|
### RDB Snapshots
|
|
|
|
```bash
|
|
# Background save (non-blocking, forks a child process)
|
|
redis-cli BGSAVE
|
|
# Background saving started
|
|
|
|
# Synchronous save (blocks the server — avoid in production)
|
|
redis-cli SAVE
|
|
|
|
# Check last save time
|
|
redis-cli LASTSAVE
|
|
# (integer) 1735689600
|
|
|
|
# Check save progress
|
|
redis-cli INFO persistence | grep rdb_last_save_time
|
|
```
|
|
|
|
### AOF Persistence
|
|
|
|
```bash
|
|
# Rewrite AOF in background (compact the append-only file)
|
|
redis-cli BGREWRITEAOF
|
|
# Background append only file rewriting started
|
|
|
|
# Check AOF status
|
|
redis-cli INFO persistence | grep aof_enabled
|
|
|
|
# Force AOF rewrite via config
|
|
redis-cli CONFIG SET appendonly yes
|
|
redis-cli CONFIG SET appendfsync everysec # always|everysec|no
|
|
```
|
|
|
|
### Persistence Configuration
|
|
|
|
```bash
|
|
# RDB save schedule: save after N seconds if at least M keys changed
|
|
redis-cli CONFIG GET save
|
|
redis-cli CONFIG SET save "900 1 300 10 60 10000"
|
|
|
|
# AOF settings
|
|
redis-cli CONFIG GET appendonly
|
|
redis-cli CONFIG GET appendfsync
|
|
redis-cli CONFIG GET auto-aof-rewrite-percentage
|
|
```
|
|
|
|
## Replication
|
|
|
|
### Configure Replication
|
|
|
|
```bash
|
|
# Make current instance a replica of another Redis
|
|
redis-cli REPLICAOF host port
|
|
# OK
|
|
|
|
# Promote replica back to master
|
|
redis-cli REPLICAOF NO ONE
|
|
# OK
|
|
|
|
# Check replication status
|
|
redis-cli INFO replication
|
|
redis-cli ROLE
|
|
```
|
|
|
|
### Replication Info
|
|
|
|
```bash
|
|
redis-cli INFO replication | grep -E "role|connected_slaves|master_repl_offset"
|
|
```
|
|
|
|
## Server Lifecycle
|
|
|
|
### Shutdown
|
|
|
|
```bash
|
|
# Save and shutdown (blocks until complete)
|
|
redis-cli SHUTDOWN NOSAVE|SAVE
|
|
|
|
# Shutdown with save (default if not specified)
|
|
redis-cli SHUTDOWN SAVE
|
|
|
|
# Shutdown without saving
|
|
redis-cli SHUTDOWN NOSAVE
|
|
|
|
# Check if server is responding
|
|
redis-cli PING
|
|
```
|
|
|
|
### Failover (Redis 7.0+)
|
|
|
|
```bash
|
|
# Coordinated failover via sentinel-like mechanism
|
|
redis-cli FAILOVER [TO host port [FORCE]] [ABORT] [TIMEOUT milliseconds]
|
|
```
|