neulab/tldr huggingface dataset:
In general, end-users should never need to explicitly use this option, as it is automatically added by the OpenVPN service wrapper when a given OpenVPN configuration is being run as a service.
exit-event is the name of a Windows global event object, and OpenVPN will continuously monitor the state of this event object and exit when it becomes signaled.
The second parameter indicates the initial state of exit-event and normally defaults to 0.
Multiple OpenVPN processes can be simultaneously executed with the same exit-event parameter. In any case, the controlling process can signal exit-event, causing all such OpenVPN processes to exit.
When executing an OpenVPN process using the --service directive, OpenVPN will probably not have a console window to output status/error messages, therefore it is useful to use --log or --log-append to write these messages to a file.
--show-adapters (Standalone) Show available TAP-Win32 adapters which can be selected using the --dev-node option. On non-Windows systems, the ifconfig(8) command provides similar functionality.
--show-net (Standalone) Show OpenVPN's view of the system routing table and network adapter list.
--show-net-up Output OpenVPN's view of the system routing table and network adapter list to the syslog or log file after the TUN/TAP adapter has been brought up and any routes have been added.
--show-valid-subnets (Standalone) Show valid subnets for --dev tun emulation. Since the TAP-Win32 driver exports an ethernet interface to Windows, and since TUN devices are point-to-point in nature, it is necessary for the TAP-Win32 driver to impose certain constraints on TUN endpoint address selection.
Namely, the point-to-point endpoints used in TUN device emulation must be the middle two addresses of a /30 subnet (netmask 255.255.255.252).
--tap-sleep n Cause OpenVPN to sleep for n seconds immediately after the TAP-Win32 adapter state is set to "connected".
This option is intended to be used to troubleshoot problems with the --ifconfig and --ip-win32 options, and is used to give the TAP-Win32 adapter time to come up before Windows IP Helper API operations are applied to it.
--win-sys path Set the Windows system directory pathname to use when looking for system executables such as route.exe and netsh.exe. By default, if this directive is not specified, OpenVPN will use the SystemRoot environment variable.
This option has changed behaviour since OpenVPN 2.3. Earlier you had to define --win-sys env to use the SystemRoot environment variable, otherwise it defaulted to C:\\WINDOWS. It is not needed to use the env keyword any more, and it will just be ignored. A warning is logged when this is found in the configuration file.
--windows-driver drv Specifies which tun driver to use. Values are tap-windows6 (default) and wintun.  This is a Windows-only option.  wintun" requires --dev tun and the OpenVPN process to run elevated, or be invoked using the Interactive Service.
Standalone Debug Options --show-gateway args (Standalone) Show current IPv4 and IPv6 default gateway and interface towards the gateway (if the protocol in question is enabled).
--show-gateway --show-gateway IPv6-target
For IPv6 this queries the route towards ::/128, or the specified IPv6 target address if passed as argument.  For IPv4 on Linux, Windows, MacOS and BSD it looks for a 0.0.0.0/0 route.  If there are more specific routes, the result will not always be matching the route of the IPv4 packets to the VPN gateway.
Advanced Expert Options These are options only required when special tweaking is needed, often used when debugging or testing out special usage scenarios.
--hash-size args Set the size of the real address hash table to r and the virtual address table to v.
hash-size r v
By default, both tables are sized at 256 buckets.
--bcast-buffers n Allocate n buffers for broadcast datagrams (default 256).
--persist-local-ip Preserve initially resolved local IP address and port number across SIGUSR1 or --ping-restart restarts.
--persist-remote-ip Preserve most recently authenticated remote IP address and port number across SIGUSR1 or --ping-restart restarts.
--prng args (Advanced) Change the PRNG (Pseudo-random number generator) parameters
prng alg prng alg nsl
Changes the PRNG to use digest algorithm alg (default sha1), and set nsl (default 16) to the size in bytes of the nonce secret length (between 16 and 64).
Set alg to none to disable the PRNG and use the OpenSSL RAND_bytes function instead for all of OpenVPN's pseudo-random number needs.
--rcvbuf size Set the TCP/UDP socket receive buffer size. Defaults to operating system default.
--shaper n Limit bandwidth of outgoing tunnel data to n bytes per second on the TCP/UDP port. Note that this will only work if mode is set to p2p.  If you want to limit the bandwidth in both directions, use this option on both peers.
OpenVPN uses the following algorithm to implement traffic shaping: Given a shaper rate of n bytes per second, after a datagram write of b bytes is queued on the TCP/UDP port, wait a minimum of (b / n) seconds before queuing the next write.
It should be noted that OpenVPN supports multiple tunnels between the same two peers, allowing you to construct full-speed and reduced bandwidth tunnels at the same time, routing low-priority data such as off-site backups over the reduced bandwidth tunnel, and other data over the full-speed tunnel.
Also note that for low bandwidth tunnels (under 1000 bytes per second), you should probably use lower MTU values as well (see above), otherwise the packet latency will grow so large as to trigger timeouts in the TLS layer and TCP connections running over the tunnel.
OpenVPN allows n to be between 100 bytes/sec and 100 Mbytes/sec.
--sndbuf size Set the TCP/UDP socket send buffer size. Defaults to operating system default.
--tcp-queue-limit n Maximum number of output packets queued before TCP (default 64).
When OpenVPN is tunneling data from a TUN/TAP device to a remote client over a TCP connection, it is possible that the TUN/TAP device might produce data at a faster rate than the TCP connection can support. When the number of output packets queued before sending to the TCP socket reaches this limit for a given client connection, OpenVPN will start to drop outgoing packets directed at this client.
--txqueuelen n (Linux only) Set the TX queue length on the TUN/TAP interface. Currently defaults to operating system default.
Options listed in this section have been removed from OpenVPN and are no longer supported
--client-cert-not-required Removed in OpenVPN 2.5.  This should be replaxed with --verify-client-cert none.
--ifconfig-pool-linear Removed in OpenVPN 2.5.  This should be replaced with --topology p2p.
--key-method Removed in OpenVPN 2.5.  This option should not be used, as using the old key-method weakens the VPN tunnel security.  The old key-method was also only needed when the remote side was older than OpenVPN 2.0.
--no-iv Removed in OpenVPN 2.5.  This option should not be used as it weakens the VPN tunnel security.  This has been a NOOP option since OpenVPN 2.4.
--no-replay Removed in OpenVPN 2.5.  This option should not be used as it weakens the VPN tunnel security.
--ns-cert-type Removed in OpenVPN 2.5.  The nsCertType field is no longer supported in recent SSL/TLS libraries.  If your certificates does not include key usage and extended key usage fields, they must be upgraded and the --remote-cert-tls option should be used instead.
Client configuration files may contain multiple remote servers which it will attempt to connect against.  But there are some configuration options which are related to specific --remote options.  For these use cases, connection profiles are the solution.
By enacpulating the --remote option and related options within <connection> and </connection>, these options are handled as a group.
An OpenVPN client will try each connection profile sequentially until it achieves a successful connection.
--remote-random can be used to initially "scramble" the connection list.
Here is an example of connection profile usage:
client dev tun
<connection> remote 198.19.34.56 1194 udp </connection>
<connection> remote 198.19.34.56 443 tcp </connection>
<connection> remote 198.19.34.56 443 tcp http-proxy 192.168.0.8 8080 </connection>
<connection> remote 198.19.36.99 443 tcp http-proxy 192.168.0.8 8080 </connection>
persist-key persist-tun pkcs12 client.p12 remote-cert-tls server verb 3
First we try to connect to a server at 198.19.34.56:1194 using UDP. If that fails, we then try to connect to 198.19.34.56:443 using TCP. If that also fails, then try connecting through an HTTP proxy at 192.168.0.8:8080 to 198.19.34.56:443 using TCP. Finally, try to connect through the same proxy to a server at 198.19.36.99:443 using TCP.
The following OpenVPN options may be used inside of a <connection> block:
bind, connect-retry, connect-retry-max, connect-timeout, explicit-exit-notify, float, fragment, http-proxy, http-proxy-option, key-direction, link-mtu, local, lport, mssfix, mtu-disc, nobind, port, proto, remote, rport, socks-proxy, tls-auth, tls-crypt, tun-mtu and, tun-mtu-extra.
A defaulting mechanism exists for specifying options to apply to all <connection> profiles. If any of the above options (with the exception of remote ) appear outside of a <connection> block, but in a configuration file which has one or more <connection> blocks, the option setting will be used as a default for <connection> blocks which follow it in the configuration file.
For example, suppose the nobind option were placed in the sample configuration file above, near the top of the file, before the first <connection> block. The effect would be as if nobind were declared in all <connection> blocks below it.
OpenVPN allows including files in the main configuration for the --ca, --cert, --dh, --extra-certs, --key, --pkcs12, --secret, --crl-verify, --http-proxy-user-pass, --tls-auth, --auth-gen-token-secret, --tls-crypt and --tls-crypt-v2 options.
Each inline file started by the line <option> and ended by the line </option>
Here is an example of an inline file usage
<cert> -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- </cert>
When using the inline file feature with --pkcs12 the inline file has to be base64 encoded. Encoding of a .p12 file into base64 can be done for example with OpenSSL by running openssl base64 -in input.p12
SIGHUP Cause OpenVPN to close all TUN/TAP and network connections, restart, re-read the configuration file (if any), and reopen TUN/TAP and network connections.
SIGUSR1 Like SIGHUP`, except don't re-read configuration file, and possibly don't close and reopen TUN/TAP device, re-read key files, preserve local IP address/port, or preserve most recently authenticated remote IP address/port based on --persist-tun, --persist-key, --persist-local-ip and --persist-remote-ip options respectively (see above).
This signal may also be internally generated by a timeout condition, governed by the --ping-restart option.
This signal, when combined with --persist-remote-ip, may be sent when the underlying parameters of the host's network interface change such as when the host is a DHCP client and is assigned a new IP address.  See --ipchange for more information.
SIGUSR2 Causes OpenVPN to display its current statistics (to the syslog file if --daemon is used, or stdout otherwise).
SIGINT, SIGTERM Causes OpenVPN to exit gracefully.
https://community.openvpn.net/openvpn/wiki/FAQ
For a more comprehensive guide to setting up OpenVPN in a production setting, see the OpenVPN HOWTO at https://openvpn.net/community-resources/how-to/
For a description of OpenVPN's underlying protocol, see https://openvpn.net/community-resources/openvpn-protocol/
OpenVPN's web site is at https://openvpn.net/
Go here to download the latest version of OpenVPN, subscribe to the mailing lists, read the mailing list archives, or browse the SVN repository.
Report all bugs to the OpenVPN team info@openvpn.net
openvpn-examples(5), dhcpcd(8), ifconfig(8), openssl(1), route(8), scp(1) ssh(1)
This product includes software developed by the OpenSSL Project (‐ https://www.openssl.org/)
For more information on the TLS protocol, see http://www.ietf.org/rfc/rfc2246.txt
For more information on the LZO real-time compression library see https://www.oberhumer.com/opensource/lzo/
Copyright (C) 2002-2020 OpenVPN Inc This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation.
James Yonan james@openvpn.net
DMESG(1)                          User Commands                         DMESG(1)
dmesg - print or control the kernel ring buffer
dmesg [options]
dmesg --clear
dmesg --read-clear [options]
dmesg --console-level level
dmesg --console-on
dmesg --console-off
dmesg is used to examine or control the kernel ring buffer.
The default action is to display all messages from the kernel ring buffer.
The --clear, --read-clear, --console-on, --console-off, and --console-level options are mutually exclusive.
-C, --clear Clear the ring buffer.
-c, --read-clear Clear the ring buffer after first printing its contents.
-D, --console-off Disable the printing of messages to the console.
-d, --show-delta Display the timestamp and the time delta spent between messages. If used together with --notime then only the time delta without the timestamp is printed.
-E, --console-on Enable printing messages to the console.
-e, --reltime Display the local time and the delta in human-readable format. Be aware that conversion to the local time could be inaccurate (see -T for more details).
-F, --file file Read the syslog messages from the given file. Note that -F does not support messages in kmsg format. The old syslog format is supported only.
-f, --facility list Restrict output to the given (comma-separated) list of facilities. For example:
dmesg --facility=daemon
will print messages from system daemons only. For all supported facilities see the --help output.
-H, --human Enable human-readable output. See also --color, --reltime and --nopager.
-k, --kernel Print kernel messages.
-L, --color[=when] Colorize the output. The optional argument when can be auto, never or always. If the when argument is omitted, it defaults to auto. The colors can be disabled; for the current built-in default see the --help output. See also the COLORS section below.
-l, --level list Restrict output to the given (comma-separated) list of levels. For example:
dmesg --level=err,warn
will print error and warning messages only. For all supported levels see the --help output.
-n, --console-level level Set the level at which printing of messages is done to the console. The level is a level number or abbreviation of the level name. For all supported levels see the --help output.
For example, -n 1 or -n emerg prevents all messages, except emergency (panic) messages, from appearing on the console. All levels of messages are still written to /proc/kmsg, so syslogd(8) can still be used to control exactly where kernel messages appear. When the -n option is used, dmesg will not print or clear the kernel ring buffer.
--noescape The unprintable and potentially unsafe characters (e.g., broken multi-byte sequences, terminal controlling chars, etc.) are escaped in format \x<hex> for security reason by default. This option disables this feature at all. It’s usable for example for debugging purpose together with --raw. Be careful and don’t use it by default.
-P, --nopager Do not pipe output into a pager. A pager is enabled by default for --human output.
-p, --force-prefix Add facility, level or timestamp information to each line of a multi-line message.
-r, --raw Print the raw message buffer, i.e., do not strip the log-level prefixes, but all unprintable characters are still escaped (see also --noescape).
Note that the real raw format depends on the method how dmesg reads kernel messages. The /dev/kmsg device uses a different format than syslog(2). For backward compatibility, dmesg returns data always in the syslog(2) format. It is possible to read the real raw data from /dev/kmsg by, for example, the command 'dd if=/dev/kmsg iflag=nonblock'.
-S, --syslog Force dmesg to use the syslog(2) kernel interface to read kernel messages. The default is to use /dev/kmsg rather than syslog(2) since kernel 3.5.0.
-s, --buffer-size size Use a buffer of size to query the kernel ring buffer. This is 16392 by default. (The default kernel syslog buffer size was 4096 at first, 8192 since 1.3.54, 16384 since 2.1.113.) If you have set the kernel buffer to be larger than the default, then this option can be used to view the entire buffer.
-T, --ctime Print human-readable timestamps.
Be aware that the timestamp could be inaccurate! The time source used for the logs is not updated after system SUSPEND/RESUME. Timestamps are adjusted according to current delta between boottime and monotonic clocks, this works only for messages printed after last resume.
--since time Display record since the specified time. The time is possible to specify in absolute way as well as by relative notation (e.g. '1 hour ago'). Be aware that the timestamp could be inaccurate and see --ctime for more details.
--until time Display record until the specified time. The time is possible to specify in absolute way as well as by relative notation (e.g. '1 hour ago'). Be aware that the timestamp could be inaccurate and see --ctime for more details.
-t, --notime Do not print kernel’s timestamps.
--time-format format Print timestamps using the given format, which can be ctime, reltime, delta or iso. The first three formats are aliases of the time-format-specific options. The iso format is a dmesg implementation of the ISO-8601 timestamp format. The purpose of this format is to make the comparing of timestamps between two systems, and any other parsing, easy. The definition of the iso timestamp is: YYYY-MM-DD<T>HH:MM:SS,<microseconds>←+><timezone offset from UTC>.
The iso format has the same issue as ctime: the time may be inaccurate when a system is suspended and resumed.
-u, --userspace Print userspace messages.
-w, --follow Wait for new messages. This feature is supported only on systems with a readable /dev/kmsg (since kernel 3.5.0).
-W, --follow-new Wait and print only new messages.
-x, --decode Decode facility and level (priority) numbers to human-readable prefixes.
Implicit coloring can be disabled by an empty file /etc/terminal-colors.d/dmesg.disable. See terminal-colors.d(5) for more details about colorization configuration.
The logical color names supported by dmesg are:
subsys The message sub-system prefix (e.g., "ACPI:").
time The message timestamp.
timebreak The message timestamp in short ctime format in --reltime or --human output.
alert The text of the message with the alert log priority.
crit The text of the message with the critical log priority.
err The text of the message with the error log priority.
warn The text of the message with the warning log priority.
segfault The text of the message that inform about segmentation fault.
dmesg can fail reporting permission denied error. This is usually caused by dmesg_restrict kernel setting, please see syslog(2) for more details.
dmesg was originally written by Theodore Ts’o <tytso@athena.mit.edu>.
terminal-colors.d(5), syslogd(8)
The dmesg command is part of the util-linux package which can be downloaded from Linux Kernel Archive <https://www.kernel.org/pub/linux/utils/util-linux/>.
DNF(8)                                 DNF                                DNF(8)
dnf - DNF Command Reference
dnf [options] <command> [<args>...]
DNF is the next upcoming major version of YUM, a package manager for RPM-based Linux distributions. It roughly maintains CLI compatibility with YUM and defines a strict API for extensions and plugins.
Plugins can modify or extend features of DNF or provide additional CLI commands on top of those mentioned below. If you know the name of such a command (including commands mentioned below), you may find/install the package which provides it using the appropriate virtual provide in the form of dnf-command(<alias>), where <alias> is the name of the command; e.g.``dnf install 'dnf-command(versionlock)'`` installs a versionlock plugin. This approach also applies to specifying dependencies of packages that require a particular DNF command.
• 0  : Operation was successful.
• 1  : An error occurred, which was handled by dnf.
• 3  : An unknown unhandled error occurred during operation.
• 100: See check-update
• 200: There was a problem with acquiring or releasing of locks.
Available commands:
• alias
• autoremove
• check-update
• clean
• deplist
• distro-sync
• downgrade
• help
• history
• makecache
• mark
• module
• provides
• reinstall
• remove
• repoinfo
• repolist
• repoquery
• repository-packages
• shell
• updateinfo
• upgrade
• upgrade-minimal
Additional information:
• Specifying Packages
• Specifying Provides
• Specifying File Provides
• Specifying Groups
• Specifying Transactions
• Metadata Synchronization
• Configuration Files Replacement Policy
• Files
-4     Resolve to IPv4 addresses only.
-6     Resolve to IPv6 addresses only.
--advisory=<advisory>, --advisories=<advisory> Include packages corresponding to the advisory ID, Eg. FEDORA-2201-123.  Applicable for the install, repoquery, updateinfo and upgrade commands.
--allowerasing Allow erasing of installed packages to resolve dependencies. This option could be used as an alternative to the yum swap command where packages to remove are not explicitly defined.
--assumeno Automatically answer no for all questions.
-b, --best Try the best available package versions in transactions. Specifically during dnf upgrade, which by default skips over updates that can not be installed for dependency reasons, the switch forces DNF to only consider the latest packages. When running into packages with broken dependencies, DNF will fail giving a reason why the latest version can not be installed.
Note that the use of the newest available version is only guaranteed for the packages directly requested (e.g. as a command line arguments), and the solver may use older versions of dependencies to meet their requirements.
--bugfix Include packages that fix a bugfix issue. Applicable for the install, repoquery, updateinfo and upgrade commands.
--bz=<bugzilla>, --bzs=<bugzilla> Include packages that fix a Bugzilla ID, Eg. 123123. Applicable for the install, repoquery, updateinfo and upgrade commands.
-C, --cacheonly Run entirely from system cache, don't update the cache and use it even in case it is expired.
DNF uses a separate cache for each user under which it executes. The cache for the root user is called the system cache. This switch allows a regular user read-only access to the system cache, which usually is more fresh than the user's and thus he does not have to wait for metadata sync.
--color=<color> Control whether color is used in terminal output. Valid values are always, never and auto (default).
--comment=<comment> Add a comment to the transaction history.
-c <config file>, --config=<config file> Configuration file location.
--cve=<cves>, --cves=<cves> Include packages that fix a CVE (Common Vulnerabilities and Exposures) ID (http://cve.mitre.org/about/), Eg. CVE-2201-0123. Applicable for the install, repoquery, updateinfo, and upgrade commands.
-d <debug level>, --debuglevel=<debug level> Debugging output level. This is an integer value between 0 (no additional information strings) and 10 (shows all debugging information, even that not understandable to the user), default is 2. Deprecated, use -v instead.
--debugsolver Dump data aiding in dependency solver debugging into ./debugdata.
--disableexcludes=[all|main|<repoid>], --disableexcludepkgs=[all|main|<repoid>] Disable the configuration file excludes. Takes one of the following three options:
• all, disables all configuration file excludes
• main, disables excludes defined in the [main] section
• repoid, disables excludes defined for the given repository
--disable, --set-disabled Disable specified repositories (automatically saves). The option has to be used together with the config-manager command (dnf-plugins-core).
--disableplugin=<plugin names> Disable the listed plugins specified by names or globs.
--disablerepo=<repoid> Disable specific repositories by an id or a glob. This option is mutually exclusive with --repo.
--downloaddir=<path>, --destdir=<path> Redirect downloaded packages to provided directory. The option has to be used together with the --downloadonly command line option, with the download command (dnf-plugins-core) or with the system-upgrade command (dnf-plugins-extras).
--downloadonly Download the resolved package set without performing any rpm transaction (install/upgrade/erase).
-e <error level>, --errorlevel=<error level> Error output level. This is an integer value between 0 (no error output) and 10 (shows all error messages), default is 3. Deprecated, use -v instead.
--enable, --set-enabled Enable specified repositories (automatically saves). The option has to be used together with the config-manager command (dnf-plugins-core).
--enableplugin=<plugin names> Enable the listed plugins specified by names or globs.
--enablerepo=<repoid> Enable additional repositories by an id or a glob.
--enhancement Include enhancement relevant packages. Applicable for the install, repoquery, updateinfo and upgrade commands.
-x <package-file-spec>, --exclude=<package-file-spec> Exclude packages specified by <package-file-spec> from the operation.
--excludepkgs=<package-file-spec> Deprecated option. It was replaced by the --exclude option.
--forcearch=<arch> Force the use of an architecture. Any architecture can be specified.  However, use of an architecture not supported natively by your CPU will require emulation of some kind. This is usually through QEMU. The behavior of --forcearch can be configured by using the arch and ignorearch configuration options with values <arch> and True respectively.
-h, --help, --help-cmd Show the help.
--installroot=<path> Specifies an alternative installroot, relative to where all packages will be installed. Think of this like doing chroot <root> dnf, except using --installroot allows dnf to work before the chroot is created. It requires absolute path.
• cachedir, log files, releasever, and gpgkey are taken from or stored in the installroot. Gpgkeys are imported into the installroot from a path relative to the host which can be specified in the repository section of configuration files.
• configuration file and reposdir are searched inside the installroot first. If they are not present, they are taken from the host system. Note:  When a path is specified within a command line argument (--config=<config file> in case of configuration file and --setopt=reposdir=<reposdir> for reposdir) then this path is always relative to the host with no exceptions.
• vars are taken from the host system or installroot according to reposdir . When reposdir path is specified within a command line argument, vars are taken from the installroot. When varsdir paths are specified within a command line argument (--setopt=varsdir=<reposdir>) then those path are always relative to the host with no exceptions.
• The pluginpath and pluginconfpath are relative to the host. Note: You may also want to use the command-line option --releasever=<release> when creating the installroot, otherwise the $releasever value is taken from the rpmdb within the installroot (and thus it is empty at the time of creation and the transaction will fail). If --releasever=/ is used, the releasever will be detected from the host (/) system. The new installroot path at the time of creation does not contain the repository, releasever and dnf.conf files.
On a modular system you may also want to use the --setopt=module_platform_id=<module_platform_name:stream> command-line option when creating the installroot, otherwise the module_platform_id value will be taken from the /etc/os-release file within the installroot (and thus it will be empty at the time of creation, the modular dependency could be unsatisfied and modules content could be excluded).
Installroot examples:
dnf --installroot=<installroot> --releasever=<release> install system-release Permanently sets the releasever of the system in the <installroot> directory to <release>.
dnf --installroot=<installroot> --setopt=reposdir=<path> --config /path/dnf.conf upgrade Upgrades packages inside the installroot from a repository described by --setopt using configuration from /path/dnf.conf.
--newpackage Include newpackage relevant packages. Applicable for the install, repoquery, updateinfo and upgrade commands.
--noautoremove Disable removal of dependencies that are no longer used. It sets clean_requirements_on_remove configuration option to False.
--nobest Set best option to False, so that transactions are not limited to best candidates only.
--nodocs Do not install documentation. Sets the rpm flag 'RPMTRANS_FLAG_NODOCS'.
--nogpgcheck Skip checking GPG signatures on packages (if RPM policy allows).
--noplugins Disable all plugins.
--obsoletes This option has an effect on an install/update, it enables dnf's obsoletes processing logic. For more information see the obsoletes option.
This option also displays capabilities that the package obsoletes when used together with the repoquery command.
Configuration Option: obsoletes
-q, --quiet In combination with a non-interactive command, shows just the relevant content. Suppresses messages notifying about the current state or actions of DNF.
-R <minutes>, --randomwait=<minutes> Maximum command wait time.
--refresh Set metadata as expired before running the command.
--releasever=<release> Configure DNF as if the distribution release was <release>. This can affect cache paths, values in configuration files and mirrorlist URLs.
--repofrompath <repo>,<path/url> Specify a repository to add to the repositories for this query. This option can be used multiple times.
• The repository label is specified by <repo>.
• The path or url to the repository is specified by <path/url>.  It is the same path as a baseurl and can be also enriched by the repo variables.
• The configuration for the repository can be adjusted using -‐ -setopt=<repo>.<option>=<value>.
• If you want to view only packages from this repository, combine this with the --repo=<repo> or --disablerepo="*" switches.
--repo=<repoid>, --repoid=<repoid> Enable just specific repositories by an id or a glob. Can be used multiple times with accumulative effect. It is basically a shortcut for --disablerepo="*" --enablerepo=<repoid> and is mutually exclusive with the --disablerepo option.
--rpmverbosity=<name> RPM debug scriptlet output level. Sets the debug level to <name> for RPM scriptlets.  For available levels, see the rpmverbosity configuration option.
--sec-severity=<severity>, --secseverity=<severity> Includes packages that provide a fix for an issue of the specified severity.  Applicable for the install, repoquery, updateinfo and upgrade commands.
--security Includes packages that provide a fix for a security issue. Applicable for the upgrade command.
--setopt=<option>=<value> Override a configuration option from the configuration file. To override configuration options for repositories, use repoid.option for the <option>. Values for configuration options like excludepkgs, includepkgs, installonlypkgs and tsflags are appended to the original value, they do not override it. However, specifying an empty value (e.g. --setopt=tsflags=) will clear the option.
--skip-broken Resolve depsolve problems by removing packages that are causing problems from the transaction.  It is an alias for the strict configuration option with value False.  Additionally, with the enable and disable module subcommands it allows one to perform an action even in case of broken modular dependencies.
--showduplicates Show duplicate packages in repositories. Applicable for the list and search commands.
-v, --verbose Verbose operation, show debug messages.
--version Show DNF version and exit.
-y, --assumeyes Automatically answer yes for all questions.
List options are comma-separated. Command-line options override respective settings from configuration files.
For an explanation of <package-spec>, <package-file-spec> and <package-name-spec> see Specifying Packages.
For an explanation of <provide-spec> see Specifying Provides.
For an explanation of <group-spec> see Specifying Groups.
For an explanation of <module-spec> see Specifying Modules.
For an explanation of <transaction-spec> see Specifying Transactions.
Alias Command Command: alias
Allows the user to define and manage a list of aliases (in the form <name=value>), which can be then used as dnf commands to abbreviate longer command sequences. For examples on using the alias command, see Alias Examples. For examples on the alias processing, see Alias Processing Examples.
To use an alias (name=value), the name must be placed as the first "command" (e.g. the first argument that is not an option). It is then replaced by its value and the resulting sequence is again searched for aliases. The alias processing stops when the first found command is not a name of any alias.
In case the processing would result in an infinite recursion, the original arguments are used instead.
Also, like in shell aliases, if the result starts with a \, the alias processing will stop.
All aliases are defined in configuration files in the /etc/dnf/aliases.d/ directory in the [aliases] section, and aliases created by the alias command are written to the USER.conf file. In case of conflicts, the USER.conf has the highest priority, and alphabetical ordering is used for the rest of the configuration files.
Optionally, there is the enabled option in the [main] section defaulting to True. This can be set for each file separately in the respective file, or globally for all aliases in the ALIASES.conf file.
dnf alias [options] [list] [<name>...] List aliases with their final result. The [<alias>...] parameter further limits the result to only those aliases matching it.
dnf alias [options] add <name=value>... Create new aliases.
dnf alias [options] delete <name>... Delete aliases.
Alias Examples dnf alias list Lists all defined aliases.
dnf alias add rm=remove Adds a new command alias called rm which works the same as the remove command.
dnf alias add upgrade="\upgrade --skip-broken --disableexcludes=all --obsoletes" Adds a new command alias called upgrade which works the same as the upgrade command, with additional options. Note that the original upgrade command is prefixed with a \ to prevent an infinite loop in alias processing.
Alias Processing Examples If there are defined aliases in=install and FORCE="--skip-broken --disableexcludes=all":
• dnf FORCE in will be replaced with dnf --skip-broken --disableexcludes=all install
• dnf in FORCE will be replaced with dnf install FORCE (which will fail)
If there is defined alias in=install:
• dnf in will be replaced with dnf install
• dnf --repo updates in will be replaced with dnf --repo updates in (which will fail)
Autoremove Command Command: autoremove Aliases for explicit NEVRA matching: autoremove-n, autoremove-na, autoremove-nevra
dnf [options] autoremove Removes all "leaf" packages from the system that were originally installed as dependencies of user-installed packages, but which are no longer required by any such package.
Packages listed in installonlypkgs are never automatically removed by this command.
dnf [options] autoremove <spec>... This is an alias for the Remove Command command with clean_requirements_on_remove set to True. It removes the specified packages from the system along with any packages depending on the packages being removed. Each <spec> can be either a <package-spec>, which specifies a package directly, or a @<group-spec>, which specifies an (environment) group which contains it. It also removes any dependencies that are no longer needed.
There are also a few specific autoremove commands autoremove-n, autoremove-na and autoremove-nevra that allow the specification of an exact argument in the NEVRA (name-epoch:version-release.architecture) format.
This command by default does not force a sync of expired metadata. See also Metadata Synchronization.
Check Command Command: check
dnf [options] check [--dependencies] [--duplicates] [--obsoleted] [--provides] Checks the local packagedb and produces information on any problems it finds. You can limit the checks to be performed by using the --dependencies, --duplicates, --obsoleted and --provides options (the default is to check everything).
Check-Update Command Command: check-update Aliases: check-upgrade
dnf [options] check-update [--changelogs] [<package-file-spec>...] Non-interactively checks if updates of the specified packages are available. If no <package-file-spec> is given, checks whether any updates at all are available for your system. DNF exit code will be 100 when there are updates available and a list of the updates will be printed, 0 if not and 1 if an error occurs. If --changelogs option is specified, also changelog delta of packages about to be updated is printed.
Please note that having a specific newer version available for an installed package (and reported by check-update) does not imply that subsequent dnf upgrade will install it. The difference is that dnf upgrade has restrictions (like package dependencies being satisfied) to take into account.
The output is affected by the autocheck_running_kernel configuration option.
Clean Command Command: clean
Performs cleanup of temporary files kept for repositories. This includes any such data left behind from disabled or removed repositories as well as for different distribution release versions.
dnf clean dbcache Removes cache files generated from the repository metadata. This forces DNF to regenerate the cache files the next time it is run.
dnf clean expire-cache Marks the repository metadata expired. DNF will re-validate the cache for each repository the next time it is used.
dnf clean metadata Removes repository metadata. Those are the files which DNF uses to determine the remote availability of packages. Using this option will make DNF download all the metadata the next time it is run.
dnf clean packages Removes any cached packages from the system.
dnf clean all Does all of the above.
Deplist Command dnf [options] deplist [<select-options>] [<query-options>] [<package-spec>] Deprecated alias for dnf repoquery --deplist.
Distro-Sync Command Command: distro-sync Aliases: dsync Deprecated aliases: distrosync, distribution-synchronization
dnf distro-sync [<package-spec>...] As necessary upgrades, downgrades or keeps selected installed packages to match the latest version available from any enabled repository. If no package is given, all installed packages are considered.
See also Configuration Files Replacement Policy.
Downgrade Command Command: downgrade Aliases: dg
dnf [options] downgrade <package-spec>... Downgrades the specified packages to the highest installable package of all known lower versions if possible. When version is given and is lower than version of installed package then it downgrades to target version.
Group Command Command: group Aliases: grp Deprecated aliases: groups, grouplist, groupinstall, groupupdate, groupremove, grouperase, groupinfo
Groups are virtual collections of packages. DNF keeps track of groups that the user selected ("marked") installed and can manipulate the comprising packages with simple commands.
dnf [options] group [summary] <group-spec> Display overview of how many groups are installed and available. With a spec, limit the output to the matching groups. summary is the default groups subcommand.
dnf [options] group info <group-spec> Display package lists of a group. Shows which packages are installed or available from a repository when -v is used.
dnf [options] group install [--with-optional] <group-spec>... Mark the specified group installed and install packages it contains. Also include optional packages of the group if --with-optional is specified. All mandatory and Default packages will be installed whenever possible.  Conditional packages are installed if they meet their requirement.  If the group is already (partially) installed, the command installs the missing packages from the group.  Depending on the value of obsoletes configuration option group installation takes obsoletes into account.
dnf [options] group list <group-spec>... List all matching groups, either among installed or available groups. If nothing is specified, list all known groups. --installed and --available options narrow down the requested list.  Records are ordered by the display_order tag defined in comps.xml file.  Provides a list of all hidden groups by using option --hidden.  Provides group IDs when the -v or --ids options are used.
dnf [options] group remove <group-spec>... Mark the group removed and remove those packages in the group from the system which do not belong to another installed group and were not installed explicitly by the user.
dnf [options] group upgrade <group-spec>... Upgrades the packages from the group and upgrades the group itself. The latter comprises of installing packages that were added to the group by the distribution and removing packages that got removed from the group as far as they were not installed explicitly by the user.
Groups can also be marked installed or removed without physically manipulating any packages:
dnf [options] group mark install <group-spec>... Mark the specified group installed. No packages will be installed by this command, but the group is then considered installed.
dnf [options] group mark remove <group-spec>... Mark the specified group removed. No packages will be removed by this command.
Help Command Command: help
dnf help [<command>] Displays the help text for all commands. If given a command name then only displays help for that particular command.
History Command Command: history Aliases: hist
The history command allows the user to view what has happened in past transactions and act according to this information (assuming the history_record configuration option is set).
dnf history [list] [--reverse] [<spec>...] The default history action is listing information about given transactions in a table. Each <spec> can be either a <transaction-spec>, which specifies a transaction directly, or a <transaction-spec>..<transaction-spec>, which specifies a range of transactions, or a <package-name-spec>, which specifies a transaction by a package which it manipulated. When no transaction is specified, list all known transactions.
--reverse The order of history list output is printed in reverse order.
dnf history info [<spec>...] Describe the given transactions. The meaning of <spec> is the same as in the History List Command. When no transaction is specified, describe what happened during the latest transaction.
dnf history redo <transaction-spec>|<package-file-spec> Repeat the specified transaction. Uses the last transaction (with the highest ID) if more than one transaction for given <package-file-spec> is found. If it is not possible to redo some operations due to the current state of RPMDB, it will not redo the transaction.
dnf history replay [--ignore-installed] [--ignore-extras] [--skip-unavailable] <filename> Replay a transaction stored in file <filename> by History Store Command. The replay will perform the exact same operations on the packages as in the original transaction and will return with an error if case of any differences in installed packages or their versions. See also the Transaction JSON Format specification of the file format.
--ignore-installed Don't check for the installed packages being in the same state as those recorded in the transaction. E.g. in case there is an upgrade foo-1.0 -> foo-2.0 stored in the transaction, but there is foo-1.1 installed on the target system.
--ignore-extras Don't check for extra packages pulled into the transaction on the target system. E.g. the target system may not have some dependency, which was installed on the source system. The replay errors out on this by default, as the transaction would not be the same.
--skip-unavailable In case some packages stored in the transaction are not available on the target system, skip them instead of erroring out.
dnf history rollback <transaction-spec>|<package-file-spec> Undo all transactions performed after the specified transaction. Uses the last transaction (with the highest ID) if more than one transaction for given <package-file-spec> is found.  If it is not possible to undo some transactions due to the current state of RPMDB, it will not undo any transaction.
dnf history store [--output <output-file>] <transaction-spec> Store a transaction specified by <transaction-spec>. The transaction can later be replayed by the History Replay Command.
Warning: The stored transaction format is considered unstable and may change at any time. It will work if the same version of dnf is used to store and replay (or between versions as long as it stays the same).
-o <output-file>, --output=<output-file> Store the serialized transaction into <output-file. Default is transaction.json.
dnf history undo <transaction-spec>|<package-file-spec> Perform the opposite operation to all operations performed in the specified transaction.  Uses the last transaction (with the highest ID) if more than one transaction for given <package-file-spec> is found. If it is not possible to undo some operations due to the current state of RPMDB, it will not undo the transaction.
dnf history userinstalled Show all installonly packages, packages installed outside of DNF and packages not installed as dependency. I.e. it lists packages that will stay on the system when Autoremove Command or Remove Command along with clean_requirements_on_remove configuration option set to True is executed. Note the same results can be accomplished with dnf repoquery --userinstalled, and the repoquery command is more powerful in formatting of the output.
This command by default does not force a sync of expired metadata, except for the redo, rollback, and undo subcommands.  See also Metadata Synchronization and Configuration Files Replacement Policy.
Info Command Command: info Aliases: if
dnf [options] info [<package-file-spec>...] Lists description and summary information about installed and available packages.
The info command limits the displayed packages the same way as the list command.
Install Command Command: install Aliases: in Aliases for explicit NEVRA matching: install-n, install-na, install-nevra Deprecated aliases: localinstall
dnf [options] install <spec>... Makes sure that the given packages and their dependencies are installed on the system. Each <spec> can be either a <package-spec>, or a @<module-spec>, or a @<group-spec>.  See Install Examples.  If a given package or provide cannot be (and is not already) installed, the exit code will be non-zero.  If the <spec> matches both a @<module-spec> and a @<group-spec>, only the module is installed.
When <package-spec> to specify the exact version of the package is given, DNF will install the desired version, no matter which version of the package is already installed. The former version of the package will be removed in the case of non-installonly package.
On the other hand if <package-spec> specifies only a name, DNF also takes into account packages obsoleting it when picking which package to install.  This behaviour is specific to the install command.  Note that this can lead to seemingly unexpected results if a package has multiple versions and some older version is being obsoleted. It creates a split in the upgrade-path and both ways are considered correct, the resulting package is picked simply by lexicographical order.
There are also a few specific install commands install-n, install-na and install-nevra that allow the specification of an exact argument in the NEVRA format.
Install Examples dnf install tito Install the tito package (tito is the package name).
dnf install ~/Downloads/tito-0.6.2-1.fc22.noarch.rpm Install a local rpm file tito-0.6.2-1.fc22.noarch.rpm from the ~/Downloads/ directory.
dnf install tito-0.5.6-1.fc22 Install the package with a specific version. If the package is already installed it will automatically try to downgrade or upgrade to the specific version.
dnf --best install tito Install the latest available version of the package. If the package is already installed it will try to automatically upgrade to the latest version. If the latest version of the package cannot be installed, the installation will fail.