neulab/tldr huggingface dataset:
establishes a VSOCK connection with the host (host is always reachable with the well-know CID=2) on 1234 port.
socat - VSOCK-LISTEN:1234
listens for a VSOCK connection on 1234 port.
socat - VSOCK-CONNECT:31:4321,bind:5555
establishes a VSOCK connection with the guest that have CID=31 on 1234 port, binding the local socket to the 5555 port.
socat VSOCK-LISTEN:3333,reuseaddr,fork VSOCK-CONNECT:42,3333
starts a forwarder that accepts VSOCK connections on port 3333, and directs them to the guest with CID=42 on the same port.
socat VSOCK-LISTEN:22,reuseaddr,fork TCP:localhost:22
forwards VSOCK connections from 22 port to the local SSH server. Running this in a VM allows you to connect via SSH from the host using VSOCK, as in the example below.
socat TCP4-LISTEN:22222,reuseaddr,fork VSOCK-CONNECT:33:22
forwards TCP connections from 22222 port to the guest with CID=33 listening on VSOCK port 22.  Running this in the host, allows you to connect via SSH running "ssh -p 22222 user@localhost", if the guest runs the example above.
socat PTY,link=/var/run/ppp,rawer INTERFACE:hdlc0
circumvents the problem that pppd requires a serial device and thus might not be able to work on a synchronous line that is represented by a network device.  socat creates a PTY to make pppd happy, binds to the network interface hdlc0, and can transfer data between both devices. Use pppd on device /var/run/ppp then.
socat -T 1 -d -d TCP-L:10081,reuseaddr,fork,crlf SYSTEM:"echo -e \"\\\"HTTP/1.0 200 OK\\\nDocumentType: text/plain\\\n\\\ndate: \$\(date\)\\\nserver:\$SOCAT_SOCKADDR:\$SOCAT_SOCKPORT\\\nclient: \$SOCAT_PEERADDR:\$SOCAT_PEERPORT\\\n\\\"\"; cat; echo -e \"\\\"\\\n\\\"\""
creates a simple HTTP echo server: each HTTP client that connects gets a valid HTTP reply that contains information about the client address and port as it is seen by the server host, the host address (which might vary on multihomed servers), and the original client request.
socat -d -d UDP4-RECVFROM:9999,so-broadcast,so-timestamp,ip-pktinfo,ip-recverr,ip-recvopts,ip-recvtos,ip-recvttl!!- SYSTEM:’export; sleep 1’ |grep SOCAT
waits for an incoming UDP packet on port 9999 and prints the environment variables provided by socat. On BSD based systems you have to replace ip-pktinfo with ip-recvdstaddr,ip-recvif. Especially interesting is SOCAT_IP_DSTADDR: it contains the target address of the packet which may be a unicast, multicast, or broadcast address.
echo -e "M-SEARCH * HTTP/1.1\nHOST: 239.255.255.250:1900\nMAN: \"ssdp:discover\"\nMX: 4\nST: \"ssdp:all\"\n" |./socat - UDP-DATAGRAM:239.255.255.250:1900,crlf
sends an SSDP (Simple Service Discovery Protocol) query to the local network and collects and outputs the answers received.
Socat uses a logging mechanism that allows filtering messages by severity. The severities provided are more or less compatible to the appropriate syslog priority. With one or up to four occurrences of the -d command line option, the lowest priority of messages that are issued can be selected. Each message contains a single uppercase character specifying the messages severity (one of F, E, W, N, I, or D)
FATAL: Conditions that require unconditional and immediate program termination.
ERROR: Conditions that prevent proper program processing. Usually the program is terminated (see option -s).
WARNING: Something did not function correctly or is in a state where correct further processing cannot be guaranteed, but might be possible.
NOTICE: Interesting actions of the program, e.g. for supervising socat in some kind of server mode.
INFO:  Description of what the program does, and maybe why it happens. Allows monitoring the lifecycles of file descriptors.
DEBUG: Description of how the program works, all system or library calls and their results.
Log messages can be written to stderr, to a file, or to syslog.
On exit, socat gives status 0 if it terminated due to EOF or inactivity timeout, with a positive value on error, and with a negative value on fatal error.
/usr/bin/socat /usr/bin/filan /usr/bin/procan
Input variables carry information from the environment to socat, output variables are set by socat for use in executed scripts and programs.
In the output variables beginning with "SOCAT" this prefix is actually replaced by the upper case name of the executable or the value of option -lp.
SOCAT_DEFAULT_LISTEN_IP (input) (Values 4 or 6) Sets the IP version to be used for listen, recv, and recvfrom addresses if no pf (protocol-family) option is given. Is overridden by socat options -4 or -6.
SOCAT_PREFERRED_RESOLVE_IP (input) (Values 0, 4, or 6) Sets the IP version to be used when resolving target host names when version is not specified by address type, option pf (protocol-family), or address format. If name resolution does not return a matching entry, the first result (with differing IP version) is taken. With value 0, socat always selects the first record and its IP version.
SOCAT_FORK_WAIT (input) Specifies the time (seconds) to sleep the parent and child processes after successful fork(). Useful for debugging.
SOCAT_VERSION (output) Socat sets this variable to its version string, e.g. "1.7.0.0" for released versions or e.g. "1.6.0.1+envvar" for temporary versions; can be used in scripts invoked by socat.
SOCAT_PID (output) Socat sets this variable to its process id. In case of fork address option, SOCAT_PID gets the child processes id. Forking for exec and system does not change SOCAT_PID.
SOCAT_PPID (output) Socat sets this variable to its process id. In case of fork, SOCAT_PPID keeps the pid of the master process.
SOCAT_PEERADDR (output) With passive socket addresses (all LISTEN and RECVFROM addresses), this variable is set to a string describing the peers socket address. Port information is not included.
SOCAT_PEERPORT (output) With appropriate passive socket addresses (TCP, UDP, and SCTP - LISTEN and RECVFROM), this variable is set to a string containing the number of the peer port.
SOCAT_SOCKADDR (output) With all LISTEN addresses, this variable is set to a string describing the local socket address. Port information is not included example
SOCAT_SOCKPORT (output) With TCP-LISTEN, UDP-LISTEN, and SCTP-LISTEN addresses, this variable is set to the local port.
SOCAT_TIMESTAMP (output) With all RECVFROM addresses where address option so-timestamp is applied, socat sets this variable to the resulting timestamp.
SOCAT_IP_OPTIONS (output) With all IPv4 based RECVFROM addresses where address option ip-recvopts is applied, socat fills this variable with the IP options of the received packet.
SOCAT_IP_DSTADDR (output) With all IPv4 based RECVFROM addresses where address option ip-recvdstaddr (BSD) or ip-pktinfo (other platforms) is applied, socat sets this variable to the destination address of the received packet. This is particularly useful to identify broadcast and multicast addressed packets.
SOCAT_IP_IF (output) With all IPv4 based RECVFROM addresses where address option ip-recvif (BSD) or ip-pktinfo (other platforms) is applied, socat sets this variable to the name of the interface where the packet was received.
SOCAT_IP_LOCADDR (output) With all IPv4 based RECVFROM addresses where address option ip-pktinfo is applied, socat sets this variable to the address of the interface where the packet was received.
SOCAT_IP_TOS (output) With all IPv4 based RECVFROM addresses where address option ip-recvtos is applied, socat sets this variable to the TOS (type of service) of the received packet.
SOCAT_IP_TTL (output) With all IPv4 based RECVFROM addresses where address option ip-recvttl is applied, socat sets this variable to the TTL (time to live) of the received packet.
SOCAT_IPV6_HOPLIMIT (output) With all IPv6 based RECVFROM addresses where address option ipv6-recvhoplimit is applied, socat sets this variable to the hoplimit value of the received packet.
SOCAT_IPV6_DSTADDR (output) With all IPv6 based RECVFROM addresses where address option ipv6-recvpktinfo is applied, socat sets this variable to the destination address of the received packet.
SOCAT_IPV6_TCLASS (output) With all IPv6 based RECVFROM addresses where address option ipv6-recvtclass is applied, socat sets this variable to the transfer class of the received packet.
SOCAT_OPENSSL_X509_ISSUER (output) Issuer field from peer certificate
SOCAT_OPENSSL_X509_SUBJECT (output) Subject field from peer certificate
SOCAT_OPENSSL_X509_COMMONNAME (output) commonName entries from peer certificates subject. Multiple values are separated by " // ".
SOCAT_OPENSSL_X509_* (output) all other entries from peer certificates subject
SOCAT_OPENSSL_X509V3_DNS (output) DNS entries from peer certificates extensions - subjectAltName field. Multiple values are separated by " // ".
HOSTNAME (input) Is used to determine the hostname for logging (see -lh).
LOGNAME (input) Is used as name for the socks client user name if no socksuser is given. With options su and su-d, LOGNAME is set to the given user name.
USER (input) Is used as name for the socks client user name if no socksuser is given and LOGNAME is empty. With options su and su-d, USER is set to the given user name.
SHELL (output) With options su and su-d, SHELL is set to the login shell of the given user.
PATH (output) Can be set with option path for exec and system addresses.
HOME (output) With options su and su-d, HOME is set to the home directory of the given user.
The work of the following groups and organizations was invaluable for this project:
The FSF (GNU, http://www.fsf.org/ project with their free and portable development software and lots of other useful tools and libraries.
The Linux developers community (http://www.linux.org/) for providing a free, open source operating system.
The Open Group (http://www.unix-systems.org/) for making their standard specifications available on the Internet for free.
This man page describes version 1.7.4 of socat.
Addresses cannot be nested, so a single socat process cannot, e.g., drive ssl over socks.
Address option ftruncate without value uses default 1 instead of 0.
Verbose modes (-x and/or -v) display line termination characters inconsistently when address options cr or crnl are used: They show the data after conversion in either direction.
The data transfer blocksize setting (-b) is ignored with address readline.
Send bug reports to <socat@dest-unreach.org>
nc(1), rinetd(8), openssl(1), stunnel(8), rlwrap(1), setsid(1)
Socat home page http://www.dest-unreach.org/socat/
Gerhard Rieger <rieger@dest-unreach.org> and contributors
MONGOD(1)                        mongodb-manual                        MONGOD(1)
mongod - MongoDB Server
mongod is the primary daemon process for the MongoDB system. It handles data requests, manages data format, and performs background management operations.
This document provides a complete overview of all command line options for mongod. These options are primarily useful for testing purposes. In common operation, use the configuration file options to control the behavior of your database, which is fully capable of all operations described below.
--help, -h Returns a basic help and usage text.
--version Returns the version of the mongod daemon.
--config <filename>, -f <filename> Specifies a configuration file, that you can use to specify runtime-configurations. While the options are equivalent and accessible via the other command line arguments, the configuration file is the preferred method for runtime configuration of mongod. See the "/reference/configuration-options" document for more information about these options.
--verbose, -v Increases the amount of internal reporting returned on standard output or in the log file specified by --logpath. Use the -v form to control the level of verbosity by including the option multiple times, (e.g. -vvvvv.)
--quiet Runs the mongod instance in a quiet mode that attempts to limit the amount of output. This option suppresses:
• output from database commands, including drop, dropIndexes, diagLogging, validate, and clean.
• replication activity.
• connection accepted events.
• connection closed events.
--port <port> Specifies a TCP port for the mongod to listen for client connections. By default mongod listens for connections on port 27017.
UNIX-like systems require root privileges to use ports with numbers lower than 1024.
--bind_ip <ip address> The IP address that the mongod process will bind to and listen for connections. By default mongod listens for connections on the localhost (i.e. 127.0.0.1 address.) You may attach mongod to any interface; however, if you attach mongod to a publicly accessible interface ensure that you have implemented proper authentication and/or firewall restrictions to protect the integrity of your database.
--maxConns <number> Specifies the maximum number of simultaneous connections that mongod will accept. This setting will have no effect if it is higher than your operating system's configured maximum connection tracking threshold.
Note   You cannot set maxConns to a value higher than 20000.
--objcheck Forces the mongod to validate all requests from clients upon receipt to ensure that clients never insert invalid documents into the database. For objects with a high degree of sub-document nesting, --objcheck can have a small impact on performance. You can set --noobjcheck to disable object checking at run-time.
Changed in version 2.4: MongoDB enables --objcheck by default, to prevent any client from inserting malformed or invalid BSON into a MongoDB database.
--noobjcheck New in version 2.4.
Disables the default document validation that MongoDB performs on all incoming BSON documents.
--logpath <path> Specify a path for the log file that will hold all diagnostic logging information.
Unless specified, mongod will output all log information to the standard output. Additionally, unless you also specify --logappend, the logfile will be overwritten when the process restarts.
Note   The behavior of the logging system may change in the near future in response to the SERVER-4499 case.
--logappend When specified, this option ensures that mongod appends new entries to the end of the logfile rather than overwriting the content of the log when the process restarts.
--syslog New in version 2.1.0.
Sends all logging output to the host's syslog system rather than to standard output or a log file as with --logpath.
Warning You cannot use --syslog with --logpath.
--pidfilepath <path> Specify a file location to hold the "PID" or process ID of the mongod process. Useful for tracking the mongod process in combination with the mongod --fork option.
Without a specified --pidfilepath option, mongos creates no PID file.
--keyFile <file> Specify the path to a key file to store authentication information. This option is only useful for the connection between replica set members.
"Replica Set Security" and "/administration/replica-sets."
--nounixsocket Disables listening on the UNIX socket. Unless set to false, mongod and mongos provide a UNIX-socket.
--unixSocketPrefix <path> Specifies a path for the UNIX socket. Unless this option has a value, mongod and mongos, create a socket with the /tmp as a prefix.
--fork Enables a daemon mode for mongod that runs the process to the background. This is the normal mode of operation, in production and production-like environments, but may not be desirable for testing.
--auth Enables database authentication for users connecting from remote hosts. configure users via the mongo shell shell. If no users exist, the localhost interface will continue to have access to the database until the you create the first user.
See the Security and Authentication page for more information regarding this functionality.
--cpu  Forces mongod to report the percentage of CPU time in write lock. mongod generates output every four seconds. MongoDB writes this data to standard output or the logfile if using the logpath option.
--dbpath <path> Specify a directory for the mongod instance to store its data. Typical locations include: /srv/mongodb, /var/lib/mongodb or /opt/mongodb
Unless specified, mongod will look for data files in the default /data/db directory. (Windows systems use the \data\db directory.) If you installed using a package management system. Check the /etc/mongodb.conf file provided by your packages to see the configuration of the dbpath.
--diaglog <value> Creates a very verbose, diagnostic log for troubleshooting and recording various errors. MongoDB writes these log files in the dbpath directory in a series of files that begin with the string diaglog and end with the initiation time of the logging as a hex string.
The specified value configures the level of verbosity. Possible values, and their impact are as follows.
┌──────┬─────────────────────────┐ │Value │ Setting                 │ ├──────┼─────────────────────────┤ │0     │ off. No logging.        │ ├──────┼─────────────────────────┤ │1     │ Log write operations.   │ ├──────┼─────────────────────────┤ │2     │ Log read operations.    │ ├──────┼─────────────────────────┤ │3     │ Log both read and write │ │      │ operations.             │ └──────┴─────────────────────────┘
│7     │ Log write and some read │ │      │ operations.             │ └──────┴─────────────────────────┘
You can use the mongosniff tool to replay this output for investigation. Given a typical diaglog file, located at /data/db/diaglog.4f76a58c, you might use a command in the following form to read these files:
mongosniff --source DIAGLOG /data/db/diaglog.4f76a58c
--diaglog is for internal use and not intended for most users.
Warning Setting the diagnostic level to 0 will cause mongod to stop writing data to the diagnostic log file. However, the mongod instance will continue to keep the file open, even if it is no longer writing data to the file.  If you want to rename, move, or delete the diagnostic log you must cleanly shut down the mongod instance before doing so.
--directoryperdb Alters the storage pattern of the data directory to store each database's files in a distinct folder. This option will create directories within the --dbpath named for each directory.
Use this option in conjunction with your file system and device configuration so that MongoDB will store data on a number of distinct disk devices to increase write throughput or disk capacity.
--journal Enables operation journaling to ensure write durability and data consistency. mongod enables journaling by default on 64-bit builds of versions after 2.0.
--journalOptions <arguments> Provides functionality for testing. Not for general use, and may affect database integrity.
--journalCommitInterval <value> Specifies the maximum amount of time for mongod to allow between journal operations. The default value is 100 milliseconds, while possible values range from 2 to 300 milliseconds. Lower values increase the durability of the journal, at the expense of disk performance.
To force mongod to commit to the journal more frequently, you can specify j:true. When a write operation with j:true pending, mongod will reduce journalCommitInterval to a third of the set value.
--ipv6 Specify this option to enable IPv6 support. This will allow clients to connect to mongod using IPv6 networks. mongod disables IPv6 support by default in mongod and all utilities.
--jsonp Permits JSONP access via an HTTP interface. Consider the security implications of allowing this activity before enabling this option.
--noauth Disable authentication. Currently the default. Exists for future compatibility and clarity.
--nohttpinterface Disables the HTTP interface.
--nojournal Disables the durability journaling. By default, mongod enables journaling in 64-bit versions after v2.0.
--noprealloc Disables the preallocation of data files. This will shorten the start up time in some cases, but can cause significant performance penalties during normal operations.
--noscripting Disables the scripting engine.
--notablescan Forbids operations that require a table scan.
--nssize <value> Specifies the default size for namespace files (i.e .ns). This option has no impact on the size of existing namespace files. The maximum size is 2047 megabytes.
The default value is 16 megabytes; this provides for approximately 24,000 namespaces. Each collection, as well as each index, counts as a namespace.
--profile <level> Changes the level of database profiling, which inserts information about operation performance into output of mongod or the log file. The following levels are available:
┌──────┬────────────────────────┐ │Level │ Setting                │ ├──────┼────────────────────────┤ │0     │ Off. No profiling.     │ ├──────┼────────────────────────┤ │1     │ On. Only includes slow │ │      │ operations.            │ ├──────┼────────────────────────┤ │2     │ On. Includes all       │ │      │ operations.            │ └──────┴────────────────────────┘
Profiling is off by default. Database profiling can impact database performance. Enable this option only after careful consideration.
--quota Enables a maximum limit for the number data files each database can have. When running with --quota, there are a maximum of 8 data files per database. Adjust the quota with the --quotaFiles option.
--quotaFiles <number> Modify limit on the number of data files per database. This option requires the --quota setting. The default value for --quotaFiles is 8.
--rest Enables the simple REST API.
--repair Runs a repair routine on all databases. This is equivalent to shutting down and running the repairDatabase database command on all databases.
Warning In general, if you have an intact copy of your data, such as would exist on a very recent backup or an intact member of a replica set, do not use repairDatabase or related options like db.repairDatabase() in the mongo shell or mongod --repair. Restore from an intact copy of your data.
Note   When using journaling, there is almost never any need to run repairDatabase. In the event of an unclean shutdown, the server will be able restore the data files to a pristine state automatically.
Changed in version 2.1.2.
If you run the repair option and have data in a journal file, mongod will refuse to start. In these cases you should start mongod without the --repair option to allow mongod to recover data from the journal. This will complete more quickly and will result in a more consistent and complete data set.
To continue the repair operation despite the journal files, shut down mongod cleanly and restart with the --repair option.
Note   --repair copies data from the source data files into new data files in the repairpath, and then replaces the original data files with the repaired data files. If repairpath is on the same device as dbpath, you may interrupt a mongod running --repair without affecting the integrity of the data set.
--repairpath <path> Specifies the root directory containing MongoDB data files, to use for the --repair operation. Defaults to a _tmp directory within the dbpath.
--setParameter <options> New in version 2.4.
Specifies an option to configure on startup.  Specify multiple options with multiple --setParameter options.  See /reference/parameters for full documentation of these parameters. The setParameter database command provides access to many of these parameters. --setParameter supports the following options:
• enableLocalhostAuthBypass
• enableTestCommands
• journalCommitInterval
• logLevel
• logUserIds
• notablescan
• quiet
• replApplyBatchSize
• replIndexPrefetch
• supportCompatibilityFormPrivilegeDocuments
• syncdelay
• traceExceptions
--slowms <value> Defines the value of "slow," for the --profile option. The database logs all slow queries to the log, even when the profiler is not turned on. When the database profiler is on, mongod the profiler writes to the system.profile collection. See the profile command for more information on the database profiler.
--smallfiles Enables a mode where MongoDB uses a smaller default file size. Specifically, --smallfiles reduces the initial size for data files and limits them to 512 megabytes. --smallfiles also reduces the size of each journal files from 1 gigabyte to 128 megabytes.
Use --smallfiles if you have a large number of databases that each holds a small quantity of data. --smallfiles can lead your mongod to create a large number of files, which may affect performance for larger databases.
--shutdown Used in control scripts, the --shutdown will cleanly and safely terminate the mongod process. When invoking mongod with this option you must set the --dbpath option either directly or by way of the configuration file and the --config option.
--shutdown is only available on Linux systems.
--syncdelay <value> mongod writes data very quickly to the journal, and lazily to the data files. --syncdelay controls how much time can pass before MongoDB flushes data to the database files via an fsync operation. The default setting is 60 seconds.  In almost every situation you should not set this value and use the default setting.
The serverStatus command reports the background flush thread's status via the backgroundFlushing field.
syncdelay has no effect on the journal files or journaling.
Warning If you set --syncdelay to 0, MongoDB will not sync the memory mapped files to disk. Do not set this value on production systems.
--sysinfo Returns diagnostic system information and then exits. The information provides the page size, the number of physical pages, and the number of available physical pages.
--upgrade Upgrades the on-disk data format of the files specified by the --dbpath to the latest version, if needed.
This option only affects the operation of mongod if the data files are in an old format.
Note   In most cases you should not set this value, so you can exercise the most control over your upgrade process. See the MongoDB release notes (on the download page) for more information about the upgrade process.
--traceExceptions For internal diagnostic use only.
Replication Options --replSet <setname> Use this option to configure replication with replica sets. Specify a setname as an argument to this set. All hosts must have the same set name.
"/replication," "/administration/replica-sets," and "/reference/replica-configuration"
--oplogSize <value> Specifies a maximum size in megabytes for the replication operation log (e.g. oplog.) By mongod creates an oplog based on the maximum amount of space available. For 64-bit systems, the op log is typically 5% of available disk space.
Once the mongod has created the oplog for the first time, changing --oplogSize will not affect the size of the oplog.
--fastsync In the context of replica set replication, set this option if you have seeded this member with a snapshot of the dbpath of another member of the set. Otherwise the mongod will attempt to perform an initial sync, as though the member were a new member.
Warning If the data is not perfectly synchronized and mongod starts with fastsync, then the secondary or slave will be permanently out of sync with the primary, which may cause significant consistency problems.
--replIndexPrefetch New in version 2.2.
You must use --replIndexPrefetch in conjunction with replSet. The default value is all and available options are:
• none
• all
• _id_only
By default secondary members of a replica set will load all indexes related to an operation into memory before applying operations from the oplog. You can modify this behavior so that the secondaries will only load the _id index. Specify _id_only or none to prevent the mongod from loading any index into memory.
Master-Slave Replication These options provide access to conventional master-slave database replication. While this functionality remains accessible in MongoDB, replica sets are the preferred configuration for database replication.
--master Configures mongod to run as a replication master.
--slave Configures mongod to run as a replication slave.
--source <host><:port> For use with the --slave option, the --source option designates the server that this instance will replicate.
--only <arg> For use with the --slave option, the --only option specifies only a single database to replicate.
--slavedelay <value> For use with the --slave option, the --slavedelay option configures a "delay" in seconds, for this slave to wait to apply operations from the master node.
--autoresync For use with the --slave option, the --autoresync option allows this slave to automatically resync if the local data is more than 10 seconds behind the master. This option may be problematic if the oplog is too small (controlled by the --oplogSize option.) If the oplog not large enough to store the difference in changes between the master's current state and the state of the slave, this node will forcibly resync itself unnecessarily. When you set the If the --autoresync option the slave will not attempt an automatic resync more than once in a ten minute period.
Sharding Cluster Options --configsvr Declares that this mongod instance serves as the config database of a sharded cluster. When running with this option, clients will not be able to write data to any database other than config and admin. The default port for mongod with this option is 27019 and mongod writes all data files to the /configdb sub-directory of the --dbpath directory.
--shardsvr Configures this mongod instance as a shard in a partitioned cluster. The default port for these instances is 27018.  The only effect of --shardsvr is to change the port number.
--noMoveParanoia Disables a "paranoid mode" for data writes for chunk migration operation. See the chunk migration and moveChunk command documentation for more information.
By default mongod will save copies of migrated chunks on the "from" server during migrations as "paranoid mode." Setting this option disables this paranoia.
SSL Options See
/administration/ssl for full documentation of MongoDB's support.
--sslOnNormalPorts New in version 2.2.
Note   The default distribution of MongoDB does not contain support for SSL. To use SSL you can either compile MongoDB with SSL support or use the MongoDB Subscriber Edition. See /administration/ssl for more information about SSL and MongoDB.
Enables SSL for mongod. With --sslOnNormalPorts, a mongod requires SSL encryption for all connections on the default MongoDB port, or the port specified by --port. By default, --sslOnNormalPorts is disabled.
--sslPEMKeyFile <filename> New in version 2.2.
Specifies the .pem file that contains both the SSL certificate and key. Specify the file name of the .pem file using relative or absolute paths
When using --sslOnNormalPorts, you must specify --sslPEMKeyFile.
--sslPEMKeyPassword <value> New in version 2.2.
Specifies the password to de-crypt the certificate-key file (i.e. --sslPEMKeyFile). Only use --sslPEMKeyPassword if the certificate-key file is encrypted. In all cases, mongod will redact the password from all logging and reporting output.
Changed in version 2.4: --sslPEMKeyPassword is only needed when the private key is encrypted. In earlier versions mongod would require --sslPEMKeyPassword whenever using --sslOnNormalPorts, even when the private key was not encrypted.
--sslCAFile <filename> New in version 2.4.
Specifies the .pem file that contains the root certificate chain from the Certificate Authority. Specify the file name of the .pem file using relative or absolute paths
--sslCRLFile <filename> New in version 2.4.
Specifies the .pem file that contains the Certificate Revocation List. Specify the file name of the .pem file using relative or absolute paths
--sslWeakCertificateValidation New in version 2.4.
Disables the requirement for SSL certificate validation, that --sslCAFile enables. With --sslWeakCertificateValidation, mongod will accept connections if the client does not present a certificate when establishing the connection.
If the client presents a certificate and mongod has --sslWeakCertificateValidation enabled, mongod will validate the certificate using the root certificate chain specified by --sslCAFile, and reject clients with invalid certificates.
Use --sslWeakCertificateValidation if you have a mixed deployment that includes clients that do not or cannot present certificates to mongod.
--sslFIPSMode New in version 2.4.
When specified, mongod will use the FIPS mode of the installed OpenSSL library. Your system must have a FIPS compliant OpenSSL library to use --sslFIPSMode.
In common usage, the invocation of mongod will resemble the following in the context of an initialization or control script:
mongod --config /etc/mongodb.conf
See the "/reference/configuration-options" for more information on how to configure mongod using the configuration file.
MongoDB Documentation Project
2011-2013, 10gen, Inc.
EX(1P)                      POSIX Programmer's Manual                     EX(1P)
ex — text editor
ex [-rR] [-s|-v] [-c command] [-t tagstring] [-w size] [file...]
The ex utility is a line-oriented text editor. There are two other modes of the editor—open and visual—in which screen-oriented editing is available. This is described more fully by the ex open and visual commands and in vi.
If an operand is '-', the results are unspecified.
This section uses the term edit buffer to describe the current working text. No specific implementation is implied by this term. All editing changes are performed on the edit buffer, and no changes to it shall affect any file until an editor command writes the file.
Certain terminals do not have all the capabilities necessary to support the complete ex definition, such as the full-screen editing commands (visual mode or open mode).  When these commands cannot be supported on such terminals, this condition shall not produce an error message such as ``not an editor command'' or report a syntax error. The implementation may either accept the commands and produce results on the screen that are the result of an unsuccessful attempt to meet the requirements of this volume of POSIX.1‐2017 or report an error describing the terminal-related deficiency.
The ex utility shall conform to the Base Definitions volume of POSIX.1‐2017, Section 12.2, Utility Syntax Guidelines, except for the unspecified usage of '-', and that '+' may be recognized as an option delimiter as well as '-'.
The following options shall be supported:
-c command Specify an initial command to be executed in the first edit buffer loaded from an existing file (see the EXTENDED DESCRIPTION section).  Implementations may support more than a single -c option. In such implementations, the specified commands shall be executed in the order specified on the command line.
-r        Recover the named files (see the EXTENDED DESCRIPTION section). Recovery information for a file shall be saved during an editor or system crash (for example, when the editor is terminated by a signal which the editor can catch), or after the use of an ex preserve command.
A crash in this context is an unexpected failure of the system or utility that requires restarting the failed system or utility. A system crash implies that any utilities running at the time also crash. In the case of an editor or system crash, the number of changes to the edit buffer (since the most recent preserve command) that will be recovered is unspecified.
If no file operands are given and the -t option is not specified, all other options, the EXINIT variable, and any .exrc files shall be ignored; a list of all recoverable files available to the invoking user shall be written, and the editor shall exit normally without further action.
-R        Set readonly edit option.
-s        Prepare ex for batch use by taking the following actions:
*  Suppress writing prompts and informational (but not diagnostic) messages.
*  Ignore the value of TERM and any implementation default terminal type and assume the terminal is a type incapable of supporting open or visual modes; see the visual command and the description of vi.
*  Suppress the use of the EXINIT environment variable and the reading of any .exrc file; see the EXTENDED DESCRIPTION section.
*  Suppress autoindentation, ignoring the value of the autoindent edit option.
-t tagstring Edit the file containing the specified tagstring; see ctags. The tags feature represented by -t tagstring and the tag command is optional. It shall be provided on any system that also provides a conforming implementation of ctags; otherwise, the use of -t produces undefined results. On any system, it shall be an error to specify more than a single -t option.
-v        Begin in visual mode (see vi).
-w size   Set the value of the window editor option to size.
The following operand shall be supported:
file      A pathname of a file to be edited.
The standard input consists of a series of commands and input text, as described in the EXTENDED DESCRIPTION section. The implementation may limit each line of standard input to a length of {LINE_MAX}.
If the standard input is not a terminal device, it shall be as if the -s option had been specified.
If a read from the standard input returns an error, or if the editor detects an end-of-file condition from the standard input, it shall be equivalent to a SIGHUP asynchronous event.
Input files shall be text files or files that would be text files except for an incomplete last line that is not longer than {LINE_MAX}-1 bytes in length and contains no NUL characters. By default, any incomplete last line shall be treated as if it had a trailing <newline>.  The editing of other forms of files may optionally be allowed by ex implementations.
The .exrc files and source files shall be text files consisting of ex commands; see the EXTENDED DESCRIPTION section.
By default, the editor shall read lines from the files to be edited without interpreting any of those lines as any form of editor command.
The following environment variables shall affect the execution of ex:
COLUMNS   Override the system-selected horizontal screen size. See the Base Definitions volume of POSIX.1‐2017, Chapter 8, Environment Variables for valid values and results when it is unset or null.
EXINIT    Determine a list of ex commands that are executed on editor start-up. See the EXTENDED DESCRIPTION section for more details of the initialization phase.
HOME      Determine a pathname of a directory that shall be searched for an editor start-up file named .exrc; see the EXTENDED DESCRIPTION section.
LC_COLLATE Determine the locale for the behavior of ranges, equivalence classes, and multi-character collating elements within regular expressions.
LC_CTYPE  Determine the locale for the interpretation of sequences of bytes of text data as characters (for example, single-byte as opposed to multi-byte characters in arguments and input files), the behavior of character classes within regular expressions, the classification of characters as uppercase or lowercase letters, the case conversion of letters, and the detection of word boundaries.
LINES     Override the system-selected vertical screen size, used as the number of lines in a screenful and the vertical screen size in visual mode.  See the Base Definitions volume of POSIX.1‐2017, Chapter 8, Environment Variables for valid values and results when it is unset or null.
PATH      Determine the search path for the shell command specified in the ex editor commands !, shell, read, and write, and the open and visual mode command !; see the description of command search and execution in Section 2.9.1.1, Command Search and Execution.
SHELL     Determine the preferred command line interpreter for use as the default value of the shell edit option.
TERM      Determine the name of the terminal type. If this variable is unset or null, an unspecified default terminal type shall be used.
The following term is used in this and following sections to specify command and asynchronous event actions:
complete write A complete write is a write of the entire contents of the edit buffer to a file of a type other than a terminal device, or the saving of the edit buffer caused by the user executing the ex preserve command. Writing the contents of the edit buffer to a temporary file that will be removed when the editor exits shall not be considered a complete write.
The following actions shall be taken upon receipt of signals:
SIGINT    If the standard input is not a terminal device, ex shall not write the file or return to command or text input mode, and shall exit with a non-zero exit status.
Otherwise, if executing an open or visual text input mode command, ex in receipt of SIGINT shall behave identically to its receipt of the <ESC> character.
Otherwise:
1. If executing an ex text input mode command, all input lines that have been completely entered shall be resolved into the edit buffer, and any partially entered line shall be discarded.
2. If there is a currently executing command, it shall be aborted and a message displayed. Unless otherwise specified by the ex or vi command descriptions, it is unspecified whether any lines modified by the executing command appear modified, or as they were before being modified by the executing command, in the buffer.
If the currently executing command was a motion command, its associated command shall be discarded.
3. If in open or visual command mode, the terminal shall be alerted.
4. The editor shall then return to command mode.
SIGCONT   The screen shall be refreshed if in open or visual mode.
SIGHUP    If the edit buffer has been modified since the last complete write, ex shall attempt to save the edit buffer so that it can be recovered later using the -r option or the ex recover command. The editor shall not write the file or return to command or text input mode, and shall terminate with a non-zero exit status.
SIGTERM   Refer to SIGHUP.
The action taken for all other signals is unspecified.
The standard output shall be used only for writing prompts to the user, for informational messages, and for writing lines from the file.
The output from ex shall be text files.
Only the ex mode of the editor is described in this section. See vi for additional editing capabilities available in ex.
When an error occurs, ex shall write a message. If the terminal supports a standout mode (such as inverse video), the message shall be written in standout mode. If the terminal does not support a standout mode, and the edit option errorbells is set, an alert action shall precede the error message.
By default, ex shall start in command mode, which shall be indicated by a : prompt; see the prompt command. Text input mode can be entered by the append, insert, or change commands; it can be exited (and command mode re-entered) by typing a <period> ('.')  alone at the beginning of a line.
Initialization in ex and vi The following symbols are used in this and following sections to specify locations in the edit buffer:
alternate and current pathnames Two pathnames, named current and alternate, are maintained by the editor. Any ex commands that take filenames as arguments shall set them as follows:
1. If a file argument is specified to the ex edit, ex, or recover commands, or if an ex tag command replaces the contents of the edit buffer.
a. If the command replaces the contents of the edit buffer, the current pathname shall be set to the file argument or the file indicated by the tag, and the alternate pathname shall be set to the previous value of the current pathname.
b. Otherwise, the alternate pathname shall be set to the file argument.
2. If a file argument is specified to the ex next command:
a. If the command replaces the contents of the edit buffer, the current pathname shall be set to the first file argument, and the alternate pathname shall be set to the previous value of the current pathname.
3. If a file argument is specified to the ex file command, the current pathname shall be set to the file argument, and the alternate pathname shall be set to the previous value of the current pathname.
4. If a file argument is specified to the ex read and write commands (that is, when reading or writing a file, and not to the program named by the shell edit option), or a file argument is specified to the ex xit command:
a. If the current pathname has no value, the current pathname shall be set to the file argument.
If the alternate pathname is set to the previous value of the current pathname when the current pathname had no previous value, then the alternate pathname shall have no value as a result.
current line The line of the edit buffer referenced by the cursor. Each command description specifies the current line after the command has been executed, as the current line value.  When the edit buffer contains no lines, the current line shall be zero; see Addressing in ex.
current column The current display line column occupied by the cursor. (The columns shall be numbered beginning at 1.) Each command description specifies the current column after the command has been executed, as the current column value. This column is an ideal column that is remembered over the lifetime of the editor. The actual display line column upon which the cursor rests may be different from the current column; see the cursor positioning discussion in Command Descriptions in vi.
set to non-<blank> A description for a current column value, meaning that the current column shall be set to the last display line column on which is displayed any part of the first non-<blank> of the line. If the line has no non-<blank> non-<newline> characters, the current column shall be set to the last display line column on which is displayed any part of the last non-<newline> character in the line. If the line is empty, the current column shall be set to column position 1.
The length of lines in the edit buffer may be limited to {LINE_MAX} bytes. In open and visual mode, the length of lines in the edit buffer may be limited to the number of characters that will fit in the display. If either limit is exceeded during editing, an error message shall be written. If either limit is exceeded by a line read in from a file, an error message shall be written and the edit session may be terminated.
If the editor stops running due to any reason other than a user command, and the edit buffer has been modified since the last complete write, it shall be equivalent to a SIGHUP asynchronous event. If the system crashes, it shall be equivalent to a SIGHUP asynchronous event.
During initialization (before the first file is copied into the edit buffer or any user commands from the terminal are processed) the following shall occur:
1. If the environment variable EXINIT is set, the editor shall execute the ex commands contained in that variable.
2. If the EXINIT variable is not set, and all of the following are true:
a. The HOME environment variable is not null and not empty.
b. The file .exrc in the directory referred to by the HOME environment variable:
i.  Exists
ii.  Is owned by the same user ID as the real user ID of the process or the process has appropriate privileges
iii. Is not writable by anyone other than the owner
the editor shall execute the ex commands contained in that file.
3. If and only if all of the following are true:
a. The current directory is not referred to by the HOME environment variable.
b. A command in the EXINIT environment variable or a command in the .exrc file in the directory referred to by the HOME environment variable sets the editor option exrc.
c. The .exrc file in the current directory:
ii.  Is owned by the same user ID as the real user ID of the process, or by one of a set of implementation-defined user IDs
the editor shall attempt to execute the ex commands contained in that file.
Lines in any .exrc file that are blank lines shall be ignored. If any .exrc file exists, but is not read for ownership or permission reasons, it shall be an error.
After the EXINIT variable and any .exrc files are processed, the first file specified by the user shall be edited, as follows:
1. If the user specified the -t option, the effect shall be as if the ex tag command was entered with the specified argument, with the exception that if tag processing does not result in a file to edit, the effect shall be as described in step 3. below.
2. Otherwise, if the user specified any command line file arguments, the effect shall be as if the ex edit command was entered with the first of those arguments as its file argument.
3. Otherwise, the effect shall be as if the ex edit command was entered with a nonexistent filename as its file argument. It is unspecified whether this action shall set the current pathname. In an implementation where this action does not set the current pathname, any editor command using the current pathname shall fail until an editor command sets the current pathname.