About These Docs
What this documentation covers, how it relates to the repository docs, and the conventions it follows · Checked against tacctl 0.2.22
This documentation is the operations layer of tacctl: how to do things during a shift. It is written for network engineers, operators and support staff.
1. What is here, and what is not
| Here (this documentation) | In the repository docs |
|---|---|
| Task guides by role: operators, engineers, superusers | Installation, upgrades and rolling back |
| Procedures: connecting, access lifecycle, device changes, hosts, undo | Backends, the store, generated files, RADIUS and metrics |
| Emergencies: troubleshooting, runbooks, lockdown, break-glass | Every command and flag, every tacctl.yaml setting |
| Concepts, a glossary, exit codes, operator release notes | Design plans and development notes |
The repository documentation
and man tacctl are updated in the same change as the code, so they are the
reference. When this documentation and the reference disagree, the
reference wins: please report the difference.
2. Which release a page describes
Every page says, under its title, which tacctl release it was checked
against (for example Checked against tacctl 0.2.21). The footer shows
the release for the documentation as a whole. Run tacctl version on your
server to see which release you have.
What’s New for Operators lists what changed
between releases.
3. Conventions
| Convention | Meaning |
|---|---|
tacctl … commands |
The full form, for a normal shell. In the login console or tacctl shell, leave out tacctl. |
| Console-first pages | Day-to-Day Device Operations shows commands without the prefix, as typed at the console |
| Tier or Who column | The lowest tier that can run a command: R read-only, O operator, E engineer (own scopes), S superuser |
--dry-run, --check first |
Every risky command is shown with its preview first |
--reason "<ticket>" |
Lockdowns and holds always carry a ticket number |
| Numbered sections | Cite a section as Page §4.2 |
| Yellow callouts | Warnings and gotchas |
3.1 Example names
All examples use made-up names from the examples table of the tacctl repository, so no example points to a real network. Names the table does not list are invented in the same style.
| Kind | Names |
|---|---|
| Server | tacacs.example.net (its console prompt is tacacs>) |
| Scopes | lab, site-a, site-b |
| Cisco devices | sw1, sw2, sw3, sw7 (legacy IOS 12.4) |
| Junos devices | rtr1, rtr2, jsw1 (blank switch, onboarded) |
| WTI | pdu1 |
| Linux hosts | web1, db1, db2 |
| Users | alice, bob, carol, dave; each name keeps one role on a page |
| Addresses | 10.10.0.0/16 (site-a), 10.10.0.1 (sw1), 10.10.0.2 (rtr1), 10.10.0.50 (pdu1) |
| Tickets | INC-4821, CHG-1182 |
4. Reporting a mistake
If a page is wrong or out of date, use Report a problem with this page at the foot of the page: it opens a GitHub issue with the page already named. Or open an issue on the tacctl repository naming the page, the section and the tacctl release you run.
5. Printable PDFs
Every page links its PDF under the title. All of them:
See also: Home · Command Reference Map · Glossary