ovn-nbctl(8)                  Open vSwitch Manual                 ovn-nbctl(8)



NAME
       ovn-nbctl - Open Virtual Network northbound db management utility

SYNOPSIS
       ovn-nbctl [options] command [arg...]

DESCRIPTION
       This utility can be used to manage the OVN northbound database.

GENERAL COMMANDS
       init   Initializes  the  database,  if it is empty. If the database has
              already been initialized, this command has no effect.

       show [switch | router]
              Prints a brief overview of the database contents. If  switch  is
              provided, only records related to that logical switch are shown.
              If router is provided, only  records  related  to  that  logical
              router are shown.

LOGICAL SWITCH COMMANDS
       ls-add Creates  a  new,  unnamed logical switch, which initially has no
              ports. The switch does not have a name, other commands must  re‐
              fer to this switch by its UUID.

       [--may-exist | --add-duplicate] ls-add switch
              Creates  a  new logical switch named switch, which initially has
              no ports.

              The OVN northbound database  schema  does  not  require  logical
              switch  names  to be unique, but the whole point to the names is
              to provide an easy way for humans to refer to the switches, mak‐
              ing  duplicate  names unhelpful. Thus, without any options, this
              command regards it as an error if switch is  a  duplicate  name.
              With  --may-exist, adding a duplicate name succeeds but does not
              create a new logical switch. With --add-duplicate,  the  command
              really creates a new logical switch with a duplicate name. It is
              an error to specify both options. If there are multiple  logical
              switches  with  a duplicate name, configure the logical switches
              using the UUID instead of the switch name.

       [--if-exists] ls-del switch
              Deletes switch. It is an error if switch does not exist,  unless
              --if-exists is specified.

       ls-list
              Lists all existing switches on standard output, one per line.

ACL COMMANDS
       These  commands  operates on ACL objects for a given entity. The entity
       can be either a logical switch or a port group. The entity can be spec‐
       ified  as  uuid  or  name. The --type option can be used to specify the
       type of the entity, in case both a logical switch and a port groups ex‐
       ist with the same name specified for entity. type must be either switch
       or port-group.

              [--type={switch | port-group}] [--log] [--meter=meter] [--sever
              ity=severity]  [--name=name] [--may-exist] acl-add entity direc
              tion priority match verdict
                     Adds the specified ACL to entity. direction must  be  ei‐
                     ther  from-lport  or to-lport. priority must be between 0
                     and 32767, inclusive. A full description  of  the  fields
                     are  in  ovn-nb(5). If --may-exist is specified, adding a
                     duplicated ACL succeeds but the ACL is  not  really  cre‐
                     ated.  Without  --may-exist,  adding a duplicated ACL re‐
                     sults in error.

                     The --log option enables packet logging for the ACL.  The
                     options  --severity  and  --name  specify  a severity and
                     name, respectively, for log entries (and also enable log‐
                     ging).  The  severity  must be one of alert, warning, no
                     tice, info, or debug. If a severity is not specified, the
                     default  is  info.  The  --meter=meter  option is used to
                     rate-limit packet logging. The meter argument names a me‐
                     ter configured by meter-add.

              [--type={switch | port-group}] acl-del entity [direction [prior
              ity match]]
                     Deletes ACLs from entity. If only entity is supplied, all
                     the  ACLs  from  the  entity are deleted. If direction is
                     also specified, then all the flows in that direction will
                     be  deleted from the entity. If all the fields are given,
                     then a single flow that matches all the  fields  will  be
                     deleted.

              [--type={switch | port-group}] acl-list entity
                     Lists the ACLs on entity.

LOGICAL SWITCH QOS RULE COMMANDS
       [--may-exist]  qos-add  switch  direction  priority  match  [dscp=dscp]
       [rate=rate [burst=burst]]
              Adds QoS marking and metering rules to switch. direction must be
              either  from-lport  or  to-lport. priority must be between 0 and
              32767, inclusive.

              If dscp=dscp is specified, then matching packets will have  DSCP
              marking  applied.  dscp  must be between 0 and 63, inclusive. If
              rate=rate is specified then matching packets will have  metering
              applied   at   rate   kbps.  If  metering  is  configured,  then
              burst=burst specifies the burst rate  limit  in  kilobits.  dscp
              and/or rate are required arguments.

              If  --may-exist  is specified, adding a duplicated QoS rule suc‐
              ceeds but the QoS rule is not really created. Without  --may-ex
              ist, adding a duplicated QoS rule results in error.

       qos-del switch [direction [priority match]]
              Deletes  QoS  rules from switch. If only switch is supplied, all
              the QoS rules from the logical switch are deleted. If  direction
              is  also specified, then all the flows in that direction will be
              deleted from the logical switch. If all the fields are supplied,
              then  a  single  flow  that  matches  the  given  fields will be
              deleted.

       qos-list switch
              Lists the QoS rules on switch.

METER COMMANDS
       meter-add name action rate unit [burst]
              Adds the specified meter. name must be a unique name to identify
              this  meter.  The  action  argument specifies what should happen
              when this meter is exceeded. The only supported action is drop.

              The unit specifies the unit for the rate argument; valid  values
              are  kbps and pktps for kilobits per second and packets per sec‐
              ond, respectively. The burst option configures the maximum burst
              allowed for the band in kilobits or packets depending on whether
              the unit chosen was kbps or pktps, respectively. If a  burst  is
              not supplied, the switch is free to select some reasonable value
              depending on its configuration.

              ovn-nbctl only supports adding a meter with a single  band,  but
              the other commands support meters with multiple bands.

              Names  that  start  with "__" (two underscores) are reserved for
              internal use by OVN, so ovn-nbctl does not allow adding them.

       meter-del [name]
              Deletes meters. By default, all meters are deleted. If  name  is
              supplied, only the meter with that name will be deleted.

       meter-list
              Lists all meters.

LOGICAL SWITCH PORT COMMANDS
       [--may-exist] lsp-add switch port
              Creates on lswitch a new logical switch port named port.

              It  is an error if a logical port named port already exists, un‐
              less --may-exist is specified. Regardless of --may-exist, it  is
              an  error  if  the existing port is in some logical switch other
              than switch or if it has a parent port.

       [--may-exist] lsp-add switch port parent tag_request
              Creates on switch a logical switch port named  port  that  is  a
              child  of  parent  that  is identified with VLAN ID tag_request,
              which must be between 0 and 4095, inclusive. If  tag_request  is
              0,  ovn-northd  generates  a  tag that is unique in the scope of
              parent. This is useful in cases such  as  virtualized  container
              environments  where  Open vSwitch does not have a direct connec‐
              tion to the container’s port and it must be shared with the vir‐
              tual machine’s port.

              It  is an error if a logical port named port already exists, un‐
              less --may-exist is specified. Regardless of --may-exist, it  is
              an error if the existing port is not in switch or if it does not
              have the specified parent and tag_request.

       [--if-exists] lsp-del port
              Deletes port. It is an error if  port  does  not  exist,  unless
              --if-exists is specified.

       lsp-list switch
              Lists  all  the  logical  switch ports within switch on standard
              output, one per line.

       lsp-get-parent port
              If set, get the parent port of port. If not set, print nothing.

       lsp-get-tag port
              If set, get the tag for port traffic. If not set, print nothing.

       lsp-set-addresses port [address]...
              Sets the addresses associated with port to address. Each address
              should be one of the following:

              an  Ethernet  address, optionally followed by a space and one or
              more IP addresses
                     OVN delivers packets for the  Ethernet  address  to  this
                     port.

              unknown
                     OVN  delivers  unicast Ethernet packets whose destination
                     MAC address is not in any logical port’s addresses column
                     to ports with address unknown.

              dynamic
                     Use  this  keyword to make ovn-northd generate a globally
                     unique MAC address and choose an unused IPv4 address with
                     the  logical  port’s  subnet and store them in the port’s
                     dynamic_addresses column.

              router Accepted only when the type of the logical switch port is
                     router.  This indicates that the Ethernet, IPv4, and IPv6
                     addresses for this logical switch port should be obtained
                     from  the  connected logical router port, as specified by
                     router-port in lsp-set-options.

              Multiple addresses may be set. If no address argument is  given,
              port will have no addresses associated with it.

       lsp-get-addresses port
              Lists all the addresses associated with port on standard output,
              one per line.

       lsp-set-port-security port [addrs]...
              Sets the port security addresses associated with port to  addrs.
              Multiple  sets  of  addresses may be set by using multiple addrs
              arguments. If no addrs argument is given,  port  will  not  have
              port security enabled.

              Port security limits the addresses from which a logical port may
              send packets and to  which  it  may  receive  packets.  See  the
              ovn-nb(5) documentation for the port_security column in the Log
              ical_Switch_Port table for details.

       lsp-get-port-security port
              Lists all the port security addresses associated  with  port  on
              standard output, one per line.

       lsp-get-up port
              Prints the state of port, either up or down.

       lsp-set-enabled port state
              Set  the  administrative  state  of port, either enabled or dis
              abled. When a port is disabled, no traffic is  allowed  into  or
              out of the port.

       lsp-get-enabled port
              Prints  the administrative state of port, either enabled or dis
              abled.

       lsp-set-type port type
              Set the type for the logical port. The type must be one  of  the
              following:

              (empty string)
                     A VM (or VIF) interface.

              router A connection to a logical router.

              localnet
                     A  connection  to  a locally accessible network from each
                     ovn-controller instance. A logical switch can only have a
                     single  localnet port attached. This is used to model di‐
                     rect connectivity to an existing network.

              localport
                     A connection to a local VIF. Traffic that  arrives  on  a
                     localport  is  never  forwarded  over a tunnel to another
                     chassis. These ports are present  on  every  chassis  and
                     have  the  same  address  in all of them. This is used to
                     model connectivity to local services that  run  on  every
                     hypervisor.

              l2gateway
                     A connection to a physical network.

              vtep   A port to a logical switch on a VTEP gateway.

       lsp-get-type port
              Get the type for the logical port.

       lsp-set-options port [key=value]...
              Set type-specific key-value options for the logical port.

       lsp-get-options port
              Get the type-specific options for the logical port.

       lsp-set-dhcpv4-options port dhcp_options
              Set the DHCPv4 options for the logical port. The dhcp_options is
              a UUID referring to a set of DHCP options  in  the  DHCP_Options
              table.

       lsp-get-dhcpv4-optoins port
              Get the configured DHCPv4 options for the logical port.

       lsp-set-dhcpv6-options port dhcp_options
              Set the DHCPv6 options for the logical port. The dhcp_options is
              a UUID referring to a set of DHCP options  in  the  DHCP_Options
              table.

       lsp-get-dhcpv6-optoins port
              Get the configured DHCPv6 options for the logical port.

LOGICAL ROUTER COMMANDS
       lr-add Creates  a  new,  unnamed logical router, which initially has no
              ports. The router does not have a name, other commands must  re‐
              fer to this router by its UUID.

       [--may-exist | --add-duplicate] lr-add router
              Creates  a  new logical router named router, which initially has
              no ports.

              The OVN northbound database  schema  does  not  require  logical
              router  names  to be unique, but the whole point to the names is
              to provide an easy way for humans to refer to the routers,  mak‐
              ing  duplicate  names unhelpful. Thus, without any options, this
              command regards it as an error if router is  a  duplicate  name.
              With  --may-exist, adding a duplicate name succeeds but does not
              create a new logical router. With --add-duplicate,  the  command
              really creates a new logical router with a duplicate name. It is
              an error to specify both options. If there are multiple  logical
              routers with a duplicate name, configure the logical routers us‐
              ing the UUID instead of the router name.

       [--if-exists] lr-del router
              Deletes router. It is an error if router does not exist,  unless
              --if-exists is specified.

       lr-list
              Lists all existing routers on standard output, one per line.

LOGICAL ROUTER PORT COMMANDS
       [--may-exist] lrp-add router port mac network... [peer=peer]
              Creates on router a new logical router port named port with Eth‐
              ernet address mac and one or more IP  address/netmask  for  each
              network.

              The optional argument peer identifies a logical router port that
              connects to this one. The following example adds a  router  port
              with an IPv4 and IPv6 address with peer lr1:

              lrp-add lr0 lrp0 00:11:22:33:44:55 192.168.0.1/24 2001:db8::1/64
              peer=lr1

              It is an error if a logical router port named port  already  ex‐
              ists,  unless  --may-exist is specified. Regardless of --may-ex
              ist, it is an error if the existing router port is in some logi‐
              cal router other than router.

       [--if-exists] lrp-del port
              Deletes  port.  It  is  an  error if port does not exist, unless
              --if-exists is specified.

       lrp-list router
              Lists all the logical router ports  within  router  on  standard
              output, one per line.

       lrp-set-enabled port state
              Set  the  administrative  state  of port, either enabled or dis
              abled. When a port is disabled, no traffic is  allowed  into  or
              out of the port.

       lrp-get-enabled port
              Prints  the administrative state of port, either enabled or dis
              abled.

       lrp-set-gateway-chassis port chassis [priority]
              Set gateway chassis for port. chassis is the name of  the  chas‐
              sis. This creates a gateway chassis entry in Gateway_Chassis ta‐
              ble. It won’t check if chassis really exists  in  OVN_Southbound
              database.  Priority will be set to 0 if priority is not provided
              by user. priority must be between 0 and 32767, inclusive.

       lrp-del-gateway-chassis port chassis
              Deletes gateway chassis from port. It is  an  error  if  gateway
              chassis with chassis for port does not exist.

       lrp-get-gateway-chassis port
              Lists all the gateway chassis with priority within port on stan‐
              dard output, one per line, ordered based on priority.

LOGICAL ROUTER STATIC ROUTE COMMANDS
       [--may-exist]  [--policy=POLICY]  lr-route-add  router  prefix  nexthop
       [port]
              Adds  the specified route to router. prefix describes an IPv4 or
              IPv6 prefix for this route, such  as  192.168.100.0/24.  nexthop
              specifies the gateway to use for this route, which should be the
              IP address of one of router logical router ports or the  IP  ad‐
              dress  of  a  logical  port.  If port is specified, packets that
              match this route will be sent out that port. When port is  omit‐
              ted, OVN infers the output port based on nexthop.

              --policy  describes  the  policy used to make routing decisions.
              This should be one of "dst-ip" or "src-ip".  If  not  specified,
              the default is "dst-ip".

              It  is  an  error  if a route with prefix already exists, unless
              --may-exist is specified.

       [--if-exists] lr-route-del router [prefix]
              Deletes routes from router. If only router is supplied, all  the
              routes  from  the  logical router are deleted. If prefix is also
              specified, then all the routes that match  the  prefix  will  be
              deleted from the logical router.

              It  is  an error if prefix is specified and there is no matching
              route entry, unless --if-exists is specified.

       lr-route-list router
              Lists the routes on router.

NAT COMMANDS
       [--may-exist] lr-nat-add  router  type  external_ip  logical_ip  [logi
       cal_port external_mac]
              Adds  the specified NAT to router. The type must be one of snat,
              dnat, or dnat_and_snat. The external_ip is an IPv4 address.  The
              logical_ip  is  an  IPv4 network (e.g 192.168.1.0/24) or an IPv4
              address. The logical_port and  external_mac  are  only  accepted
              when  router  is  a  distributed  router  (rather than a gateway
              router) and type is dnat_and_snat. The logical_port is the  name
              of an existing logical switch port where the logical_ip resides.
              The external_mac is an Ethernet address.

              When type is dnat, the externally visible IP address external_ip
              is DNATted to the IP address logical_ip in the logical space.

              When  type is snat, IP packets with their source IP address that
              either matches the IP address in logical_ip or is in the network
              provided  by  logical_ip is SNATed into the IP address in exter
              nal_ip.

              When type is dnat_and_snat, the externally  visible  IP  address
              external_ip is DNATted to the IP address logical_ip in the logi‐
              cal space. In addition, IP packets with the  source  IP  address
              that  matches logical_ip is SNATed into the IP address in exter
              nal_ip.

              When the logical_port and external_mac are  specified,  the  NAT
              rule  will  be  programmed on the chassis where the logical_port
              resides. This includes ARP replies for  the  external_ip,  which
              return  the  value of external_mac. All packets transmitted with
              source IP address equal to external_ip will be  sent  using  the
              external_mac.

              It  is  an error if a NAT already exists with the same values of
              router, type, external_ip, and logical_ip, unless --may-exist is
              specified.  When --may-exist, logical_port, and external_mac are
              all specified, the existing values of  logical_port  and  exter
              nal_mac are overwritten.

       [--if-exists] lr-nat-del router [type [ip]]
              Deletes  NATs  from  router. If only router is supplied, all the
              NATs from the logical router are deleted. If type is also speci‐
              fied, then all the NATs that match the type will be deleted from
              the logical router. If all the fields are given, then  a  single
              NAT  rule that matches all the fields will be deleted. When type
              is snat, the ip should be  logical_ip.  When  type  is  dnat  or
              dnat_and_snat, the ip shoud be external_ip.

              It  is  an error if ip is specified and there is no matching NAT
              entry, unless --if-exists is specified.

       lr-nat-list router
              Lists the NATs on router.

LOAD BALANCER COMMANDS
       [--may-exist | --add-duplicate] lb-add lb vip ips [protocol]
              Creates a new load balancer named lb with the provided  vip  and
              ips  or  adds the vip to an existing lb. vip should be a virtual
              IP address (or an IP address and a port number with : as a sepa‐
              rator).   Examples   for   vip  are  192.168.1.4,  fd0f::1,  and
              192.168.1.5:8080. ips should be comma separated IP endpoints (or
              comma  separated IP addresses and port numbers with : as a sepa‐
              rator). ips must be the same address family as vip. Examples for
              ips are 10.0.0.1,10.0.0.2or [fdef::1]:8800,[fdef::2]:8800.

              The  optional  argument protocol must be either tcp or udp. This
              argument is useful when a port number is provided as part of the
              vip.  If  the  protocol is unspecified and a port number is pro‐
              vided as part of the vip, OVN assumes the protocol to be tcp.

              It is an error if the vip already exists in  the  load  balancer
              named lb, unless --may-exist is specified. With --add-duplicate,
              the command really creates a new load balancer with a  duplicate
              name.

              The following example adds a load balancer.

              lb-add                      lb0                     30.0.0.10:80
              192.168.10.10:80,192.168.10.20:80,192.168.10.30:80 udp

       [--if-exists] lb-del lb [vip]
              Deletes lb or the vip from lb. If vip is supplied, only the  vip
              will  be deleted from the lb. If only the lb is supplied, the lb
              will be deleted. It is an error if vip does not already exist in
              lb, unless --if-exists is specified.

       lb-list [lb]
              Lists  the LBs. If lb is also specified, then only the specified
              lb will be listed.

       [--may-exist] ls-lb-add switch lb
              Adds the specified lb to switch. It is an error if a  load  bal‐
              ancer  named lb already exists in the switch, unless --may-exist
              is specified.

       [--if-exists] ls-lb-del switch [lb]
              Removes lb from switch. If only switch is supplied, all the  LBs
              from  the  logical  switch are removed. If lb is also specified,
              then only the lb will be removed from the logical switch. It  is
              an  error if lb does not exist in the switch, unless --if-exists
              is specified.

       ls-lb-list switch
              Lists the LBs for the given switch.

       [--may-exist] lr-lb-add router lb
              Adds the specified lb to router. It is an error if a  load  bal‐
              ancer  named lb already exists in the router, unless --may-exist
              is specified.

       [--if-exists] lr-lb-del router [lb]
              Removes lb from router. If only router is supplied, all the  LBs
              from  the  logical  router are removed. If lb is also specified,
              then only the lb will be removed from the logical router. It  is
              an  error if lb does not exist in the router, unless --if-exists
              is specified.

       lr-lb-list router
              Lists the LBs for the given router.

DHCP OPTIONS COMMANDS
       dhcp-options-create cidr [key=value]
              Creates a new DHCP Options entry in the DHCP_Options table  with
              the specified cidr and optional external-ids.

       dhcp-options-list
              Lists the DHCP Options entries.

       dhcp-options-del dhcp-option
              Deletes the DHCP Options entry referred by dhcp-option UUID.

       dhcp-options-set-options dhcp-option [key=value]...
              Set the DHCP Options for the dhcp-option UUID.

       dhcp-options-get-options dhcp-option
              Lists the DHCP Options for the dhcp-option UUID.

PORT GROUP COMMANDS
       pg-add group [port]...
              Creates  a  new  port  group in the Port_Group table named group
              with optional ports added to the group.

       pg-set-ports group port...
              Sets ports on the port group named group.  It  is  an  error  if
              group does not exist.

       pg-del group
              Deletes  port  group group. It is an error if group does not ex‐
              ist.

DATABASE COMMANDS
       These commands query and modify the contents of ovsdb tables. They  are
       a slight abstraction of the ovsdb interface and as such they operate at
       a lower level than other ovn-nbctl commands.

       Identifying Tables, Records, and Columns

       Each of these commands has a table parameter to identify a table within
       the database. Many of them also take a record parameter that identifies
       a particular record within a table. The record  parameter  may  be  the
       UUID  for  a  record, which may be abbreviated to its first 4 (or more)
       hex digits, as long as that is unique.  Many  tables  offer  additional
       ways  to  identify  records.  Some commands also take column parameters
       that identify a particular field within the records in a table.

       For a list of tables and their columns, see ovn-nb(5) or see the  table
       listing from the --help option.

       Record names must be specified in full and with correct capitalization,
       except that UUIDs may be abbreviated to their first  4  (or  more)  hex
       digits, as long as that is unique within the table. Names of tables and
       columns are not case-sensitive, and - and _  are  treated  interchange‐
       ably.  Unique  abbreviations  of table and column names are acceptable,
       e.g. d or dhcp is sufficient to identify the DHCP_Options table.

       Database Values

       Each column in the database accepts a fixed type of data. The currently
       defined basic types, and their representations, are:

              integer
                     A  decimal integer in the range -2**63 to 2**63-1, inclu‐
                     sive.

              real   A floating-point number.

              Boolean
                     True or false, written true or false, respectively.

              string An arbitrary Unicode string, except that null  bytes  are
                     not  allowed.  Quotes  are optional for most strings that
                     begin with an English letter or  underscore  and  consist
                     only  of letters, underscores, hyphens, and periods. How‐
                     ever, true and false and strings that match the syntax of
                     UUIDs  (see  below)  must be enclosed in double quotes to
                     distinguish them from  other  basic  types.  When  double
                     quotes  are  used, the syntax is that of strings in JSON,
                     e.g. backslashes may be used to  escape  special  charac‐
                     ters.  The  empty string must be represented as a pair of
                     double quotes ("").

              UUID   Either a universally unique identifier in  the  style  of
                     RFC  4122,  e.g. f81d4fae-7dec-11d0-a765-00a0c91e6bf6, or
                     an @name defined by a get or create  command  within  the
                     same ovn-nbctl invocation.

       Multiple values in a single column may be separated by spaces or a sin‐
       gle comma. When multiple values are present,  duplicates  are  not  al‐
       lowed,  and  order  is not important. Conversely, some database columns
       can have an empty set of values, represented as [], and square brackets
       may optionally enclose other non-empty sets or single values as well.

       A  few  database columns are ``maps’’ of key-value pairs, where the key
       and the value are each some fixed database type. These are specified in
       the  form key=value, where key and value follow the syntax for the col‐
       umn’s key type and value type, respectively. When  multiple  pairs  are
       present  (separated  by  spaces or a comma), duplicate keys are not al‐
       lowed, and again the order is not important. Duplicate values  are  al‐
       lowed.  An  empty map is represented as {}. Curly braces may optionally
       enclose non-empty maps as well (but use quotes  to  prevent  the  shell
       from  expanding other-config={0=x,1=y} into other-config=0=x other-con
       fig=1=y, which may not have the desired effect).

       Database Command Syntax

              [--if-exists]    [--columns=column[,column]...]    list    table
              [record]...
                     Lists  the  data  in each specified record. If no records
                     are specified, lists all the records in table.

                     If --columns is specified, only the requested columns are
                     listed,  in  the  specified order. Otherwise, all columns
                     are listed, in alphabetical order by column name.

                     Without --if-exists, it is  an  error  if  any  specified
                     record  does not exist. With --if-exists, the command ig‐
                     nores any record that does not exist,  without  producing
                     any output.

              [--columns=column[,column]...]       find       table      [col
              umn[:key]=value]...
                     Lists the data in  each  record  in  table  whose  column
                     equals  value  or, if key is specified, whose column con‐
                     tains a key with the specified value. The following oper‐
                     ators  may  be used where = is written in the syntax sum‐
                     mary:

                     = != gt;>gt; = >gt;>gt;=
                            Selects records in which column[:key] equals, does
                            not  equal, is less than, is greater than, is less
                            than or equal to, or is greater than or  equal  to
                            value, respectively.

                            Consider  column[:key]  and  value as sets of ele‐
                            ments. Identical sets are considered equal. Other‐
                            wise,  if  the sets have different numbers of ele‐
                            ments, then the set with more elements is  consid‐
                            ered  to  be larger. Otherwise, consider a element
                            from each set pairwise, in increasing order within
                            each  set.  The first pair that differs determines
                            the result. (For a column that contains  key-value
                            pairs, first all the keys are compared, and values
                            are considered only if the two sets contain  iden‐
                            tical keys.)

                     {=} {!=}
                            Test for set equality or inequality, respectively.

                     {=}   Selects  records in which column[:key] is a subset
                            of value. For example, flood-vlans{=}1,2  selects
                            records  in  which  the  flood-vlans column is the
                            empty set or contains 1 or 2 or both.

                     {}    Selects records in which column[:key] is a  proper
                            subset  of  value.  For example, flood-vlans{}1,2
                            selects records in which the flood-vlans column is
                            the empty set or contains 1 or 2 but not both.

                     {>gt;>gt;=} {>gt;>gt;}
                            Same  as  {=}  and {}, respectively, except that
                            the  relationship  is   reversed.   For   example,
                            flood-vlans{>gt;>gt;=}1,2  selects  records  in which the
                            flood-vlans column contains both 1 and 2.

                     For arithmetic operators (= != gt;>gt; = >gt;>gt;=),  when  key  is
                     specified  but a particular record’s column does not con‐
                     tain key, the record is always omitted from the  results.
                     Thus,   the   condition   other-config:mtu!=1500  matches
                     records that have a mtu key whose value is not 1500,  but
                     not those that lack an mtu key.

                     For  the  set operators, when key is specified but a par‐
                     ticular record’s column does not contain key, the compar‐
                     ison  is  done  against an empty set. Thus, the condition
                     other-config:mtu{!=}1500 matches records that have a  mtu
                     key  whose  value  is not 1500 and those that lack an mtu
                     key.

                     Don’t forget to escape gt;>gt; from interpretation by  the
                     shell.

                     If --columns is specified, only the requested columns are
                     listed, in the specified order. Otherwise all columns are
                     listed, in alphabetical order by column name.

                     The  UUIDs  shown  for rows created in the same ovn-nbctl
                     invocation will be wrong.

              [--if-exists] [--id=@name] get table record [column[:key]]...
                     Prints the value of each specified column  in  the  given
                     record in table. For map columns, a key may optionally be
                     specified, in which case the value associated with key in
                     the column is printed, instead of the entire map.

                     Without  --if-exists,  it  is an error if record does not
                     exist or key is specified,  if  key  does  not  exist  in
                     record. With --if-exists, a missing record yields no out‐
                     put and a missing key prints a blank line.

                     If @name is specified, then the UUID for  record  may  be
                     referred  to by that name later in the same ovn-nbctl in‐
                     vocation in contexts where a UUID is expected.

                     Both --id and the column arguments are optional, but usu‐
                     ally  at  least  one or the other should be specified. If
                     both are omitted, then get has no effect except to verify
                     that record exists in table.

                     --id and --if-exists cannot be used together.

              [--if-exists] set table record column[:key]=value...
                     Sets  the  value  of  each  specified column in the given
                     record in table to value. For map columns, a key may  op‐
                     tionally be specified, in which case the value associated
                     with key in that column is changed (or added, if none ex‐
                     ists), instead of the entire map.

                     Without  --if-exists,  it  is an error if record does not
                     exist. With --if-exists, this  command  does  nothing  if
                     record does not exist.

              [--if-exists] add table record column [key=]value...
                     Adds  the  specified value or key-value pair to column in
                     record in table. If column is a  map,  then  key  is  re‐
                     quired, otherwise it is prohibited. If key already exists
                     in a map column, then the current value is  not  replaced
                     (use the set command to replace an existing value).

                     Without  --if-exists,  it  is an error if record does not
                     exist. With --if-exists, this  command  does  nothing  if
                     record does not exist.

              [--if-exists] remove table record column value...

                     [--if-exists] remove table record column key...

                     [--if-exists]  remove  table  record  column key=value...
                     Removes the specified values or key-value pairs from col
                     umn in record in table. The first form applies to columns
                     that are not maps: each specified value is  removed  from
                     the  column. The second and third forms apply to map col‐
                     umns: if only a key is specified, then any key-value pair
                     with  the  given key is removed, regardless of its value;
                     if a value is given then a pair is removed only  if  both
                     key and value match.

                     It  is  not  an  error if the column does not contain the
                     specified key or value or pair.

                     Without --if-exists, it is an error if  record  does  not
                     exist.  With  --if-exists,  this  command does nothing if
                     record does not exist.

              [--if-exists] clear table record column...
                     Sets each column in record in table to the empty  set  or
                     empty  map,  as appropriate. This command applies only to
                     columns that are allowed to be empty.

                     Without --if-exists, it is an error if  record  does  not
                     exist.  With  --if-exists,  this  command does nothing if
                     record does not exist.

              [--id=@name] create table column[:key]=value...
                     Creates a new record in table and sets the initial values
                     of  each  column. Columns not explicitly set will receive
                     their default values. Outputs the UUID of the new row.

                     If @name is specified, then the UUID for the new row  may
                     be  referred  to by that name elsewhere in the same \*(PN
                     invocation in contexts where a  UUID  is  expected.  Such
                     references may precede or follow the create command.

                     Caution (ovs-vsctl as example)
                            Records  in the Open vSwitch database are signifi‐
                            cant only when they can be reached directly or in‐
                            directly  from  the Open_vSwitch table. Except for
                            records in the QoS or Queue tables,  records  that
                            are  not reachable from the Open_vSwitch table are
                            automatically  deleted  from  the  database.  This
                            deletion  happens immediately, without waiting for
                            additional ovs-vsctl commands  or  other  database
                            activity. Thus, a create command must generally be
                            accompanied by additional commands within the same
                            ovs-vsctl  invocation to add a chain of references
                            to the newly created  record  from  the  top-level
                            Open_vSwitch  record.  The  EXAMPLES section gives
                            some examples that show how to do this.

              [--if-exists] destroy table record...
                     Deletes each specified record from table. Unless --if-ex
                     ists is specified, each records must exist.

              --all destroy table
                     Deletes all records from the table.

                     Caution (ovs-vsctl as example)
                            The  destroy command is only useful for records in
                            the QoS or Queue tables. Records in  other  tables
                            are  automatically  deleted from the database when
                            they become unreachable from the Open_vSwitch  ta‐
                            ble.  This  means that deleting the last reference
                            to a record is sufficient for deleting the  record
                            itself.  For  records  in these tables, destroy is
                            silently ignored. See the EXAMPLES  section  below
                            for more information.

              wait-until table record [column[:key]=value]...
                     Waits  until  table  contains a record named record whose
                     column equals value or, if key is specified, whose column
                     contains a key with the specified value. Any of the oper‐
                     ators !=, gt;>gt;, =, or >gt;>gt;= may be  substituted  for  =  to
                     test  for  inequality, less than, greater than, less than
                     or equal to, or greater than or equal  to,  respectively.
                     (Don’t forget to escape gt;>gt; from interpretation by the
                     shell.)

                     If no column[:key]=value arguments are given,  this  com‐
                     mand  waits  only  until  record exists. If more than one
                     such argument is given, the command waits  until  all  of
                     them are satisfied.

                     Caution (ovs-vsctl as example)
                            Usually  wait-until should be placed at the begin‐
                            ning of a set of ovs-vsctl commands. For  example,
                            wait-until  bridge  br0  --  get  bridge br0 data
                            path_id waits until a bridge named br0 is created,
                            then  prints  its  datapath_id column, whereas get
                            bridge br0 datapath_id --  wait-until  bridge  br0
                            will  abort  if  no  bridge  named br0 exists when
                            ovs-vsctl initially connects to the database.

                     Consider specifying --timeout=0 along with  --wait-until,
                     to  prevent ovn-nbctl from terminating after waiting only
                     at most 5 seconds.

              comment [arg]...
                     This command has no effect on behavior, but any  database
                     log  record  created by the command will include the com‐
                     mand and its arguments.

SYNCHRONIZATION COMMANDS
       sync   Ordinarily, --wait=sb or --wait=hv only waits for changes by the
              current ovn-nbctl invocation to take effect. This means that, if
              none of the commands supplied to ovn-nbctl change the  database,
              then  the  command  does not wait at all. With the sync command,
              however, ovn-nbctl waits even for earlier changes to  the  data‐
              base  to propagate down to the southbound database or all of the
              OVN chassis, according to the argument to --wait.

REMOTE CONNECTIVITY COMMANDS
       get-connection
              Prints the configured connection(s).

       del-connection
              Deletes the configured connection(s).

       [--inactivity-probe=msecs] set-connection target...
              Sets the configured manager target or  targets.  Use  --inactiv
              ity-probe=msecs to override the default idle connection inactiv‐
              ity probe time. Use 0 to disable inactivity probes.

SSL CONFIGURATION COMMANDS
       get-ssl
              Prints the SSL configuration.

       del-ssl
              Deletes the current SSL configuration.

       [--bootstrap] set-ssl private-key  certificate  ca-cert  [ssl-protocol-
       list [ssl-cipher-list]]
              Sets the SSL configuration.

DAEMON MODE
       When  it  is invoked in the most ordinary way, ovn-nbctl connects to an
       OVSDB server that hosts the northbound database,  retrieves  a  partial
       copy  of  the  database that is complete enough to do its work, sends a
       transaction request to the  server,  and  receives  and  processes  the
       server’s  reply.  In  common  interactive use, this is fine, but if the
       database is large, the step in which ovn-nbctl retrieves a partial copy
       of  the  database  can  take a long time, which yields poor performance
       overall.

       To improve performance in such  a  case,  ovn-nbctl  offers  a  "daemon
       mode,"  in  which  the user first starts ovn-nbctl running in the back‐
       ground and afterward uses the daemon to execute operations.  Over  sev‐
       eral  ovn-nbctl  command  invocations, this performs better overall be‐
       cause it retrieves a copy of the database only once at  the  beginning,
       not once per program run.

       Use the --detach option to start an ovn-nbctl daemon. With this option,
       ovn-nbctl prints the name of a control socket  to  stdout.  The  client
       should  save this name in environment variable OVN_NB_DAEMON. Under the
       Bourne shell this might be done like this:

             export OVN_NB_DAEMON=$(ovn-nbctl --pidfile --detach)


       When OVN_NB_DAEMON is set, ovn-nbctl  automatically  and  transparently
       uses the daemon to execute its commands.

       When  the daemon is no longer needed, kill it and unset the environment
       variable, e.g.:

             kill $(cat /var/run/ovn-nbctl.pid)
             unset OVN_NB_DAEMON


       Daemon mode is experimental.

   Daemon Commands
       Daemon mode is internally implemented using the same mechanism used  by
       ovs-appctl.  One  may  also  use ovs-appctl directly with the following
       commands:

              run [options] command [arg...] [--  [options]  command  [arg...]
              ...]
                     Instructs the daemon process to run one or more ovn-nbctl
                     commands described above and reply with  the  results  of
                     running  these  commands.  Accepts the --no-wait, --wait,
                     --timeout, --dry-run,  --oneline,  and  the  options  de‐
                     scribed under Table Formatting Options in addition to the
                     the command-specific options.

              exit   Causes ovn-nbctl to gracefully terminate.

OPTIONS
       --no-wait | --wait=none
       --wait=sb
       --wait=hv
            These options control whether and how ovn-nbctl waits for the  OVN
            system  to become up-to-date with changes made in an ovn-nbctl in‐
            vocation.

            By default, or if --no-wait or --wait=none, ovn-nbctl exits  imme‐
            diately  after  confirming that changes have been committed to the
            northbound database, without waiting.

            With --wait=sb, before ovn-nbctl exits, it waits for ovn-northd to
            bring the southbound database up-to-date with the northbound data‐
            base updates.

            With --wait=hv, before ovn-nbctl exits, it additionally waits  for
            all  OVN  chassis  (hypervisors and gateways) to become up-to-date
            with the northbound database updates. (This can become an  indefi‐
            nite wait if any chassis is malfunctioning.)

            Ordinarily,  --wait=sb  or --wait=hv only waits for changes by the
            current ovn-nbctl invocation to take effect. This means  that,  if
            none  of  the  commands supplied to ovn-nbctl change the database,
            then the command does not wait at all. Use  the  sync  command  to
            override this behavior.

       --db database
            The OVSDB database remote to contact. If the OVN_NB_DB environment
            variable is set, its value is used as the default. Otherwise,  the
            default  is  unix:/var/run/openvswitch/ovnnb_db.sock, but this de‐
            fault is unlikely to be useful outside of single-machine OVN  test
            environments.

       --leader-only
       --no-leader-only
            By  default,  or with --leader-only, when the database server is a
            clustered database, ovn-nbctl will avoid servers  other  than  the
            cluster  leader.  This  ensures that any data that ovn-nbctl reads
            and reports is up-to-date. With --no-leader-only,  ovn-nbctl  will
            use  any  server  in  the  cluster, which means that for read-only
            transactions it can report and act  on  stale  data  (transactions
            that   modify   the  database  are  always  serialized  even  with
            --no-leader-only). Refer to Understanding Cluster  Consistency  in
            ovsdb(7) for more information.

   Daemon Options
       --pidfile[=pidfile]
              Causes a file (by default, program.pid) to be created indicating
              the PID of the running process. If the pidfile argument  is  not
              specified, or if it does not begin with /, then it is created in
              /var/run/openvswitch.

              If --pidfile is not specified, no pidfile is created.

       --overwrite-pidfile
              By default, when --pidfile is specified and the  specified  pid‐
              file already exists and is locked by a running process, the dae‐
              mon refuses to start. Specify --overwrite-pidfile to cause it to
              instead overwrite the pidfile.

              When --pidfile is not specified, this option has no effect.

       --detach
              Runs  this  program  as a background process. The process forks,
              and in the child it starts a new session,  closes  the  standard
              file descriptors (which has the side effect of disabling logging
              to the console), and changes its current directory to  the  root
              (unless  --no-chdir is specified). After the child completes its
              initialization, the parent exits.

       --monitor
              Creates an additional process to monitor  this  program.  If  it
              dies  due  to a signal that indicates a programming error (SIGA
              BRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU,
              or SIGXFSZ) then the monitor process starts a new copy of it. If
              the daemon dies or exits for another reason, the monitor process
              exits.

              This  option  is  normally used with --detach, but it also func‐
              tions without it.

       --no-chdir
              By default, when --detach is specified, the daemon  changes  its
              current  working  directory  to  the root directory after it de‐
              taches. Otherwise, invoking the daemon from a carelessly  chosen
              directory  would  prevent  the administrator from unmounting the
              file system that holds that directory.

              Specifying --no-chdir suppresses this behavior,  preventing  the
              daemon  from changing its current working directory. This may be
              useful for collecting core files, since it is common behavior to
              write core dumps into the current working directory and the root
              directory is not a good directory to use.

              This option has no effect when --detach is not specified.

       --no-self-confinement
              By default this daemon will try to self-confine itself  to  work
              with  files  under  well-known  directories whitelisted at build
              time. It is better to stick with this default behavior  and  not
              to  use  this  flag  unless some other Access Control is used to
              confine daemon. Note that in contrast to  other  access  control
              implementations  that  are  typically enforced from kernel-space
              (e.g. DAC or MAC), self-confinement is imposed  from  the  user-
              space daemon itself and hence should not be considered as a full
              confinement strategy, but instead should be viewed as  an  addi‐
              tional layer of security.

       --user=user:group
              Causes  this  program  to  run  as a different user specified in
              user:group, thus dropping most of  the  root  privileges.  Short
              forms  user  and  :group  are also allowed, with current user or
              group assumed, respectively. Only daemons started  by  the  root
              user accepts this argument.

              On   Linux,   daemons   will   be   granted   CAP_IPC_LOCK   and
              CAP_NET_BIND_SERVICES before dropping root  privileges.  Daemons
              that  interact  with  a  datapath, such as ovs-vswitchd, will be
              granted three  additional  capabilities,  namely  CAP_NET_ADMIN,
              CAP_NET_BROADCAST  and  CAP_NET_RAW.  The capability change will
              apply even if the new user is root.

              On Windows, this option is not currently supported. For security
              reasons,  specifying  this  option will cause the daemon process
              not to start.

LOGGING OPTIONS
       -v[spec]
       --verbose=[spec]
            Sets logging levels. Without any spec, sets the log level for  ev‐
            ery  module  and  destination to dbg. Otherwise, spec is a list of
            words separated by spaces or commas or colons, up to one from each
            category below:

            •      A  valid module name, as displayed by the vlog/list command
                   on ovs-appctl(8), limits the log level change to the speci‐
                   fied module.

            •      syslog,  console, or file, to limit the log level change to
                   only to the system log, to the console, or to a  file,  re‐
                   spectively.  (If  --detach  is specified, the daemon closes
                   its standard file descriptors, so logging  to  the  console
                   will have no effect.)

                   On  Windows  platform,  syslog is accepted as a word and is
                   only useful along with the --syslog-target option (the word
                   has no effect otherwise).

            •      off,  emer,  err,  warn,  info,  or dbg, to control the log
                   level. Messages of the given severity  or  higher  will  be
                   logged,  and  messages  of  lower severity will be filtered
                   out. off filters out all messages. See ovs-appctl(8) for  a
                   definition of each log level.

            Case is not significant within spec.

            Regardless  of the log levels set for file, logging to a file will
            not take place unless --log-file is also specified (see below).

            For compatibility with older versions of OVS, any is accepted as a
            word but has no effect.

       -v
       --verbose
            Sets  the  maximum  logging  verbosity level, equivalent to --ver
            bose=dbg.

       -vPATTERN:destination:pattern
       --verbose=PATTERN:destination:pattern
            Sets the log pattern for destination to pattern. Refer to  ovs-ap
            pctl(8) for a description of the valid syntax for pattern.

       -vFACILITY:facility
       --verbose=FACILITY:facility
            Sets  the RFC5424 facility of the log message. facility can be one
            of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock,
            ftp,  ntp,  audit,  alert, clock2, local0, local1, local2, local3,
            local4, local5, local6 or local7. If this option is not specified,
            daemon  is used as the default for the local system syslog and lo
            cal0 is used while sending a message to the  target  provided  via
            the --syslog-target option.

       --log-file[=file]
            Enables  logging  to a file. If file is specified, then it is used
            as the exact name for the log file. The default log file name used
            if file is omitted is /var/log/openvswitch/program.log.

       --syslog-target=host:port
            Send  syslog messages to UDP port on host, in addition to the sys‐
            tem syslog. The host must be a numerical IP address, not  a  host‐
            name.

       --syslog-method=method
            Specify  method  as  how  syslog messages should be sent to syslog
            daemon. The following forms are supported:

            •      libc, to use the libc syslog() function. Downside of  using
                   this  options  is that libc adds fixed prefix to every mes‐
                   sage before it is actually sent to the syslog  daemon  over
                   /dev/log UNIX domain socket.

            •      unix:file, to use a UNIX domain socket directly. It is pos‐
                   sible to specify arbitrary message format with this option.
                   However,  rsyslogd  8.9  and  older versions use hard coded
                   parser function anyway that limits UNIX domain socket  use.
                   If  you  want  to  use  arbitrary message format with older
                   rsyslogd versions, then use UDP socket to localhost IP  ad‐
                   dress instead.

            •      udp:ip:port,  to  use  a UDP socket. With this method it is
                   possible to use arbitrary message format  also  with  older
                   rsyslogd.  When sending syslog messages over UDP socket ex‐
                   tra precaution needs to be taken into account, for example,
                   syslog daemon needs to be configured to listen on the spec‐
                   ified UDP port, accidental iptables rules could  be  inter‐
                   fering  with  local syslog traffic and there are some secu‐
                   rity considerations that apply to UDP sockets, but  do  not
                   apply to UNIX domain sockets.

            •      null, to discard all messages logged to syslog.

            The  default is taken from the OVS_SYSLOG_METHOD environment vari‐
            able; if it is unset, the default is libc.

TABLE FORMATTING OPTIONS
       These options control the format of output from the list and find  com‐
       mands.

              -f format
              --format=format
                   Sets  the  type of table formatting. The following types of
                   format are available:

                   table  2-D text tables with aligned columns.

                   list (default)
                          A list with one column per line and  rows  separated
                          by a blank line.

                   html   HTML tables.

                   csv    Comma-separated values as defined in RFC 4180.

                   json   JSON  format as defined in RFC 4627. The output is a
                          sequence of JSON objects, each of which  corresponds
                          to  one  table.  Each  JSON object has the following
                          members with the noted values:

                          caption
                                 The table’s caption. This member  is  omitted
                                 if the table has no caption.

                          headings
                                 An  array  with one element per table column.
                                 Each array element is  a  string  giving  the
                                 corresponding column’s heading.

                          data   An array with one element per table row. Each
                                 element is also an array with one element per
                                 table  column.  The  elements of this second-
                                 level array are the cells that constitute the
                                 table.  Cells  that  represent  OVSDB data or
                                 data types are expressed in  the  format  de‐
                                 scribed  in  the  OVSDB  specification; other
                                 cells are simply expressed as text strings.

              -d format
              --data=format
                   Sets the formatting for cells within output  tables  unless
                   the table format is set to json, in which case json format‐
                   ting is always used when formatting  cells.  The  following
                   types of format are available:

                   string (default)
                          The  simple  format described in the Database Values
                          section of ovs-vsctl(8).

                   bare   The simple format with punctuation stripped off:  []
                          and {} are omitted around sets, maps, and empty col‐
                          umns, items within sets  and  maps  are  space-sepa‐
                          rated, and strings are never quoted. This format may
                          be easier for scripts to parse.

                   json   The RFC 4627 JSON format as described above.

              --no-headings
                   This option suppresses the heading row that  otherwise  ap‐
                   pears in the first row of table output.

              --pretty
                   By  default, JSON in output is printed as compactly as pos‐
                   sible. This option causes JSON in output to be printed in a
                   more  readable  fashion. Members of objects and elements of
                   arrays are printed one per line, with indentation.

                   This option does not affect JSON in tables, which is always
                   printed compactly.

              --bare
                   Equivalent to --format=list --data=bare --no-headings.

   PKI Options
       PKI  configuration  is  required  to  use SSL for the connection to the
       database.

              -p privkey.pem
              --private-key=privkey.pem
                   Specifies a PEM file containing the  private  key  used  as
                   identity for outgoing SSL connections.

              -c cert.pem
              --certificate=cert.pem
                   Specifies  a  PEM file containing a certificate that certi‐
                   fies the private key specified on -p or --private-key to be
                   trustworthy. The certificate must be signed by the certifi‐
                   cate authority (CA) that the peer in SSL  connections  will
                   use to verify it.

              -C cacert.pem
              --ca-cert=cacert.pem
                   Specifies a PEM file containing the CA certificate for ver‐
                   ifying certificates presented to this program by SSL peers.
                   (This  may  be  the  same certificate that SSL peers use to
                   verify the certificate specified on -c or --certificate, or
                   it  may  be a different one, depending on the PKI design in
                   use.)

              -C none
              --ca-cert=none
                   Disables verification  of  certificates  presented  by  SSL
                   peers.  This  introduces  a security risk, because it means
                   that certificates cannot be verified to be those  of  known
                   trusted hosts.

              --bootstrap-ca-cert=cacert.pem
                     When  cacert.pem  exists, this option has the same effect
                     as -C or --ca-cert. If it does not exist, then  the  exe‐
                     cutable  will  attempt  to obtain the CA certificate from
                     the SSL peer on its first SSL connection and save  it  to
                     the  named PEM file. If it is successful, it will immedi‐
                     ately drop the connection and reconnect, and from then on
                     all  SSL  connections must be authenticated by a certifi‐
                     cate signed by the CA certificate thus obtained.

                     This option exposes the SSL connection to  a  man-in-the-
                     middle  attack  obtaining the initial CA certificate, but
                     it may be useful for bootstrapping.

                     This option is only useful if the SSL peer sends  its  CA
                     certificate as part of the SSL certificate chain. The SSL
                     protocol does not require the server to send the CA  cer‐
                     tificate.

                     This option is mutually exclusive with -C and --ca-cert.

   Other Options
       -h
       --help
            Prints a brief help message to the console.

       -V
       --version
            Prints version information to the console.



Open vSwitch 2.10.90               ovn-nbctl                      ovn-nbctl(8)