Display a help message to standard output and exit

Create links in the trusted CA directory DIRECTORY instead of using the default search path.

Default trusted certificate directory.

Path to the current user’s home directory.

Path to the GCT installation.

Display a help message and exit.

Display information about the personal certificate and key that is the current user’s default credential.

Check time synchronization with the ntpdate command.

Check the validity of the certificate in the file named by CERTIFICATE or standard input if the parameter to -c is -.

Display the command-line options to grid-cert-info and exit.

Display the version number of the grid-cert-info command. The second form includes more details.

Display information about the first certificate contained in the file named by CERTIFICATE-FILE instead of the default user certificate.

Display X.509 distinguished names using the string representation defined in RFC 2253 instead of the default OpenSSL oneline format.

Display the text representation of the entire certificate in addition to any other facts requested by command-line options. This is the default if no fact-specific command-line options are used.

Display the subject name of the X.509 certificate.

Display the issuer name of the X.509 certificate.

Display the default hash of the issuer name of the X.509 certificate. This can be used to locate which CA certificate in the trusted certificate directory issued the certifcate being inspected.

Display a string representation of the date and time when the certificate is valid from. This is displayed in the format used by the OpenSSL x509 command.

Display a string representation of the date and time when the certificate is valid until. This is displayed in the format used by the OpenSSL x509 command.

Path to the default certificate file to inspect.

Display the command-line options to grid-cert-request and exit.

Display the version number of the grid-cert-request command. The second form includes more details.

Create a certificate request with the common name component of the subject set to NAME. This is used to create user identity certificates.

Write the certificate request and key to files in the directory specified by DIRECTORY.

Use the string PREFIX as the base name of the certificate, certificate_request, and key files instead of the default. For a user certificate request, this would mean creating files $HOME/.globus/PREFIXcert_request.pem, , $HOME/.globus/PREFIXcert.pem, and , and $HOME/.globus/PREFIXkey.pem..

Use the certificate request configuration for the CA with the name hash CA-HASH instead of the default CA chosen by running grid-default-ca.

Keep the output from the OpenSSL certificate request command visible after it completes, instead of clearing the screen..

Prompt for each component of the subject name of the request, instead of generating the common name from other command-line options. Note that CAs may not sign certificates for subject names that don’t match their signing policies.

Overwrite any existing certificate request and private key with a new one.

Create an unencrypted private key for the certificate instead of prompting for a passphrase. This is the default behavior for host or service certificates, but not recommended for user certificates.

Create a certificate request for use on a particular host. This option also causes the private key assoicated with the certificate request to be unencrypted. The FQDN argument to this option should be the fully qualified domain name of the host that will use this certificate. The subject name of the certificate will be derived from the FQDN and the service option if specified by the -service command-line option. If the host for the certificate has multiple names, then use either the -dns or -ip command-line options to add alternate names or addresses to the certificates.

Create a certificate request for a particular service on a host. The subject name of the certificate will be derived from the FQDN passed as the argument to the -host command-line option and the SERVICE string.

Create a certificate request containing a subjectAltName extension containing one or more host names. This is used when a certificate may be used by multiple virtual servers or if a host has different names when contacted within or outside a private network. Multiple DNS names can be included in the extension by separating then with a comma.

Create a certificate request containing a subjectAltName extension containing the IP addresses named by the IP-ADDRESS strings. This is used when a certificate may be used by services listening on multiple networks. Multiple IP addresses can be included in the extension by separating then with a comma.

Path to the directory containing SSL configuration files for generating certificate requests.

Path to the directory containing SSL configuration files for generating certificate requests. This value is used if X509_CERT_DIR is not set.

Path to the directory containing the Grid Community Toolkit. This is searched if neither the X509_CERT_DIR nor the GRID_SECURITY_DIR environment variables are set.

Default path to write a user certificate request.

Default path to write a user certificate.

Default path to write a user private key.

Default path to write a host certificate request.

Default path to write a host certificate.

Default path to write a host private key.

SSL configuration file for requesting a user certificate. The first form is the default location, the second form is used when the -ca command-line option is specified.

SSL configuration file for requesting a host or service certificate. The first form is the default location, the second form is used when the -ca command-line option is specified.

Display the command-line options to grid-default-ca and exit.

Display the version number of the grid-default-ca command. The second form includes more details.

Use the trusted certificate directory named by CA-DIRECTORY instead of the default.

Instead of changing the default CA, print out a list of all available CA certificates in the trusted certificate directory

Set the default CA without displaying the list of choices or prompting. The CA file named by CA-HASH must exist.

Path to the default trusted certificate directory.

Path to the default trusted certificate directory.

Path to the Grid Community Toolkit installation directory.

Display the command-line options to grid-change-pass-phrase and exit.

Display the version number of the grid-change-pass-phrase command. The second form includes more details.

Change the passphrase of the private key named by PRIVATE-KEY instead of the default.

Path to the default private key file.

Display the command-line options to grid-proxy-init.

Display the version number of the grid-proxy-init command

Display information about the path to the certificate and key used to generate the proxy certificate, the path to the trusted certificate directory, and verbose error messages

Suppress all output from grid-proxy-init except for passphrase prompts.

Perform certificate chain validity checks on the generated proxy.

Create a certificate that is valid for HOURS hours and MINUTES minutes. If not specified, the default of twelve hours and no minutes is used.

Create a proxy certificate signed by the certificate located in CERTFILE using the key located in using the key located in KEYFILE. If not specified the default certificate and key will be used. This overrides the values of environment variables described below.. If not specified the default certificate and key will be used. This overrides the values of environment variables described below.

Search CERTDIR for trusted certificates if verifying the proxy certificate. If not specified, the default trusted certificate search path is used. This overrides the value of the X509_CERT_DIR environment variable

Write the generated proxy certificate file to PROXYPATH instead of the default path of /tmp/x509up_uUID..

When creating the proxy certificate, use a BITS bit key instead of the default 512 bit keys.

Add the certificate policy data described in POLICYFILE as the ProxyCertInfo X.509 extension to the generated proxy certificate.

Set the policy language identifier of the policy data specified by the -policy command-line option to the oid specified by the POLICY-OID string.

Set the maximum length of the chain of proxies that can be created by the generated proxy to MAXIMUM. If not set, the default of an unlimited proxy chain length is used.

Read the private key’s passphrase from stdin instead of reading input from the controlling tty. This is useful when scripting grid-proxy-init.

Create a limited proxy. Limited proxies are generally refused by process-creating services, but may be used to authorize with other services.

Create an independent proxy. An independent proxy is not treated as an impersonation proxy but as a separate identity for authorization purposes.

Create a IETF draft proxy instead of the default RFC 3280-compliant proxy. This type of proxy uses a non-standard proxy policy identifier. This might be useful for authenticating with older versions of the Globus Toolkit.

Create a legacy proxy instead of the default RFC 3280-compliant proxy. This type of proxy uses a non-standard method of indicating that the certificate is a proxy and whether it is limited. This might be useful for authenticating with older versions of the Globus Toolkit.

Create an RFC 3820-compliant proxy certificate. This is the default for this version of grid-proxy-init.

Path to the certificate to use as issuer of the new proxy.

Path to the key to use to sign the new proxy.

Path to the directory containing trusted certifiate certificates and signing policies.

Default path to the certificate to use as issuer of the new proxy.

Default path to the key to use to sign the new proxy.

Display the command-line options to grid-proxy-destroy.

Display the version number of the grid-proxy-destroy command

Display verbose error messages.

Do not remove the proxy, but display the path of the files that would have been removed, or the directory where they would have been removed from if the -all command-line option is used.

Remove the default proxy in addition to the files included on the command-line. Only needed if other paths are included on the command-line.

Remove the default proxy and all delegated proxies in the temporary file directory.

Path to the default user proxy.

Display the command-line options to grid-proxy-info.

Display the version number of the grid-proxy-info command

Display verbose error messages.

Read the proxy located in the file PROXYFILE instead of using the default proxy.

Display the proxy certificate’s subject distinguished name.

Display the proxy certificate issuer’s distinguished name.

Display the proxy certificate’s identity. For non-independent proxies, the identity is the subject of the certificate which issued the first proxy in the proxy chain.

Display the type of proxy certificate. The type string includes the format ("legacy", "draft", or RFC 3280 compliant), identity type ("impersonation" or "independent"), and policy ("limited" or "full"). See grid-proxy-init(1) for information about how to create different types of proxies.

Display the number of seconds remaining until the proxy certificate expires.

Display the strength (in bits) of the key associated with the proxy certificate.

Display the default information for the proxy when also using the -e or -exists command-line option.

Display the proxy certificate contents to standard output, including policy information, issuer, public key, and modulus.

Display the path to the file containing the default proxy certificate.

Display distinguished names for the subject, issuer, and identity using the string representation described in RFC 2253, instead of the legacy format.

Perform an existence and validity check for the proxy. If a valid proxy exists and matches the criteria described by other command-line options (if any), exit with 0; otherwise, exit with 1. This option must be before other validity check predicate in the command-line options. If this option is specified, the output of the default facts about the proxy is disabled. Use the -all option to have the information displayed as well as the exit code set.

Check that the proxy certificate is valid for at least HOURS hours and MINUTES minutes. If it is not, grid-proxy-info will exit with exit code 1.

Check that the proxy certificate key strength is at least BITS bits.

Path to the default user proxy.

Display the command-line options to grid-mapfile-add-entry.

Display the version number of the grid-mapfile-add-entry command. The second form includes more details.

The X.509 distinguished name to add a mapping for. The name should be in OpenSSL’s oneline format.

The POSIX user name to map the distinguished name to. This name must be a valid username. Add multiple LOCAL-NAME strings after the -ln command-line option. If any of the local names are invalid, no changes will be made to the gridmap file. Note that if multiple occurances of the -ln command-line option are present, only the the last one will be added.

Verify local names and display diagnostics about what would be added to the gridmap file, but don’t actually modify the file.

Modify the gridmap file named by MAPFILE instead of the default.

Path to the default gridmap to modify.

Path to the default gridmap to modify if GRIDMAP environment variable is not set.

Display the command-line options to grid-mapfile-check-consistency.

Display the version number of the grid-mapfile-check-consistency command.

Check the gridmap file named by MAPFILE instead of the default.

Path to the default gridmap to check.

Path to the default gridmap to check if the GRIDMAP environment variable is not set for non-root users.

Path to the default gridmap to check if GRIDMAP environment variable is not set and the above file does not exist.

Display the command-line options to grid-mapfile-delete-entry.

Display the version number of the grid-mapfile-delete-entry command. The second form includes more details.

The X.509 distinguished name to remove from the gridmap file. If the -ln option is not specified, remove all entries for this name; otherwise, remove entries that match both this name and the local name. The name should be in OpenSSL’s oneline format.

The POSIX user name to remove from the gridmap file. Include multiple LOCAL-NAME strings after the -ln command-line option to remove multiple names from the gridmap. If the -dn option is not specifeid, remove all entries for these names; otherwise, remove entries that match the DISTINGUISHED-NAME and any of the LOCAL-NAME values.

Display diagnostics about what would be removed from the gridmap file, but don’t actually modify the file.

Modify the gridmap file named by MAPFILE instead of the default.

Path to the default gridmap to modify.

Path to the default gridmap to modify if GRIDMAP environment variable is not set.

Print help.

Print the versions of all modules that this program uses

Do not die after any errors. By default, program will exit after most errors.

Convert the file to/from ASCII format to/from local file format

Do not apply any conversion to the files. default

Read a list of URL pairs from filename. Each line should contain sourceURL destURL. Enclose URLs with spaces in double qoutes ("). Blank lines and lines beginning with # will be ignored.

Create destination directory if needed.

Copy files in subdirectories

Recommended when using GridFTP servers. Use MODE E for all data transfers, including reusing data channels between list and transfer operations.

Run the transfer for this number of seconds and then end. Useful for performance testing or forced restart loops.

Suppress all output for successful operation.

Display URLs being transferred

During the transfer, display the number of bytes transferred and the transfer rate per second. Show URLs being transferred

Debug ftp connections. Prints control channel communication to stderr

Restart failed ftp operations.

The maximum number of times to retry the operation before giving up on the transfer. Use 0 for infinite. Default is 5.

The interval in seconds to wait after a failure before retrying the transfer. Use 0 for an exponential backoff. Default is 0.

Maximum time after a failure to keep retrying. Use 0 for no timeout. Default is 0.

How long before cancelling/restarting a transfer with no data movement. Set to 0 to disable. Default is 600 seconds.

Path to a file where untransferred URLs will be saved for later restarting. Resulting file is the same format as the -f input file. If file exists, it will be read and all other URL input will be ignored.

Perform no write operations on the destination. Instead, all files that would be transferred are enumerated and dumped to the specified file. Resulting file is the same format as the -f input file. Note: if you intend to use this file as input for a future transfer, the -create-dest option will be required if any destination directories do not already exist.

The path portion of ftp URLs will be interpreted as relative to the user’s starting directory on the server. By default, all paths are root-relative. When this flag is set, the path portion of the ftp URL must start with %2F if it designates a root-relative path.

Use this subject to match with both the source and dest servers.

Use this subject to match with the source server

Use this subject to match with the destination server.

Specify the size (in bytes) of the buffer to be used by the underlying ftp data channels.

Specify the size (in bytes) of the buffer to be used by the underlying transfer methods.

Specify the number of parallel data connections should be used.

Turn third-party transfers off (on by default).

Turn off data channel authentication for ftp transfers.

Set data channel protection mode to SAFE

Set data channel protection mode to PRIVATE

Offset for partial ftp file transfers, defaults to 0.

Length for partial ftp file transfers, used only for the source url, defaults the full file.

List the files located at URL.

Enable striped transfers on supported servers.

Set layout mode and block size for striped transfers. If not set, server defaults will be used. If set to 0, Partitioned mode will be used. If set to > 0, Blocked mode will be used, with this as the block size.

Use ipv6 when available (EXPERIMENTAL)

Use UDT, a reliable udp based transport protocol, for data transfers

Use GridFTP v2 protocol enhancements when possible.

Enable delayed passive.

Set the back-end storage module to use for both the source and destination in a GridFTP transfer.

Set the back-end storage module arguments to use for both the source and destination in a GridFTP transfer.

Set the back-end storage module to use for the source in a GridFTP transfer.

Set the back-end storage module arguments to use for the source in a GridFTP transfer.

Set the back-end storage module to use for the destination in a GridFTP transfer.

Set the back-end storage module arguments to use for the destination in a GridFTP transfer.

Use the assertions in FILE to authorize the access with both source and destination servers.

Use the assertions in this file to authorize the access with source server.

Use the assertions in this file to authorize the access with dest server.

Cache the authz assertion for subsequent transfers.

Cache the src authz assertion for subsequent transfers.

Cache the dst authz assertion for subsequent transfers.

Enable pipelining support for multi-file ftp transfers. Currently third-party transfers benefit from this. EXPERIMENTAL

Number of concurrent ftp connections to use for multiple transfers.

Use NetLogger to estimate speeds of disk and network read/write system calls, and attempt to determine the bottleneck component.

Set the source end of a remote transfer to use piped in input with the given command line. Do not use with -fsstack.

Set the destination end of a remote transfer to write data to then standard input of the program run via the given command line. Do not use with -fsstack.

Sets both -src-pipe and -dst-pipe to the same thing.

Set the XIO driver stack for the network on both the source and the destination. Both must be GridFTP servers. The stack should contain all network drivers to use, in the order specified from bottom to top (e.g. -dcstack tcp,gsi). If the gsi driver is not included in the stack and data channel authentication is enabled, it will be inserted above the transport driver in the stack.

Set the XIO driver stack for the disk on both the source and the destination. Both must be GridFTP servers. The stack should contain all file system drivers to use, in the order specified from bottom to top.

Set the XIO driver stack for the network on the source GridFTP server. See -dcstack above for description of the STACK string.

Set the XIO driver stack for the disk on the source GridFTP server. See -fsstack above for description of the STACK string.

Set the XIO driver stack for the network on the destination GridFTP server. See -dcstack above for description of the STACK string.

Set the XIO driver stack for the disk on the destination GridFTP server. See -fsstack above for description of the STACK string.

Set the credentials to use for both ftp connections.

Set the credentials to use for source ftp connections.

Set the credentials to use for destination ftp connections.

File with mapping of logical host aliases to lists of physical hosts. When used with multiple concurrent connections, each connection uses the next host in the list. Each line should either be an alias, noted with the @ symbol, or a hostname[:port]. Currently, only the aliases @source and @destination are valid, and they are used for every source or destination URL.

Only transfer files where the destination does not exist or differs from the source. -sync-level controls how to determine if files differ.

Criteria for determining if files differ when performing a sync transfer. The default sync level is 2. The available levels are:

Successful program execution.

Print short usage and exit

Specify the new chroot directory to create.

Specify the trusted certificate dir source.

Successful program execution.

Error

Working directory of the job

Comma-separated list of strings defining environment variables. The form of these strings is var=value

Number of processes to start

Full path to the executable to run

Comma-separated list of command-line arguments for the job

Full path to a file containing the input of the job

Full path to a file to write the output of the job to

Full path to a file to write the error stream of the job

Path to Grid Community Toolkit installation. This is used to locate the globus-fork.conf configuration file. configuration file.

Path to fork SEG configuration file.

Default location of enabled gatekeeper service descriptions.

Display a help message to standard error and exit

Load configuration parameters from PARAMETER_FILE. The parameters in that file are treated as additional command-line options.

Parse the configuration file and print out the POSIX user id of the globus-gatekeeper process, service home directory, service execution directory, and X.509 subject name and then exits.

Run the globus-gatekeeper process in the foreground.

Flag to indicate that the globus-gatekeeper process was started via inetd or a similar super-server. If this flag is set and the globus-gatekeeper was not started via inetd, a warning will be printed in the gatekeeper log.

Flag to indicate that the globus-gatekeeper process should run in the foreground. This flag has no effect when the globus-gatekeeper is started via inetd.

Listen for connections on the TCP/IP port PORT. This option has no effect if the globus-gatekeeper is started via inetd or a similar service. If not specified and the gatekeeper is running as root, the default of 2119 is used. Otherwise, the gatekeeper defaults to an ephemeral port.

Sets the gatekeeper deployment directory to PATH. This is used to interpret relative paths for accounting files, libexecdir, certificate paths, and also to set the GLOBUS_LOCATION environment variable in the service environment. If not specified, the gatekeeper looks for service executables in /usr/sbin, configuration in , configuration in /etc, and writes logs and accounting files to , and writes logs and accounting files to /var/log..

Write log entries to LOGFILE. If LOGFILE is equal to logoff or LOGOFF, then logging will be disabled, both to file and to syslog.

Open syslog using the LOG_FACILITY. If not specified, LOG_DAEMON will be used as the default when using syslog.

Set the path to write accounting records to ACCTFILE. If not set, records will be written to the log file.

Look for service executables in LIBEXECDIR. If not specified, the sbin subdirectory of the parameter to subdirectory of the parameter to -home is used, or /usr/sbin if that is not set. if that is not set.

Determine how to launch services. The method may be either fork_and_exit (the service runs completely independently of the gatekeeper, which exits after creating the new service process), fork_and_wait (the service is run in a separate process from the gatekeeper but the gatekeeper does not exit until the service terminates), or dont_fork, where the gatekeeper process becomes the service process via the exec() system call.

Look for service descriptions in SERVICEDIR.

Sets the GLOBUSID environment variable to GLOBUSID. This variable is used to construct the gatekeeper contact string if it can not be parsed from the service credential.

Use the file at GRIDMAP to map GSSAPI names to POSIX user names.

Use the directory TRUSTED_CERT_DIR to locate trusted CA X.509 certificates. The gatekeeper sets the environment variable X509_CERT_DIR to this value.

Read the service X.509 certificate from CERT_PATH. The gatekeeper sets the X509_USER_CERT environment variable to this value.

Read the private key for the service from KEY_PATH. The gatekeeper sets the X509_USER_KEY environment variable to this value.

Read the X.509 proxy certificate from PROXY_PATH. The gatekeeper sets the X509_USER_PROXY environment variable to this value.

Use the globus-k5 command to acquire Kerberos 5 credentials before starting the service.

Use KMAP as the path to the Grid credential to kerberos initialization mapping file.

Write the process id of the globus-gatekeeper to the file named by PIDFILE.

Directory containing X.509 trust anchors and signing policy files.

Path to file containing an X.509 proxy.

Path to file containing an X.509 user certificate.

Path to file containing an X.509 user key.

Default path to gatekeeper service files.

Service configuration for SERVICENAME.

Default file mapping Grid identities to POSIX identities.

Default file mapping Grid identities to Kerberos 5 principals.

File to disable the globus-gatekeeper program.

Default gatekeeper log.

Use CONFIG_FILE instead of the default from the configuration file for audit database configuration.

Check whether the insertion of a record was successful by querying the database after inserting the records. This is used in tests.

Delete audit records from the database right after inserting them. This is used in tests to avoid filling the databse with test records.

Look for audit records in DIR, instead of looking in the directory specified in the job manager configuration. This is used in tests to control which records are loaded to the database and then deleted.

Perform the given SQL query on the audit database. This uses the database information from the configuration file to determine how to contact the database.

Reduce the amount of output for common operations.

GRAM5 job manager configuration. It includes the default path to the audit directory

Audit configuration. It includes the information needed to contact the audit database.

Display a help message to standard error and exit.

Display the software version of the globus-job-cancel program to standard output.

Display the software version of the globus-job-cancel program including DiRT information to standard output.

Do not prompt to confirm job cancel and clean-up.

Do not print diagnostics for succesful cancel. Implies -f

Path to proxy credential.

Path to trusted certificate directory.

Display a help message to standard error and exit.

Display the software version of the globus-job-clean program to standard output.

Display the software version of the globus-job-clean program including DiRT information to standard output.

Submit the clean-up job to the resource named by RESOURCE instead of the default GRAM service on the same host as the job contact.

Do not prompt to confirm job cancel and clean-up.

Do not print diagnostics for succesful clean-up. Implies -f

Path to proxy credential.

Path to trusted certificate directory.

Display a help message to standard error and exit.

Display the software version of the globus-job-get-output program to standard output.

Display the software version of the globus-job-get-output program including DiRT information to standard output.

Submit the retrieval job to the resource named by RESOURCE instead of the default GRAM service on the same host as the job contact.

Retrieve only the standard output stream of the job. The default is to retrieve both standard output and standard error.

Retrieve only the standard error stream of the job. The default is to retrieve both standard output and standard error.

Print only the last LINES count lines of output from the data streams being retrieved. By default, the entire output and error file data is retrieved. This option can not be used along with the -f or -follow options.

Print the last LINES count lines of output from the data streams being retrieved and then wait until canceled, printing any subsequent job output that occurs. By default, the entire output and error file data is retrieved. This option can not be used along with the -t or -tail options.

Path to proxy credential.

Path to trusted certificate directory.

Display a help message to standard error and exit

Execute jobs using the local resource manager named LRM.

Read additional command-line arguments from the file CONFIG_PATH. If present, this must be the first command-line argument to the globus-job-manager program.

Indicate the CPU type of the system which the jobs will execute on. This parameter sets the value of the $(GLOBUS_HOST_CPUTYPE) RSL substitution to CPUTYPE

Indicate the operating system type of the system which the jobs will execute on. This parameter sets the value of the $(GLOBUS_HOST_OSNAME) RSL substitution to OSNAME

Indicate the operating system version of the system which the jobs will execute on. This parameter sets the value of the $(GLOBUS_HOST_OSVERSION) RSL substitution to OSVERSION

Indicate the host name of the machine which the job was submitted to. This parameter sets the value of the $(GLOBUS_GATEKEEPER_HOST) RSL substitution to HOST

Indicate the TCP port number of gatekeeper to which jobs are submitted to. This parameter sets the value of the $(GLOBUS_GATEKEEPER_PORT) RSL substitution to PORT

Indicate the X.509 identity of the gatekeeper to which jobs are submitted to. This parameter sets the value of the $(GLOBUS_GATEKEEPER_SUBJECT) RSL substitution to SUBJECT

Indicate the path where the Grid Community Toolkit is installed on the service node. This is used by the job manager to locate its support and configuration files.

Indicate the path where the Grid Community Toolkit is installed on the execution host. If this is omitted, the value specified as a parameter to -home is used. This parameter sets the value of the $(GLOBUS_LOCATION) RSL substitution to TARGET_GLOBUS_LOCATION

Configure the job manager to write job history files to HISTORY_DIRECTORY. These files are described in the FILES section below.

Configure the job manager to use SCRATCH_DIRECTORY as the default scratch directory root if a relative path is specified in the job RSL’s scratch_dir attribute.

Configure the job manager to write log messages via syslog. Logging is further controlled by the argument to the -log-levels parameter described below.

Configure the job manager to write log messages to files named by the string PATTERN. The PATTERN string may contain job-independent RSL substitutions such as $(HOME), $(LOGNAME), etc, as well as the special RSL substition $(DATE) which will be resolved at log time to the date in YYYYMMDD form.

Configure the job manager to write log messages to files in the LOG_DIRECTORY directory. This is a backward-compatible parameter, equivalent to '-log-pattern '.

Configure the job manager to write log messages of certain levels to syslog and/or log files. The available log levels are FATAL, ERROR, WARN, INFO, DEBUG, and TRACE. Multiple values can be combined with the | character. The default value of logging when enabled is FATAL|ERROR.

Configure the job manager to write state files to STATE_DIRECTORY. If not specified, the job manager uses the default of $GLOBUS_LOCATION/tmp/gram_job_state/. This directory must be writable by all users and be on a file system which supports POSIX advisory file locks. . This directory must be writable by all users and be on a file system which supports POSIX advisory file locks.

Configure the job manager to restrict its TCP/IP communication to use ports in the range described by PORT_RANGE. This value is also made available in the job environment via the GLOBUS_TCP_PORT_RANGE environment variable.

Configure the job manager to restrict its TCP/IP communication to use source ports in the range described by SOURCE_RANGE. This value is also made available in the job environment via the GLOBUS_TCP_SOURCE_RANGE environment variable.

Configure the job manager to search TRUSTED_CERTIFICATE_DIRECTORY for its list of trusted CA certificates and their signing policies. This value is also made available in the job environment via the X509_CERT_DIR environment variable.

Configure the job manager to use the path GASS_CACHE_DIRECTORY for its temporary GASS-cache files. This value is also made available in the job environment via the GLOBUS_GASS_CACHE_DEFAULT environment variable.

Configure the job manager to assume it is using Kerberos for authentication instead of X.509 certificates. This disables some certificate-specific processing in the job manager.

Configure the job manager to define a set of environment variables in the job environment beyond those defined in the base job environment. The format of the parameter to this argument is a comma-separated sequence of VAR=VAL pairs, where VAR is the variable name and VAL is the variable’s value. If the value is not specified, then the value of the variable in the job manager’s environment is used. This option may be present multiple times on the command-line or the job manager configuration file to append multiple environment settings.

Configure the job manager to use the schedule event generator module named by SEG_MODULE to detect job state changes events from the local resource manager, in place of the less efficient polling operations used in GT2. To use this, one instance of the globus-job-manager-event-generator must be running to process events for the LRM into a generic format that the job manager can parse.

Configure the job manager to write audit records to the directory named by AUDIT_DIRECTORY. This records can be loaded into a database using the globus-gram-audit program.

Configure the job manager to use TOOLKIT_VERSION as the version for audit and usage stats records.

Configure the job manager to use SERVICE_TAG as a unique identifier to allow multiple GRAM instances to use the same job state directories without interfering with each other’s jobs. If not set, the value untagged will be used.

Configure the job manager to disable file streaming. This is propagated to the LRM script interface but has no effect in GRAM5.

Disable sending of any usage stats data, even if -usagestats-targets is present in the configuration.

Send usage packets to a data collection service for analysis. The TARGET string consists of a comma-separated list of HOST:PORT combinations, each contaiing an optional list of data to send. See Usage Stats Packets for more information about the tags. Special tag strings of all (which enables all tags) and default may be used, or a sequence of characters for the various tags. If this option is not present in the configuration, then the default of usage-stats.globus.org:4810 is used.

Set the architecture specification for condor jobs to be ARCH in job classified ads generated by the GRAM5 codnor LRM script. This is required for the condor LRM but ignored for all others.

Set the operating system specification for condor jobs to be OS in job classified ads generated by the GRAM5 codnor LRM script. This is required for the condor LRM but ignored for all others.

User’s home directory.

User’s name.

String to prepend to syslog audit messages.

Facility to log syslog audit messages as.

Priority level to use for syslog audit messages.

Job manager ID to be used in syslog audit records.

Peer information to be used in syslog audit records

Credential information to be used in syslog audit records

Time (in seconds) to sleep when the job manager is started. [For debugging purposes only]

File descriptor of an open file which contains the initial job request and to which the initial job reply should be sent. This file descriptor is inherited from the globus-gatekeeper.

Path to the X.509 user proxy which was delegated by the client to the globus-gatekeeper program to be used by the job manager.

File descriptor containing an exported security context that the job manager should use to reply to the client which submitted the job.

Default list of usagestats services to send usage packets to.

Default range of allowed TCP ports to listen on. The -globus-tcp-port-range command-line option overrides this.

Default range of allowed TCP ports to bind to. The -globus-tcp-source-range command-line option overrides this.

Job manager delegated user credential.

Job manager state lock file.

Job manager pid file.

Job manager socket for inter-job manager communications.

Job-specific state directory.

Standard input which has been staged from a remote URL.

Standard output which will be staged from a remote URL.

Standard error which will be staged from a remote URL.

Job-specific delegated credential.

Job state file.

Job state lock file. In most cases this will be a symlink to the job manager lock file.

Default location of the global job manager configuration file.

Default location of the LRM-specific gatekeeper configuration file.

Default location of the site-specific job manager RSL validation file.

Default location of the site-specific job manager RSL validation file for the named lrm.

Display a help message to standard error and exit.

Display the software version of the globus-job-run program to standard output.

Display the software version of the globus-job-run program including DiRT information to standard output.

Translate the command-line options to globus-job-run into an RSL expression that can be used with tools such as globusrun.

Submit the job request to the GRAM service with the dryrun option enabled. When this option is used, the GRAM service prepares to execute the job but stops before submitting the job to the LRM. This can be used to diagnose some problems such as missing files.

Submit the job request to the GRAM service with the dryrun option enabled and then without it enabled if the dryrun is successful.

Read additional command-line options from ARGUMENT_FILE.

Start PROCESSES instances of the executable as a single job.

Schedule the job to run for a maximum of MAX_TIME minutes.

Request that the job use the allocation PROJECT when submitting the job to the LRM.

Request that the job be submitted to the LRM using the named QUEUE.

Run the job in the directory named by DIRECTORY. Input and output files will be interpreted relative to this directory. This directory must exist on the file system on the LRM-managed resource. If not specified, the job will run in the home directory of the user the job is running as.

Define an environment variable named by NAME with the value VALUE in the job environment. This option may be specified multiple times to define multiple environment variables.

Use the file named by STDIN_FILE as the standard input of the job. If the -l option is specified, then this file is interpreted to be on a file system local to the LRM. If the -s option is specified, then this file is interpreted to be on the file system where globus-job-run is being executed, and the file will be staged via GASS. If neither is specified, the local behavior is assumed.

Use the file named by STDOUT_FILE as the destination for the standard output of the job. If the -l option is specified, then this file is interpreted to be on a file system local to the LRM. If the -s option is specified, then this file is interpreted to be on the file system where globus-job-run is being executed, and the file will be staged via GASS. If neither is specified, the local behavior is assumed.

Use the file named by STDERR_FILE as the destination for the standard error of the job. If the -l option is specified, then this file is interpreted to be on a file system local to the LRM. If the -s option is specified, then this file is interpreted to be on the file system where globus-job-run is being executed, and the file will be staged via GASS. If neither is specified, the local behavior is assumed.

Add a set of custom RSL attributes described by RSL_CLAUSE to the job description. The clause must be an RSL conjunction and may contain one or more attributes. This can be used to include attributes which can not be defined by other command-line options of globus-job-run.

When included outside the context of -stdin, -stdout, or -stderr command-line options, -l option alters the interpretation of the executable path. If the -l option is specified, then the executable is interpreted to be on a file system local to the LRM.

When included outside the context of -stdin, -stdout, or -stderr command-line options, -l option alters the interpretation of the executable path. If the -s option is specified, then the executable is interpreted to be on the file system where globus-job-run is being executed, and the file will be staged via GASS. If neither is specified, the local behavior is assumed.

Path to proxy credential.

Path to trusted certificate directory.

The job has been submitted to the LRM but has not yet begun execution.

The job has begun execution.

The job has failed.

The job is currently suspended by the LRM.

The job has completed.

The job has been accepted by GRAM, but not yet submitted to the LRM.

The job has been accepted by GRAM and is currently staging files prior to being submitted to the LRM.

The job has completed execution and is currently staging files from the service node to other http, GASS, or GridFTP servers.

Display a help message to standard error and exit.

Display the software version of the globus-job-status program to standard output.

Display the software version of the globus-job-status program including DiRT information to standard output.

Path to proxy credential.

Path to trusted certificate directory.

Display a help message to standard error and exit.

Display the software version of the globus-job-submit program to standard output.

Display the software version of the globus-job-submit program including DiRT information to standard output.

Translate the command-line options to globus-job-submit into an RSL expression that can be used with tools such as globusrun.

Submit the job request to the GRAM service with the dryrun option enabled. When this option is used, the GRAM service prepares to execute the job but stops before submitting the job to the LRM. This can be used to diagnose some problems such as missing files.

Submit the job request to the GRAM service with the dryrun option enabled and then without it enabled if the dryrun is successful.

Read additional command-line options from ARGUMENT_FILE.

Start PROCESSES instances of the executable as a single job.

Schedule the job to run for a maximum of MAX_TIME minutes.

Request that the job use the allocation PROJECT when submitting the job to the LRM.

Request that the job be submitted to the LRM using the named QUEUE.

Run the job in the directory named by DIRECTORY. Input and output files will be interpreted relative to this directory. This directory must exist on the file system on the LRM-managed resource. If not specified, the job will run in the home directory of the user the job is running as.

Define an environment variable named by NAME with the value VALUE in the job environment. This option may be specified multiple times to define multiple environment variables.

Use the file named by STDIN_FILE as the standard input of the job. If the -l option is specified, then this file is interpreted to be on a file system local to the LRM. If the -s option is specified, then this file is interpreted to be on the file system where globus-job-submit is being executed, and the file will be staged via GASS. If neither is specified, the local behavior is assumed.

Use the file named by STDOUT_FILE as the destination for the standard output of the job. If the -l option is specified, then this file is interpreted to be on a file system local to the LRM. If the -s option is specified, then this file is interpreted to be on the file system where globus-job-submit is being executed, and the file will be staged via GASS. If neither is specified, the local behavior is assumed.

Use the file named by STDERR_FILE as the destination for the standard error of the job. If the -l option is specified, then this file is interpreted to be on a file system local to the LRM. If the -s option is specified, then this file is interpreted to be on the file system where globus-job-submit is being executed, and the file will be staged via GASS. If neither is specified, the local behavior is assumed.

Add a set of custom RSL attributes described by RSL_CLAUSE to the job description. The clause must be an RSL conjunction and may contain one or more attributes. This can be used to include attributes which can not be defined by other command-line options of globus-job-submit.

When included outside the context of -stdin, -stdout, or -stderr command-line options, -l option alters the interpretation of the executable path. If the -l option is specified, then the executable is interpreted to be on a file system local to the LRM.

When included outside the context of -stdin, -stdout, or -stderr command-line options, -l option alters the interpretation of the executable path. If the -s option is specified, then the executable is interpreted to be on the file system where globus-job-run is being executed, and the file will be staged via GASS. If neither is specified, the local behavior is assumed.

Path to proxy credential.

Path to trusted certificate directory.

Print command-line option summary and exit

Print software version

Print software version including DiRT information

Print a list of all currently running personal gatekeepers. These entries will be printed one per line.

Print the configuration directory for the personal gatekeeper with the contact string CONTACT.

Print additional debugging information when starting a personal gatekeeper. This option is ignored in other modes.

Start a new personal gatekeeper process.

Use LRM as the local resource manager interface. If not provided when starting a personal gatekeeper, the job manager will use the default fork LRM.

Write audit report files to AUDIT_DIRECTORY. If not provided, the job manager will not write any audit files.

Listen for gatekeeper TCP/IP connections on the port PORT. If not provided, the gatekeeper will let the operating system choose.

Write job manager log files to DIRECTORY. If DIRECTORY is omitted, the default of $HOME will be used. If this option is not present, the job manager will not write any log files. will be used. If this option is not present, the job manager will not write any log files.

Try to use the SEG mechanism to receive job state change information, instead of polling for these. These require either the system administrator or the user to run an instance of the globus-job-manager-event-generator program for the LRM specified by the -jmtype option.

Write gatekeeper accounting entries to ACCOUNTING_FILE. If not provided, no accounting records are written.

Print command-line option summary and exit

Dump the RVF contents to stdout. In the output, Each file which is parsed will be prefixed by an RVF comment which contains the input filename. If not specified, globus-rvf-check just prints a diagnostic message to standard output indicating whether the file could be parsed.

Print command-line option summary and exit

Edit of the site-specific RVF file, which provides override values applicable to all LRMs installed on the system.

Edit the site-specific LRM overrides for the LRM named by the LRM parameter to the option.

Edit the RVF file located at PATH

Default location of enabled SEG modules.

Start processing events which start at TIMESTAMP in seconds since the UNIX epoch. If not present, the globus-scheduler-event-generator will process events from the time it was started, and not look for historical events.

Write the event log to files in DIRECTORY, instead of printing them to standard output. Within DIRECTORY, logs will be named by the time when they were created in YYYYMMDD format.

Run the globus-scheduler-event-generator program in the background.

Write the process-id of globus-scheduler-event-generator to PIDFILE.

LRM-independent event log generated by globus-scheduler-event-generator

Display a help message to standard error and exit.

Display a one-line usage summary to standard error and exit.

Display the software version of globusrun to standard error and exit.

Display the software version of all modules used by globusrun (including DiRT information) to standard error and then exit.

Do a parse check on the job specification and print diagnostics. If a parse error occurs, globusrun exits with a non-zero exit code.

Disable handling of the SIGINT signal, so that the interrupt character (typically ) causes globusrun to terminate without canceling the job.

Submit the request to the resource specified by RESOURCE_CONTACT. A resource may be specified in the following ways:

Print the software version being run by the service running at RESOURCE_CONTACT.

Kill the job named by JOB_ID

Delegate a full impersonation proxy to the service. By default, a limited proxy is delegated when needed.

Delegate a new proxy to the service processing JOB_ID.

Display the current status of the job named by JOB_ID.

Do not display job state change or exit code information.

Start a GASS server within the globusrun application that allows access to its standard output and standard error streams only. Also, augment the RSL_SPECIFICATION with a definition of the GLOBUSRUN_GASS_URL RSL substitution and add stdout and stderr clauses which redirect the output and error streams of the job to the output and error streams of the interactive globusrun command. If this is specified, then globusrun acts as though the -q were also specified.

Start a GASS server within the globusrun application that allows access to its standard output and standard error streams for writing and any file local the the globusrun invocation for reading. Also, augment the RSL_SPECIFICATION with a definition of the GLOBUSRUN_GASS_URL RSL substitution and add stdout and stderr clauses which redirect the output and error streams of the job to the output and error streams of the interactive globusrun command. If this is specified, then globusrun acts as though the -q were also specified.

Start a GASS server within the globusrun application that allows access to its standard output and standard error streams for writing and any file local the the globusrun invocation for reading or writing. Also, augment the RSL_SPECIFICATION with a definition of the GLOBUSRUN_GASS_URL RSL substitution and add stdout and stderr clauses which redirect the output and error streams of the job to the output and error streams of the interactive globusrun command. If this is specified, then globusrun acts as though the -q were also specified.

Terminate after submitting the job to the GRAM service. The globusrun program will exit after the job hits any of the following states: PENDING, ACTIVE, FAILED, or DONE. The GASS-related options can be used to stage input files, but standard output, standard error, and file staging after the job completes will not be processed.

Terminate after submitting the job to the GRAM service. The globusrun program will exit after it receives a reply from the service. The JOB_ID will be displayed to standard output before terminating so that the job can be checked with the -status command-line option or modified by the -refresh-proxy or -kill command-line options.

Submit the job with the dryrun attribute set to true. When this is done, the job manager will prepare to start the job but start short of submitting it to the service. This can be used to detect problems with the RSL_SPECIFICATION.

Path to proxy credential.

Path to trusted certificate directory.

Display the command-line options to grid-ca-create and exit.

Display the version number of the grid-ca-create command. The second form includes more details.

Overwite existing CA in the destination directory if one exists

Run in non-interactive mode. This will choose defaults for parameters or those specified on the command line without prompting. This option also implies -force.

Create the CA in DIRECTORY. The DIRECTORY must not exist prior to running grid-ca-create.

Use SUBJECT as the subject name of the self-signed CA to create. If this is not specified on the command-line, grid-ca-create will default to using the subject name cn=Globus Simple CA, ou=$HOSTNAME.

Use ADDRESS as the email address of the CA. The default instructions generated by grid-ca-create tell users to mail the certificate request to this address. If this is not specified on the command-line, grid-ca-create will default to the $LOGNAME@$HOSTNAME

Set the default lifetime of the self-signed CA certificate to DAYS. If not set, the grid-ca-create program will default to 1825 days (5 years).

Use the string PASSWORD to protect the CA’s private key. This is useful for automating Simple CA, but may make it easier to compromise the CA if someone obtains a shell on the machine storing the CA’s private key.

Disable building a source tarball for distributing the CA’s public information to other machines. The source tarball can be created later by using the grid-ca-package command.

Create a binary GPT package containing the new CA’s public information. The package will be created in the current working directory. This package can be deployed by with the gpt-install tool.

Create a binary GPT package containing the new CA’s public information that is backward-compatible with GPT 3.2. Packages created in this manner will work with Globus Toolkit 2.0.0-5.0.x.

Non-standard installation path of the Grid Community Toolkit.

Display the command-line options to grid-ca-package and exit.

Display the version number of the grid-ca-package command. The second form includes more details.

Use the CA whose name matches the hash string CA. When invoked with this option, grid-ca-package runs non-interactively.

Use the SimpleCA located in SIMPLECADIR When invoked with this option, grid-ca-package runs non-interactively.

Create a GPT binary package in addition to the RPM script tarball. This package may be installed on other systems using the gpt-install program.

Create a GPT binary package with GPT metadata located in the path expected by GPT 3.2 (used in Globus 2.0.0-5.0.x) instead of ${datadir}/globus/packages as used in Globus 5.2.x. This option overrides the as used in Globus 5.2.x. This option overrides the -g command-line option.

Create a binary RPM package for the CA. This option currently only works on RPM-based distributions.

Create a binary Debian package for the CA. This option currently only works on Debian-based distributions.

Non-standard installation path of the Grid Community Toolkit.

Display the command-line options to grid-ca-sign and exit.

Display the version number of the grid-ca-sign command. The second form includes details about the package containing grid-ca-sign.

Sign the request contained in the REQUEST file.

Write the signed request to the CERTIFICATE file.

Revoke any previously issued certificate with the same subject name as in the certificate request and issue a new certificate. Otherwise, grid-ca-sign will refuse to sign the request.

Sign the certificate using the Simple CA certificate and configuration located in DIRECTORY instead of the default.

Print the command-line options available for the openssl ca command.

Non-standard installation path of the Grid Community Toolkit.