Alert, Audit, and Report Commands

These commands answer three questions from a script: what is wrong now (cdr alert list), who did what (cdr audit list), and how backups have gone over a period (cdr report show). With --json, each gives you a record you can keep, and cdr report show --json is a machine-readable copy of the backup report. To save the audit trail as a file, use cdr audit export. cdr alert notify status and cdr alert notify test check the alert email.

For how to run cdr and the global options, see Command-Line Reference.

alert list

Lists the raised alerts, each with its severity, area, and the number of objects it is about. The command exits with code 4 when any alert is raised and 0 when none is, so you can run it from a scheduled task or a monitoring system as a probe. It exits with code 2, not 0, when the Manager cannot be reached, so an outage is never reported as all clear.

Alerts have no acknowledge or snooze. To stop an alert for an object you have deliberately put out of scope, add an exclusion (see Configuration and Exclusion Commands).

Requirements: The dashboard.view capability (every role).

Syntax

cdr alert list [options]

Options

Option	Description
-s, --severity <CODE>	Only alerts at this severity: critical, warning, info, or unknown.
-o, --origin <CODE>	Only alerts from this area: protection, topology, storage, security, or recovery.
--critical	Only critical alerts. Shorthand for --severity critical; give one or the other.
--subjects	Show the named objects under each alert, rather than only the count.
--sources	List the alert catalog instead of the raised alerts: every alert source, with its severity and area. Cannot be combined with --subjects.

Examples

cdr alert list --critical --subjects
cdr alert list --json > alerts.json

As a probe in a batch file:

cdr alert list --critical --manager https://10.0.0.10:5210
if %ERRORLEVEL% EQU 4 echo Critical alerts are raised

For what each alert means and what to do about it, see Alerts Reference.

alert notify status

Shows whether alerts are emailed and whether that is working: the recipients, whether the mail server is configured, the minimum severity, the check and reminder intervals, the last and next check, how many objects are raised at or above the minimum severity, and the last email with its counts or the reason it was not sent. The last check is the last one since the Manager started. When no recipients are set, the command says that alert email is off. Until the first check after the Manager starts, a few minutes after the service starts, and before any email has been sent, it says that alert email is not proven yet; cdr alert notify test checks it at once.

The command exits with code 4 when alert email is on and not working: the mail server is not configured, the last check failed, or the last email was not sent. Raised alerts are then held and sent once it works. Run it from a monitoring system to watch the alert email itself. It exits with code 0 when email is working or off.

To change the settings, use cdr config set with the keys CygnaDR:AlertEmail:Recipients, CygnaDR:AlertEmail:CheckMinutes, CygnaDR:AlertEmail:ReminderHours, and CygnaDR:AlertEmail:MinimumSeverity, or the Alert notifications settings on the Configuration screen. See Settings Reference.

Requirements: The dashboard.view capability (every role).

Syntax

cdr alert notify status [options]

The command takes only the global options, such as --json, which prints the status as the Manager returned it.

Examples

cdr alert notify status
cdr config set CygnaDR:AlertEmail:Recipients "ops@example.com, ad-team@example.com"

alert notify test

Sends the alert recipients a test email in the real format, marked [Test], listing what is raised now. It does not change what the next check reports. The Manager sends one test email at a time and at most one every 30 seconds, and records each one in the audit trail as Test alert email requested with the operator who asked.

Requirements: The config.manage capability (System Admin).

Syntax

cdr alert notify test [options]

The command takes only the global options.

Exit codes: 0 when the email was sent; 3 when it was not sent, with the reason (for example, no recipients are set, the mail server refused it, or a test email was sent less than 30 seconds ago), or when the Manager refused the request.

For the same status and test on the Alerts screen, see Alerts.

audit list

Lists audit trail rows, newest first: when, the actor, the action code, and the subject. The Manager applies the filters, so the rows are the newest that match across the whole audit trail, not a filtered view of the newest few. The Manager returns at most the 200 newest matching rows, and the command says how many matched in total; narrow the filter or the time window to see older rows.

The actor is the username of the operator who acted, or system, manager, or storage-agent for actions the product took itself.

Requirements: The audit.view capability (every role).

Syntax

cdr audit list [options]

Options

Option	Description
-a, --actor <NAME>	Only rows recorded against this actor: an operator's username, or system, manager, or storage-agent.
-A, --action <CODE>	Only rows with this action code, for example backup.job.completed or policy.updated.
-S, --subject <TEXT>	Only rows about this subject—usually a machine or object name.
--from <TIMESTAMP>	Only rows at or after this UTC time, as yyyy-MM-dd or a full timestamp.
--to <TIMESTAMP>	Only rows at or before this UTC time.
--detail	Add each row's recorded detail, exactly as stored.
--actors	List the distinct actors and action codes in the whole audit trail, instead of the rows. Cannot be combined with any filter, including --from and --to.

Examples

cdr audit list --subject dc01.corp.example.com --detail
cdr audit list --actor jsmith --from 2026-10-01 --to 2026-10-07
cdr audit list --actors
cdr audit list --from 2026-09-01 --to 2026-09-30 --json > audit-2026-09.json

For the action codes and how to review operator activity, see Auditing Operator Activity.

audit export

Saves every audit trail row that matches the filters as a CSV, JSON, HTML, or PDF file: the same export as Export on the Audit Trail screen. Unlike cdr audit list, it is not limited to the 200 newest rows. CSV and JSON hold up to 100,000 rows, and HTML and PDF up to 5,000. When more rows match, the Manager refuses the export with the reason rather than cutting it short; narrow the dates or the filter.

The file holds action and actor codes, where the console's export adds its wording beside them, and times in UTC and in the time zone of the machine cdr runs on. In a CSV file, a value that starts with =, +, -, @, a tab, or a carriage return gets a leading apostrophe, so a spreadsheet does not run it as a formula. The Manager makes the PDF with its own renderer; cdr waits for it however short --timeout is.

Unless --output names a file, the file takes the Manager's name for it, cygnadr-audit-<yyyyMMdd-HHmmss>.<format>. The Manager records each export in the audit trail as audit.exported, with that file name as the subject, before the data leaves. cdr never overwrites an existing file.

Requirements: The audit.view capability (every role).

Syntax

cdr audit export [options]

Options

Option	Description
-f, --format <FORMAT>	csv (the default), json, html, or pdf.
-o, --output <PATH>	Where to save it: a file, or a folder to save it in under its own name. Default: the current folder.
-a, --actor <NAME>	Only rows recorded against this actor.
-A, --action <CODE>	Only rows with this action code, for example backup.job.completed.
-S, --subject <TEXT>	Only rows about this subject—usually a machine or object name.
--from <TIMESTAMP>	Only rows at or after this UTC time, as yyyy-MM-dd or a full timestamp.
--to <TIMESTAMP>	Only rows at or before this UTC time.
--search <TEXT>	Only rows whose actor, action code, subject, or UTC time contains this text, as the console's search box does.

With --json, cdr prints the saved path, the format, and the size in bytes instead of a sentence.

Examples

cdr audit export
cdr audit export --subject dc01.corp.example.com --format pdf
cdr audit export --from 2026-09-01 --to 2026-09-30 --format json -o C:\evidence\

Exit codes: 0 when the file was saved; 3 when the Manager refused the export, for example because more rows match than the format holds or the PDF could not be made; 6 when the file already exists, so nothing was overwritten; 1 for a usage error, such as an unknown format.

report show

Reports backup outcomes over a window: how many finished backups succeeded, failed, and were cancelled, grouped by the status and error codes the Manager stored rather than by message text. Only finished jobs are counted. The window includes both ends; by default it is the last 30 days, and it can be at most 366 days.

The coverage tables added by --coverage show each domain and forest as they stand now, not as they were during the window. In the forest table, excluded domains and domain controllers are left out of the counts and shown as (n excluded). Both tables have a REBUILT ON RECOVERY column: domain controllers that are not backup targets, which a recovery rebuilds by promotion. They are not counted short of PROTECTED, except those a domain with too few backup targets needs backed up, which the NEED A POLICY column counts.

Requirements: The reports.view capability (every role).

Syntax

cdr report show [options]

Options

Option	Description
--from <TIMESTAMP>	Start of the window, inclusive, as yyyy-MM-dd or a full UTC timestamp.
--to <TIMESTAMP>	End of the window, inclusive. Default: now.
--days <N>	A window ending now: the last N days, from 1 to 366. Default: 30. Cannot be combined with --from or --to.
--machines	Add the per-machine table.
--daily	Add the per-day table, with one row for every day of the window, including days when nothing ran.
--coverage	Add the per-domain and per-forest coverage snapshot as it stands now.

Examples

cdr report show --days 90 --machines
cdr report show --from 2026-09-01 --to 2026-09-30 --daily
cdr report show --coverage --json > backup-report.json

For the console report and its CSV export, see Protection Summary.