Install the s1 CLI helper utility
The s1 tool is a command-line helper for the Docker Swarm that runs Netwrix Privilege Secure for Discovery. It shows service status, follows logs, opens a database shell, and wraps other maintenance tasks. The launcher at /usr/local/bin/s1 runs the matching s1tool container image from the Netwrix container registry, so the tool always matches your release.
Install the tool
The secureone.sh setup and secureone.sh upgrade commands install the matching s1 tool on the node where you run them. On a cluster, setup also installs the tool on each secondary node. See Deploy Privilege Secure for Discovery with Docker.
To install or change the version of the tool on its own, or to repeat an installation that didn't complete, run the following command from the directory that holds secureone.sh. The --version value must match the release that the deployment runs.
sudo -E bash secureone.sh install-cli --version <version>
For example, for release 26.09.1:
sudo -E bash secureone.sh install-cli --version 26.09.1
The command requires that setup has already created the /secureone directory on the node. It pulls the s1tool image, installs the launcher, and pins the version in /secureone/s1.env. The command then checks that the installed tool reports the version of its image. To run the same check again, use the verify command:
sudo -E bash secureone.sh verify --version <version>
On a cluster's secondary nodes, which have no docker-stack.yml file, add the --cli-only option to both commands.
Run the tool
Run s1 as the user that deploys the product, without sudo. The launcher calls sudo -E docker run itself, so the user needs sudo rights but doesn't type sudo. Don't run sudo s1: plain sudo resets HOME to /root, and the tool then looks for the AWS credentials and the Docker sign-in in the root user's home directory instead of yours. The tool authenticates to the registry with the AWS credentials in the ~/.aws directory of the user who runs it, so run aws configure as that same user. See Configure registry access.
The tool runs in the Docker Swarm. Run it on a node where docker node ls works. To display all commands and options, run:
s1 --help
Every command accepts the --help option. For example, s1 logs --help lists the log options.
Check services and nodes
Display the status of all services:
s1 status
To display the task history of one service, add its name:
s1 status api
Display the Docker nodes in the swarm:
s1 nodes
Display the deployment mode, which is single-node or multi-node:
s1 check-deployment-mode
Display the active database service, the MongoDB version, and the replica set status:
s1 database-status
Read logs
The s1 logs command follows the logs that the fluentd service collects. By default, it shows the last 30 seconds and keeps following new lines. Press Ctrl+C to stop. The command works only on a Swarm manager node, because it reads the service logs from the swarm.
| Option | Default | Effect |
|---|---|---|
--since <time> | 30s | Shows logs since a timestamp such as 2026-10-01T13:23:37 or a relative time such as 42m. |
--tail <lines> | all | Shows the given number of lines from the end of the logs. |
--no-follow | Off | Prints the logs and exits. |
For example, to print the last 200 lines from the past hour and exit:
s1 logs --since 1h --tail 200 --no-follow
Start, stop, and restart services
Replace <service> with a service name from s1 status, for example api.
| Command | Effect |
|---|---|
s1 restart <service> | Forces the service to restart. |
s1 stop <service> [<service> ...] | Scales one or more services to zero replicas. |
s1 start <service> [<service> ...] | Scales one or more services to one replica. The windows-bridge service starts six replicas. |
s1 shell <service> | Opens an interactive /bin/bash shell in a running service container. |
For example, to restart the API service:
s1 restart api
Open a database shell
The s1 db command opens a MongoDB shell on the active database service. To run a script, mount the JavaScript file in the database container under /data/db and pass it with the --file option.
s1 db
For the queries you can run and the differences between MongoDB versions, see Open the MongoDB shell.
Run other maintenance commands
The following commands cover less frequent tasks.
| Command | Effect |
|---|---|
s1 healthcheck-report | Runs the domain health check reports in the internal_api container. |
s1 set-password | Prompts for a new password and updates the stored password hash of the built-in secureone administrator account. The password must have at least 15 characters. |
s1 migrate status, s1 migrate apply, s1 migrate revert | Show, apply, or revert database schema migrations. The --to <number> option limits apply and revert. |
s1 mongo-upgrade check, run, status, cutover, finish-cutover, retire | Move the database from MongoDB 4.0 to 8.0. Follow Migrate from MongoDB 4.0 to 8.0 instead of running these commands on their own. |
s1 deploy | Deploys the stack from /secureone/docker-stack.yml. It has built-in guards. Run it only when the output of secureone.sh or Netwrix Support tells you to. |
s1 undeploy | Removes the stack. Run it only when Netwrix Support directs you to. |
s1 pull <service> --version <version> | Pulls the image of one or more services. Without --version, the command pulls the latest tag. Run it only when Netwrix Support directs you to. |
s1 docker-daemon-check, docker-daemon-validate, docker-daemon-configure | Check or set the Docker daemon limits that the windows-bridge-proxy service needs in /etc/docker/daemon.json. The configure command accepts --dry-run. Run it without sudo, like every other s1 command, because the tool container runs as root. Run these commands only when Netwrix Support directs you to. |
Use secureone.sh for deployment and upgrade. Before s1 deploy runs, it checks the database state and the Docker daemon limits. If the limits are too low, the command raises them in /etc/docker/daemon.json, deploys anyway, and prints sudo systemctl restart docker. Restart Docker to apply the change.
Update the tool
To change the tool to another release, run secureone.sh install-cli --version <version> as described in Install the tool. The s1 --upgrade option only pulls the image pinned in /secureone/s1.env again and replaces the launcher. It pulls with sudo, which reads the registry credential of the root user.
Troubleshoot the installation
The image pull is denied
If the installation fails with Could not pull followed by an image name, or Docker reports pull access denied ... repository does not exist or may require 'docker login', the node has no sign-in to the Netwrix container registry, or the registry doesn't hold that release. Sign in as the same user that runs the script, with sudo -E so that Docker saves the sign-in in your home directory. Then run the installation again:
aws ecr get-login-password --region us-west-2 \
| sudo -E docker login --username AWS --password-stdin 176947481038.dkr.ecr.us-west-2.amazonaws.com
For the AWS credentials and more information, see Configure registry access.
The registry isn't reachable
If a firewall blocks the node from the registry, allow the hosts in Proxy and firewall allowlist, and then run the installation again.
The tool reports an error about the swarm
The tool calls docker node ls at startup. If the node isn't part of a swarm or isn't a manager node, the command fails. Run s1 on a node that the swarm manages. See Inspect and troubleshoot the deployment.