How to manage the application using the command line

Using the command line, you can install, remove, start, and stop the Kaspersky application on the device, and also manage the application locally.

The functional components of the application are supported by Kaspersky local tasks that run in the operating system. You can enable or disable functional components of the application on a device by starting or stopping Kaspersky tasks on the command line. One-time device scans are also performed by starting Kaspersky tasks. You can configure the functional components on the device and specify device scan settings by editing Kaspersky task settings.

In addition to the task settings, the following settings are provided for configuring the application:

• Encrypted connections scan settings.
• General application settings that define the operation of the application as a whole and the operation of individual functions.

You can manage the Kaspersky application on the command line using management commands.

How to enable autocomplete of the kfl-control command (bash completion)

You can enable autocompletion for the kfl-control command in bash.

To enable autocompletion of kfl-control commands in the current bash session, run the following command:

source /opt/kaspersky/kfl/shared/bash_completion.sh

To enable autocomplete for all new bash sessions, run the following command:

echo "source /opt/kaspersky/kfl/shared/bash_completion.sh" >> ~/.bashrc

How to manage tasks using the command line

The following application tasks are provided for managing the Kaspersky application on the command line:

• File Threat Protection. This task allows you to enable or disable File Threat Protection in real time and defines the settings for the File Threat Protection component. The task starts automatically when the application starts.
• Malware Scan. This task allows you to scan file system objects for malware on demand and defines the settings for the scan. You can use this task to perform a full or custom scan of the device.
• Critical Areas Scan. This task allows you to run a critical areas scan of the operating system on demand and defines the settings for the scan.
• Custom file scan. This task is designed for configuring and storing settings that are used when scanning the specified files and directories using the kfl-control --scan-file command. As a result of the command execution, the application creates and starts a temporary file scan task.
• Removable Drives Scan. This task allows you to monitor the connection of removable media to the device in real time and defines the settings of the Removable Drives Scan and the scan of its boot sectors for malware.
• Web Threat Protection. This task allows you to enable or disable Web Threat Protection and defines the settings for the Web Threat Protection component.
• Behavior Detection. This task allows you to monitor malicious activity of applications in the operating system. The task starts automatically when the Kaspersky application starts.
• Licensing. This task provides the capability to activate an application installed on the device. The task starts automatically when the application starts, and it resides in the device operating memory. The task has no settings; license keys are managed using special management commands. The task cannot be started, stopped, or deleted.
• Update. You can use this task to perform scheduled and on-demand application database and module updates and edit update settings.
• Rollback. You can use this task to roll back the last update of application databases and modules.

Each application task has a name used on the command line, an ID, and a type (see the table below).

IDs are unique for all tasks, including deleted tasks. The application does not reuse the identifiers of the deleted tasks. The identifier of a new task is the next successive number to the identifier of the latest created task.

Task names are not case-sensitive.

During installation of the application, predefined tasks are created. These tasks cannot be deleted. Each predefined task has a name and ID.

Tasks that you create while working with the application are called user tasks. When you create the task, you specify the name for it. IDs for user tasks are defined and assigned by the application when the task is created. IDs for user tasks are starting from 100.

During operation, the application creates temporary scan tasks. Temporary task names and IDs are assigned by the application. Temporary tasks are automatically deleted when completed.

Application tasks

You can perform the following actions with tasks:

• Start and stop all preset and custom tasks except tasks of the License type.
• Pause and resume ODS tasks.
• Create and delete user tasks. You can create tasks of the following types: ODS, Update, Rollback.
• Change the settings for all user tasks and all predefined tasks, except for Rollback and License tasks.
• Configure the task start schedule.

How to view the list of tasks on the command line

To view the list of application tasks, execute the following command:

kfl-control --get-task-list [--json]

where:

--json – output format for the list of application tasks. If a file format is not specified, the output will be an INI file.

The list of Kaspersky tasks is displayed.

The following information will be displayed for each task:

• Name: the task name
• ID: the task ID
• Type: the task type
• State: the current state of the task

How to view the status of a task on the command line

To view a task state, execute the following command:

kesl-control --get-task-state <task ID/name> [--json]

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• --json is specified to output the settings in JSON format.

Application tasks can take the following main states:

• Started—Task is running.
• Starting—Task is being launched.
• Stopped—Task has been stopped.
• Stopping—Task is stopping.

ODS tasks can also have one of the following states:

• Pausing — Task is pausing.
• Suspended — Task is suspended.
• Resuming — Task is resuming.

Page top

How to create a task on the command line

You can create tasks of the following types: ODS, Update, and Rollback.

You can create tasks with default settings or with settings specified in a configuration file.

To create a task with default settings, execute the following command:

kfl-control --create-task <task name> --type <task type>

where:

• <task name> is the name that you specify for the new task.
• <task type> is the identifier for the type of the created task.

To create a task with the settings specified in the configuration file, execute the following command:

kfl-control --create-task <task name> --type <task type> --file <configuration file path> [--json]

where:

• <task name> is the name that you specify for the new task.
• <task type> is the identifier for the type of the created task.
• <path to file> is the full path to the configuration file with the settings that will be used for creating the task.
• --json is specified to import the settings from the configuration file in JSON format. If the --json option is not specified, the application attempts to import from an INI file. If the import fails, an error is displayed.

Page top

How to start, stop, pause, and resume a task on the command line

You can start and stop predefined and user tasks, except for tasks of the License type.

You can pause and resume ODS tasks.

To start a task, execute the following command:

kfl-control --start-task <task ID/name> [-W] [--progress]

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• [-W] is a command used in conjunction with the task start command to enable the display of current events associated with this task.
• Specify the [--progress] option if you want to display the progress of the task.

  Example: Start the task with ID 1 and enable the display of current events associated with the task: kfl-control --start-task 1 -W

To stop a task, execute the following command:

kfl-control --stop-task <task ID/name> [-W]

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• [-W] is a command used in conjunction with the stop task command to enable the display of current events associated with this task.

To suspend a task, execute the following command:

kfl-control --suspend-task <task ID/name>

To resume a task, execute the following command:

kfl-control --resume-task <task ID/name>

Page top

How to delete a task on the command line

You can delete only user tasks. Predefined tasks cannot be deleted.

To delete a task, execute the following command:

kfl-control --delete-task <task ID/name>

where <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.

How to output task settings to the console or into a configuration file

You can display the current values of settings for all user tasks and all predefined tasks, except for Rollback and License tasks (these tasks have no settings).

You can output the current values of task settings to the console or to a configuration file that you can use to change task settings.

To output the current values of task settings to the console, execute the following command:

kfl-control --get-settings <task ID/name> [--json]

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• --json is specified to output the settings in JSON format. If the --json option is not specified, the settings are output in the INI format.

To output the current values of task settings to a configuration file, execute the following command:

kfl-control --get-settings <task ID/name> --file <configuration file path> [--json]

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• --file <configuration file path> is the path to the configuration file into which the task settings will be written. If you specify the name of a file without its path, the file will be created in the current directory. If a file already exists in the specified path, it will be overwritten. If the specified directory does not exist, the configuration file will not be created.
• --json is specified to output the settings in JSON format. If the --json option is not specified, the settings are output in the INI format.

How to manage task settings on the command line

You can edit the settings for all user tasks and all predefined tasks, except for Rollback and License tasks.

On the command line, you can edit the settings of tasks using the kfl-control --set-settings command:

• You can edit all task settings using the configuration file that contains the task settings. You can get the configuration file using the command for displaying task settings.
• You can edit individual task settings on the command line in the <setting name>=<setting value> format. You can get the current values of task settings using the command for displaying task settings.
• You can restore the task settings to their default values.

You can add or remove scan scopes and exclusion scopes using a configuration file that contains task settings or command line options. Configuring scan scopes and exclusion scopes is available for tasks of the OAS and ODS types.

In order to optimize the operation of scan tasks, it is recommended to add the path with snapshots mounted by the system in the read-only mode to the exclusions for the systems with the btrfs file system and enabled active snapshots. For example, for the systems based on SUSE/OpenSUSE, you can add the following exclusion for the path: /.snapshots/*/snapshot/.

For some tasks, separate management commands are also provided that allow you to edit task settings.

How to modify task settings using a configuration file:

To edit values of task settings using a configuration file:

1. Output the task settings to the configuration file: kfl-control --get-settings
2. Open the configuration file and edit the values of the necessary settings.

   For tasks whose type is OAS or ODS, you can add or remove scan scopes and exclusion scopes.

   If you want to add a scan scope, add a [ScanScope.item_#] section with the following settings to the file:

   • AreaDesc is a description of the scan scope, which contains additional information about this scope.
   • UseScanArea enables scanning of the specified scope.
   • Path is a path to the directory with the objects to be scanned. You can specify a path to a local directory or enable scanning of remote directories mounted on a client device.
   • AreaMask.item_# is a limitation of the scan scope. You can specify a mask for the name of the files to be scanned. Scanning is enabled by default for all objects in the scan scope. You can specify multiple AreaMask.item_# items.

   If you want to add an exclusion scope, add an [ExcludedFromScanScope.item_#] section with the following settings to the file:

   • AreaDesc – a description of the exclusion scope, which contains additional information about the exclusion scope.
   • UseScanArea enables exclusion of the specified scope.
   • Path is a path to the directory with the objects to be excluded. You can specify a path to a local directory or exclude remote directories mounted on a client device. Possible values for the setting depend on the type of task.
   • AreaMask.item_# is a limitation of the exclusion scope. You can specify a mask for the name of the files that you want to exclude from the scan scope. By default, all objects in the scope are excluded.

     Example: [ExcludedFromScanScope.item_0000] AreaDesc= UseScanArea=Yes Path=/tmp/notchecked AreaMask.item_0000=*

   You can specify multiple [ScanScope.item_#] and [ExcludedFromScanScope.item_#] sections. The application processes the scopes by index in ascending order.

3. Save the configuration file.
4. Execute the command:

   kfl-control --set-settings <task ID/name> --file <configuration file path> [--json]

   where:

   • <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
   • --file <configuration file path> is the full path to the configuration file from which the task settings will be imported.
   • Specify the --json option if you are importing settings from a JSON configuration file. If the --json option is not specified, the application attempts to import from an INI file. If the import fails, an error is displayed.

All values of task settings defined in the file will be imported into the application.

How to modify task settings using command line options:

You can use the kfl-control --set-settings command to modify individual task settings, as well as add or remove scan scopes and exclusion scopes for tasks of the following types: OAS and ODS.

Configuring individual task settings

To modify individual values of task settings using command line options, run the following command:

kfl-control --set-settings <task ID/name> <setting name>=<setting value> [<setting name>=<setting value>]

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• <setting name>=<setting value> is the name and value of one of the task settings. You can get the current values of task settings using the command for displaying task settings.

The values of the specified task settings will be changed.

Adding and removing a scan scope

To add a scan scope using command line options, run the following command:

kfl-control --set-settings <task ID/name> --add-path <path>

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• --add-path <path> adds the path to the directory with the objects to be scanned.

A new [ScanScope.item_#] section will be added to the task settings. The application scans the objects in the directory specified by the Path setting. The remaining settings of the scan scope take default values.

If the task settings already contain a [ScanScope.item_#] section with the specified value for the Path setting, a duplicate section is not added.

If the UseScanArea setting is set to No its value will change to Yes after this command is executed and the objects located in this directory will be scanned.

To delete a scan scope using command line options, run the following command:

kfl-control --set-settings <task ID/name> --del-path <path>

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• --del-path <path> deletes the path to the directory with the objects to be scanned.

The [ScanScope.item_#] section that contains the specified path will be deleted from the task settings. The application will not scan the objects in the specified directory.

Adding and removing an exclusion scope

To add an exclusion scope using command line options, run the following command:

kfl-control --set-settings <task ID/name> --add-exclusion <path>

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• --add-exclusion <path> adds the path to the directory with the objects that you want to exclude from the scan.

A new [ExcludedFromScanScope.item_#] section will be added to the task settings. The application will exclude objects in the directory specified by the Path setting from scans. The remaining settings of the exclusion scope take default values.

If the task settings already contain an [ExcludedFromScanScope.item_#] section with the specified value for the Path setting, a duplicate section is not added.

If the UseScanArea setting is set to No its value will change to Yes after this command is executed and the objects located in this directory will be excluded from scans.

To delete an exclusion scope using command line options, run the following command:

kfl-control --set-settings <task ID/name> --del-exclusion <path>

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• --del-exclusion <path> deletes the path to the directory with the objects to be excluded.

The [ExcludedFromScanScope.item_#] section that contains the specified path will be deleted from the task settings. The application will not exclude the objects in the specified directory from the scan.

How to restore default task settings on the command line

You can restore the default settings for all user tasks and all predefined tasks, except for tasks of the Rollback and License types (these tasks have no settings).

To reset task settings to their default values, execute the following command:

kfl-control --set-settings <task ID/name> --set-to-default

where <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.

The application changes the setting values to their defaults.

Page top

How to configure the task schedule on the command line

You can configure a schedule for the following types of tasks: ODS, Update, and Rollback.

You can output the current values of the settings for the task run schedule to the console or to a configuration file.

To output the current settings for the task run schedule to the console, execute the following command:

kfl-control --get-schedule <task ID/name> [--json]

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• --json is specified to output the settings in JSON format. If the --json option is not specified, the settings are output in the INI format.

To output the current settings for the task run schedule to a configuration file, execute the following command:

kfl-control --get-schedule <task ID/name> --file <configuration file path> [--json]

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• --file <path to configuration file> is the path to the configuration file in which the settings for the task run schedule will be output. If you specify the name of a file without its path, the file will be created in the current directory. If a file already exists in the specified path, it will be overwritten. If the specified directory does not exist, the configuration file will not be created.
• --json is specified to output the settings in JSON format. If the --json option is not specified, the settings are output in the INI format.

  Examples: Save the update task settings to a file named update_schedule.ini and save the created file in the current directory: kfl-control --get-schedule 6 --file update_schedule.ini Display the update task schedule in the console: kfl-control --get-schedule 6

You can edit the settings for the task run schedule in the following ways:

• Import the settings from a configuration file that contains all schedule settings.
• Using the command line, specify the individual settings for the task run schedule in the format <setting name >=<setting value >.

To edit the values of the settings for task run schedule using a configuration file, perform the following actions:

1. Output the task settings to the configuration file: kfl-control --get-schedule
2. Edit the values of the necessary settings in the file and save the changes.
3. Execute the command:

   kfl-control --set-schedule <task ID/name> --file <configuration file path> [--json]

   where:

   <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.

   --file <configuration file path> is the full path to the configuration file from which the task schedule settings will be imported.

   --json: specify this option if you are importing settings from a configuration file in JSON format. If the --json option is not specified, the application attempts to import from an INI file. If the import fails, an error is displayed.

All values of the settings for the task run schedule defined in the file will be imported into the application.

To edit the individual values of the settings for the task run schedule using the command line, execute the following command:

kfl-control --set-schedule <task ID/name> <setting name>=<setting value> [<setting name>=<setting value>]

where:

• <task ID/name> is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
• <setting name>=<setting value> is the name and value of one of the settings for the task schedule.

The values of the specified settings for the task run schedule are modified.

Page top

How to manage general application settings on the command line

General application settings define the operation of the application as a whole and the operation of individual functions.

You can manage general application settings using special management commands:

• Output the current values of general application settings to the console or to a configuration file.
• Edit general application settings using a configuration file containing all general settings, or using command line options in the <setting name>=<setting value> format.

Using general settings, you can:

• Configure Kaspersky Security Network for the application.
• Configure the use of a proxy server in the application.
• Select the file operation interception mode (block/do not block files during a scan).
• Configure exclusions from the mount points scan (global exclusions).
• Configure exclusions from the process memory scan.
• Enable or disable the detection of legitimate applications that intruders can use to compromise devices or data.
• Configure the use of event logs.
• Configure a limit on CPU resource usage by scan tasks (of the ODS type).
• Limit the number of user scan tasks that a non-privileged user can start simultaneously.
• Configure Backup settings.

How to output general application settings to the console or into a configuration file

You can output the current values of general application settings to the console or to a configuration file that you can use to edit task settings.

To output the current values of general application settings to the console, execute the following command:

kfl-control --get-app-settings [--json]

where --json is specified to output the settings in JSON format. If the --json option is not specified, the settings are output in the INI format.

To output the current values of general application settings to a configuration file, execute the following command:

kfl-control --get-app-settings --file <configuration file path> [--json]

where:

• --file <configuration file path> is the path to the configuration file into which general settings of the application will be written. If you specify the name of a file without its path, the file will be created in the current directory. If a file already exists in the specified path, it will be overwritten. If the specified directory does not exist, the configuration file will not be created.
• --json is specified to output the settings in JSON format. If the --json option is not specified, the settings are output in the INI format.

  Example: Display the general application settings to a file named kfl_config.ini. Save the created file in the current directory: kfl-control --get-app-settings --file kfl_config.ini

Page top

How to modify general application settings on the command line

On the command line, you can edit the general application settings by using the kfl-control --set-app-settings command:

• You can edit all general settings using the configuration file that contains the general application settings. You can get the configuration file using the command for displaying general settings.
• You can edit individual settings using command line options in the <setting name>=<setting value> format. You can get the current values of general application settings using the command for displaying general settings.

To edit values of general application settings using a configuration file:

1. Output the general application settings to a configuration file.
2. Edit the values of the necessary parameters in the file and save the changes.
3. Execute the command:

   kfl-control --set-app-settings --file <configuration file path> [--json]

   where:

   • --file <path to configuration file> is the full path to the configuration file with the general application settings. If you delete any parameter in the configuration file, the default value for that parameter will be displayed after the command is executed.
   • --json: specify this option if you are importing settings from a configuration file in JSON format. If the --json option is not specified, the application attempts to import from an INI file. If the import fails, an error is displayed.

All the values of the general settings defined in the file will be imported into the application.

To edit general application settings using command line options, execute the following command:

kfl-control --set-app-settings <setting name>=<setting value> [<setting name>=<setting value>]

where <setting name>=<setting value> is the name and value of one of the general application settings.

The values of the specified general settings will be changed.

Page top

How to filter query results on the command line

You can use a filter to restrict the query results when running application control commands.

Filter conditions are specified using one or more logical expressions, which are combined using the logical operator and. Filter conditions must be enclosed in quotation marks:

"<field> <comparison operator> '<value>'"

"<field> <comparison operator> '<value>' and <field> <comparison operator> '<value>'"

where:

• <field> is the name of the field for the database.
• <comparison operator> is one of the following comparison operators:
  • > is "greater than"
  • < is "less than"
  • like matches the specified value When specifying a value, you can use % masks: for example, the logical expression "FileName like '%etc%'" sets the limitation "contains the text "etc" in the FileName field"
  • == is "equal to"
  • != is "not equal to"
  • >= is "greater than or equal to"
  • <= is "less than or equal to"
• <value> is the value of the field. The value must be enclosed in single quotation marks (').

  You can specify a date value in UNIX time (the number of seconds that have elapsed since 00:00:00 (UTC), January 1, 1970) or in YYYY-MM-DD hh:mm:ss format. The user specifies the date and time in the user's local time zone, and the application displays them in the same time zone.

You can use a filter in the following application management commands:

• Display information about certain current events of the application:

  kfl-control -W --query "<filter conditions>"

• Display information about certain application events in the event log:

  kfl-control -E --query "<filter conditions>"

• Output information about certain objects in Backup:

  kfl-control -B --query "<filter conditions>"

• Delete certain objects from Backup:

  kfl-control -B --mass-remove --query "<filter conditions>"

  Examples: Get information about events that contain the text "etc" in the FileName field: kfl-control -E --query "FileName like '%etc%'" Display information about events with the ThreatDetected type: kfl-control -E --query "EventType == 'ThreatDetected'" Display information about events with the ThreatDetected type, created by tasks of the ODS type: kfl-control -E --query "EventType == 'ThreatDetected' and TaskType == 'ODS'" Get information about the events generated after the date specified in the UNIX time stamp system (the number of seconds that have elapsed since 00:00:00 (UTC), 1 January 1970): kfl-control -E --query "Date > '1583425000'" Get information about the events generated after the date specified in YYYY-MM-DD hh:mm:ss format: kfl-control -E --query "Date > '2022-12-22 18:52:45'" Get information about files in the Backup storage that have the High severity level: kfl-control -B --query "DangerLevel == 'High'"

Page top

How to export and import application settings on the command line

The Kaspersky application allows exporting and importing all application settings for troubleshooting, checking settings, or reusing settings on devices of other users. When exporting settings, all application settings (including encrypted connections scan settings, general application settings, and task settings) are saved in a configuration file. You can use this configuration file to import settings into the application.

The application must be launched when settings are imported or exported. After the settings are imported, the application must be restarted.

To export the application settings, execute the following command:

kfl-control --export-settings --file <configuration file path> [--json]

where:

• --file <configuration file path> is the full path to the configuration file where the application settings will be saved.
• --json is specified to export the settings to the configuration file in JSON format. If the --json options is not specified, the settings will be exported to an INI file.

To import the application settings from the file, execute the following command:

kfl-control --import-settings --file <configuration file path> [--json]

where:

• --file <configuration file path> is the full path to the configuration file from which you want to import settings into the application.
• --json is specified to import the settings from the configuration file in JSON format. If the --json option is not specified, the application attempts to import from an INI file. If the import fails, an error is displayed.

When you import application settings from a file, UseKSN is set to Yes.

After application settings are imported, internal task IDs may change. It is recommended to use task names to manage tasks.

Page top

How to manage user roles

Access to the functionality of the Kaspersky application on the command line depends on the user's role.

A role is a set of rights and privileges for managing the application.

Three user groups are created in the operating system: kfladmin, kfluser, and nokfl. When you assign an application role to a system user, the user is added to the corresponding group (see the Roles table below). When you revoke a role from a user, this user is removed from the corresponding group.

If no application role is assigned to a system user, that user belongs to a separate group of users without rights.

Thus, the roles correspond to the three groups of operating system users:

• kfladmin corresponds to the Administrator role.
• kfluser corresponds to the User role.
• nokfl is assigned to a user if no other roles are assigned. In this case, the user belongs to a separate group of users without privileges

  User roles

  Role name	Role in application	OS user group	Permissions
  Administrator	admin	kfladmin	Managing application settings and task settings in the graphical interface of the application and on the command line without using the sudo command. Manage application licensing. Assigning roles to users. Revoking user roles (the administrator has no right to revoke the admin role from himself). View and manage users' Storages.
  User	user	kfluser	Manage only user file scan tasks. Start and stop Update tasks. View reports for the tasks created by this user. View specific events that are common for all application users.
  —	—	nokfl	No role is assigned in the application, no permissions.

How to view the list of users and roles on the command line

To view a list of users and their roles, run the following command on the command line:

kfl-control [-U] --get-user-list

How to assign a role to a user on the command line

To assign a role to a specific user, execute the following command:

kfl-control [-U] --grant-role <role> <user>

Page top

How to revoke a role from a user on the command line

To revoke a role from a specific user, execute the following command:

kfl-control [-U] --revoke-role <role> <user>

Page top