Redis operations pack

v0.3.19

Deep Redis ops — INFO + memory accounting, slowlog + per-event latency, command stats, client list/kill/pause, keyspace introspection (SCAN, TYPE, TTL, OBJECT encoding/refcount/idle/freq, MEMORY USAGE), config get/set/rewrite/resetstat, ACL list/whoami/getuser, cluster topology (info, nodes, slots, slot-count, check), cluster operators (failover, forget, replicaof), Sentinel HA topology (masters, master, replicas, sentinels, get-master-addr, ckquorum, is-master-down, Sentinel INFO) and operators (failover, reset), persistence (lastsave, bgsave, bgrewriteaof, memory purge/doctor), streams + pub/sub introspection, script cache flush, and tier-critical actions (flush_db, flushall, swapdb, shutdown_nosave). Sentinel actions target the Sentinel on port 26379; all others default to 127.0.0.1:6379. Authenticates via REDISCLI_AUTH / REDIS_* env vars on the runner host — never via per-call credentials.

47 allowed by default 7 need approval by default 5 denied by default

Pack ID

redis

Vendor

emisar

linux

Actions

Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.


              redis-cli

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host

sudo emisar pack install redis --hash sha256:2ac4dbfcb8f6cdf3269a6b7a75faec78c524b4b3ec6c8ee62df99be90954bbdd

Setup

redis-cli authenticates with the password in REDISCLI_AUTH on the runner host. Ordinary Redis actions target the local instance at 127.0.0.1:6379; Sentinel actions pass only -p 26379 and target the local Sentinel. No action reads a destination from the environment or accepts one as an argument.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

REDISCLI_AUTH

Password sent via AUTH. Omit for an instance with no requirepass/ACL. The matching user must hold the commands the actions you enable will run.

Notes

REDISCLI_AUTH must also be allowlisted in the runner's execution.inherit_env — the action env is scrubbed to PATH/LANG/LC_ALL/TERM by default, so an env present on the host but not allowlisted is silently dropped (the action falls back to its local default or fails auth).
Host and port are not configurable through this pack's env — ordinary actions use redis-cli's 127.0.0.1:6379 default, while Sentinel actions set only port 26379 and keep the same local host.
Sentinel must accept the same REDISCLI_AUTH password as the ordinary Redis service; every Sentinel action uses that shared runner credential on local port 26379.
REDISCLI_AUTH supplies only the password; for an ACL-enabled server with a non-default username, set requirepass-style access or run the runner as a user whose default ACL covers these commands.
Critical mutators (flush_db, flushall, swapdb, shutdown_nosave) and config writes need an ACL/user permitted to run them.

Verify it works

Runs redis.info, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host

sudo emisar pack verify redis

Install and configure a pack walks through the whole sequence on a host.

Actions 59 total

View on GitHub

redis.acl_getuser exec medium

ACL GETUSER

Get the full rule listing for one ACL user — categories, commands, key patterns, channel patterns, flags. Read-only.
View source on GitHub
redis.acl_list exec medium

ACL LIST

List all ACL users and their rules. Read-only. Use to audit access before changing a key namespace.
View source on GitHub
redis.acl_whoami exec low

ACL WHOAMI

Show the ACL username of the current connection. Use to verify the runner credential is the expected service principal.
View source on GitHub
redis.bgrewriteaof exec medium

BGREWRITEAOF

Rewrite the AOF file in the background, compacting it to the smallest equivalent command set. Reduces AOF size and recovery time. Brief fork. Concurrent BGSAVE will queue.
View source on GitHub
redis.bgsave exec medium

BGSAVE

Trigger a background RDB snapshot. The fork briefly doubles RSS (copy-on-write). Returns immediately — completion shows in INFO rdb_last_bgsave_status. Concurrent BGREWRITEAOF will queue.
View source on GitHub
redis.client_kill exec high

CLIENT KILL

Disconnect one client by addr or by id. Use to evict a stuck client with a runaway output buffer, an abandoned subscriber, or a client exceeding the slowlog. Confirm the target via `client_list` first — killing the wrong client can disrupt a critical caller.
View source on GitHub
redis.client_list exec low

CLIENT LIST

List every connected client with id, addr, name, age, idle, db, sub, psub, multi, qbuf, obl, oll, omem, cmd, fd. Use to find the client holding a long subscription, a runaway pipeline (large omem), or to identify candidate connections for CLIENT KILL.
View source on GitHub
redis.client_pause exec high

CLIENT PAUSE

Pause all clients for N milliseconds. Used during safe failover windows to drain in-flight writes before flipping a master. Long pauses block all traffic — anything over 1s is a real outage. Replicas keep streaming during the pause.
View source on GitHub
redis.cluster_check exec low

redis-cli --cluster check

Run `redis-cli --cluster check` from the local Redis entry point at 127.0.0.1:6379 — verifies slot coverage, master/replica health, and epoch consistency. Use after any topology change.
View source on GitHub
redis.cluster_countkeysinslot exec low

CLUSTER COUNTKEYSINSLOT

Count keys mapped to a single hash slot. Use when a slot appears hot in monitoring to size the blast radius of a migration or to verify a tagged keyspace is collocated.
View source on GitHub
redis.cluster_failover exec critical

CLUSTER FAILOVER

Promote the connected REPLICA to master. Default mode (empty) waits for replication parity — the only safe choice during a planned failover. FORCE skips parity (use only when master is suspected dead). TAKEOVER bypasses cluster consensus entirely (split-brain recovery). Run while connected to a REPLICA, not a master.
View source on GitHub
redis.cluster_forget exec high

CLUSTER FORGET

Remove a node from the connected node's cluster view for 60s. Used during node replacement. Run on every reachable node to fully evict the old member. Wrong target id produces a brief split view until gossip refreshes.
View source on GitHub
redis.cluster_info exec low

CLUSTER INFO

Show cluster status — state ok/fail, slots assigned/ok/pfail/fail, known nodes, size, epoch, my epoch, messages sent/received.
View source on GitHub
redis.cluster_nodes exec low

CLUSTER NODES

List the cluster nodes — id, addr, flags (master/replica/myself/fail), master id, last ping/pong, config epoch, link state, slot ranges. Use to see who owns which slot ranges and which replicas serve which masters.
View source on GitHub
redis.cluster_slots exec low

CLUSTER SLOTS

Show the slot-range → master/replica mapping. Use to confirm a given hash slot is owned by the expected shard and to see replica addresses for read traffic.
View source on GitHub
redis.command_stats exec low

INFO commandstats

Show per-command call count, total µs spent, and µs per call. Use to identify hot commands (e.g. an unexpectedly high KEYS rate or a SUBSCRIBE storm). Read-only.
View source on GitHub
redis.config_get exec medium

CONFIG GET

Read runtime config by glob pattern. Useful before any tuning conversation: confirm `maxmemory`, `maxmemory-policy`, `appendonly`, `save`, etc. Read-only. Pattern is restricted to safe globs against Redis config keys. Credential values are masked in the output — the key stays visible so you can see it is set.
View source on GitHub
redis.config_resetstat exec medium

CONFIG RESETSTAT

Reset INFO stats counters (commandstats, keyspace hits/misses, evictions, etc.). Does NOT change keyspace data, but it DOES mutate server state by zeroing the counters — so it is risk:medium (policy-gated), like the other non-keyspace mutators (memory_purge, script_flush). Use to start a fresh measurement window.
View source on GitHub
redis.config_rewrite exec medium

CONFIG REWRITE

Persist all runtime CONFIG SET changes back to the on-disk redis.conf. Without this, runtime overrides revert at restart.
View source on GitHub
redis.config_set exec high

CONFIG SET

Change one runtime tuning parameter. Effects are immediate and may include eviction policy, persistence mode, replication behavior. Combine with config_rewrite to persist. Only the tuning parameters listed on the `parameter` arg may be set: the ones that choose where Redis writes (`dir`, `dbfilename`, `appendfilename`, `logfile`) or hold a credential (`requirepass`, `masterauth`) are deliberately not settable, because together with a save they let this action write an attacker-chosen file anywhere the server can reach.
View source on GitHub
redis.dbsize exec low

DBSIZE

Count the keys in the currently selected database. O(1). Read-only. Use as a sanity check before running operations that scan the keyspace.
View source on GitHub
redis.flush_db exec critical

FLUSHDB (single database)

Delete every key in one logical database. Irreversible. Use only on caches and only when you know there is no replication consumer that treats an empty DB as a fault. ASYNC mode returns immediately and drops the data in a background thread; SYNC blocks until done. Never use against production user data — this exists for cache resets and dev environments.
View source on GitHub
redis.flushall exec critical

FLUSHALL

Delete EVERY key from EVERY database. Irreversible. Replicas FLUSHALL in turn. Only use on caches that can be cold-rebuilt.
View source on GitHub
redis.info exec low

Redis INFO section

Run `INFO <section>` and return the raw text. Sections: server, clients, memory, persistence, stats, replication, cpu, commandstats, latencystats, cluster, keyspace, errorstats, all. Read-only.
View source on GitHub
redis.lastsave exec low

LASTSAVE

Show the Unix timestamp of the last successful background save (RDB). Use to confirm the persistence schedule is firing.
View source on GitHub
redis.latency exec low

LATENCY LATEST + HISTORY

Run `LATENCY LATEST` to summarize per-event latency spikes (fork, AOF write, expire, eviction, command, etc.). Requires `latency-monitor-threshold` to be set non-zero in redis.conf; if it isn't, the output is empty and that is a configuration finding worth reporting. Read-only.
View source on GitHub
redis.latency_history exec low

LATENCY HISTORY

Show per-event latency time series (e.g. fork, aof-write, expire). Use after LATENCY LATEST to drill into one event class.
View source on GitHub
redis.memory_doctor exec low

MEMORY DOCTOR

Run the built-in memory advisor. Returns a human-readable summary of suspected issues (fragmentation, oversized clients, large peak vs current).
View source on GitHub
redis.memory_purge exec medium

MEMORY PURGE

Ask jemalloc to release unused memory back to the OS. Use after a large eviction or DEL spike when RSS hasn't dropped despite used_memory falling. Brief allocator pause possible.
View source on GitHub
redis.memory_stats exec low

MEMORY STATS

Run `MEMORY STATS`. Returns the detailed memory accounting (allocator stats, fragmentation, peak, overheads, replication backlog, client and AOF buffers). Read-only. Use to diagnose OOM warnings before resizing.
View source on GitHub
redis.memory_usage exec low

MEMORY USAGE key

Show bytes used by a single key (estimate, including value and internal overhead). Use to find a known big-value culprit before a deletion conversation.
View source on GitHub
redis.object_encoding exec low

OBJECT ENCODING key

Show the internal encoding of one value (ziplist, hashtable, intset, listpack, quicklist, embstr, raw, skiplist). Use to confirm a structure is in its compact form before tuning size limits.
View source on GitHub
redis.object_freq exec low

OBJECT FREQ key

Show the LFU access-frequency counter for the key. Requires an LFU maxmemory-policy. Use to compare access patterns across a candidate eviction set.
View source on GitHub
redis.object_idletime exec low

OBJECT IDLETIME key

Show seconds since the key was last accessed. Requires an LRU maxmemory-policy. Use to identify cold keys for manual eviction.
View source on GitHub
redis.object_refcount exec low

OBJECT REFCOUNT key

Show the reference count for a value. Shared integers report INT_MAX; every other value reports 1. Use to confirm the shared-integer optimization is hitting (or not).
View source on GitHub
redis.pubsub_channels exec low

PUBSUB CHANNELS

List active pub/sub channels matching the optional pattern. Useful to see which event streams a service is producing.
View source on GitHub
redis.pubsub_numsub exec low

PUBSUB NUMSUB

Count subscribers on a channel. Useful before tearing down a producer.
View source on GitHub
redis.randomkey exec low

RANDOMKEY

Get a random key from the current database (or nil if empty). Useful for sampling key shapes.
View source on GitHub
redis.replicaof exec critical

REPLICAOF

Reconfigure replication. REPLICAOF NO ONE promotes this node to master (used in unmanaged failover). REPLICAOF host port reassigns this node as a replica of host:port and triggers a full sync — the local dataset is REPLACED. Misuse can wipe live data.
View source on GitHub
redis.role exec low

ROLE

Report whether this Redis is master, replica, or sentinel. Master shows replication offset and connected replicas; replica shows master addr + sync state. Use before any write-path troubleshooting.
View source on GitHub
redis.scan exec low

SCAN cursor MATCH COUNT

Show one SCAN page. Returns next-cursor + up to COUNT keys matching MATCH. Safe for prod — never blocks. Use to enumerate a hot namespace without KEYS.
View source on GitHub
redis.script_flush exec medium

SCRIPT FLUSH

Drop all cached EVAL scripts (server-side Lua). Clients using EVAL repopulate naturally; clients using EVALSHA hit NOSCRIPT until they re-cache.
View source on GitHub
redis.sentinel_ckquorum exec low

SENTINEL CKQUORUM

Check whether enough Sentinels are reachable to BOTH reach the failover quorum AND form the majority needed to authorize a failover for the named master. The canonical pre-failover health check — returns OK with the counts, or an error if a failover could not currently proceed. Connects to the Sentinel on port 26379. Read-only.
View source on GitHub
redis.sentinel_failover exec high

SENTINEL FAILOVER

Force a failover for the named master as if it were unreachable, WITHOUT asking the other Sentinels for agreement (a new configuration is still published so the peers update). Promotes a replica to master and reconfigures the rest to follow it. This is a manual, operator-initiated failover — use for a planned switchover or to recover when automatic failover is stuck. Connects to the Sentinel on port 26379.
View source on GitHub
redis.sentinel_get_master_addr exec low

SENTINEL GET-MASTER-ADDR-BY-NAME

Show the ip and port Sentinel currently believes is the master for the named set. During or just after a failover this returns the PROMOTED replica's address — so it is the authoritative answer to "who is the master right now?" Compare against ROLE on each node to detect split-brain. Connects to the Sentinel on port 26379. Read-only.
View source on GitHub
redis.sentinel_info exec low

Sentinel INFO

Run INFO against the Sentinel process itself (port 26379) and return the raw text, including the `sentinel` section: sentinel_masters, sentinel_running_scripts, sentinel_tilt, and a master0..N line per monitored master (name, status, address, slaves, sentinels). Use to read the Sentinel's own health — e.g. whether it is in TILT mode. Read-only.
View source on GitHub
redis.sentinel_is_master_down exec low

SENTINEL IS-MASTER-DOWN-BY-ADDR

Check whether this Sentinel considers the master at ip:port subjectively down. Primarily an internal failover-consensus command, but useful read-only forensics when investigating WHY an objective-down (ODOWN) or failover did or did not fire. Always sends epoch 0 and run id "*", Redis's non-voting form. Connects to the Sentinel on port 26379. Read-only.
View source on GitHub
redis.sentinel_master exec low

SENTINEL MASTER

Show the full state of one monitored master by its configured name (e.g. "mymaster") — ip:port, flags, quorum, num-slaves, num-other-sentinels, down-after-milliseconds, last-ping. Use to confirm a specific master's view and whether the configured quorum is met. Connects to the Sentinel on port 26379. Read-only.
View source on GitHub
redis.sentinel_masters exec low

SENTINEL MASTERS

List every master this Sentinel monitors with full state — name, ip:port, quorum, flags (master/o_down/s_down), num-slaves, num-other-sentinels. Connects to the Sentinel on port 26379. The first stop when mapping a replicas+Sentinel topology. Read-only.
View source on GitHub
redis.sentinel_replicas exec low

SENTINEL REPLICAS

List the replicas Sentinel has discovered for one master, each with ip:port, flags (slave/s_down/disconnected), master-link-status, slave-repl-offset, and slave-priority. Use to see which replicas are up, their replication offset (lag vs the master), and which are failover-eligible. Connects to the Sentinel on port 26379. Read-only. (SENTINEL REPLICAS, the modern name for the deprecated SLAVES, requires Redis >= 5.0.)
View source on GitHub
redis.sentinel_reset exec high

SENTINEL RESET

Reset every monitored master whose name matches the glob pattern. The reset CLEARS any state for the master — including a failover in progress — and DROPS every discovered replica and peer Sentinel, so they are re-learned over the next ~10s from the current master's INFO. Use to clean up stale/removed replicas after a topology change (run on every Sentinel). A too-broad pattern (e.g. "*") resets all masters at once. Connects to the Sentinel on port 26379.
View source on GitHub
redis.sentinel_sentinels exec low

SENTINEL SENTINELS

List the OTHER Sentinel instances this Sentinel knows about for a given master — each with ip:port, runid, flags, and last-ok-ping. Use to confirm the Sentinel set is fully meshed and agrees on membership when diagnosing why a failover quorum is not reached. Connects to the Sentinel on port 26379. Read-only.
View source on GitHub
redis.shutdown_nosave exec critical

SHUTDOWN NOSAVE

Stop the Redis process without writing an RDB. Any data not already persisted is LOST. Used only for cache-only nodes or during recovery from a corrupted state. Process exit means the host's systemd/supervisor will then restart it (or not).
View source on GitHub
redis.slowlog exec medium

SLOWLOG GET

List the last N slowlog entries (commands that exceeded the slowlog threshold). Each entry shows id, timestamp, duration (µs), command + args, client addr, and client name. Read-only. Rated medium because each entry carries the executed command with its literal arguments and the client address, which no redaction list can enumerate.
View source on GitHub
redis.swapdb exec high

SWAPDB

Atomically swap the contents of two logical databases. Clients connected to db i now see db j and vice versa. Used for blue/green cache rebuilds. Wrong indices flip live traffic to a stale dataset.
View source on GitHub
redis.ttl_of exec low

TTL key

Show seconds until the key expires. -2 means missing, -1 means no expiry set. Use before any expiry-related troubleshooting.
View source on GitHub
redis.type_of exec low

TYPE key

Show the datatype of one key (string, list, set, hash, zset, stream, none).
View source on GitHub
redis.xinfo_stream exec low

XINFO STREAM

Show one stream's length, last-generated-id, groups, first/last entry. Use to confirm producers are still appending.
View source on GitHub
redis.xlen exec low

XLEN

Count entries in a stream.
View source on GitHub

← Back to registry

Pack reference Publish your own