Understanding return codes from the vSSH CLI

Palo Alto Networks SSH Manager · vSSH CLI

Understanding return codes from the vSSH CLI

The return code is sent after running a vSSH CLI command and describes the status of the command. You can display the code sent from the last vSSH CLI command and use it to determine whether the command succeeded or failed, and why.

To determine the return code of an vSSH CLI command, run one of the following commands immediately after running the CLI command.

Linux and macOS

$ echo $?
0

Windows PowerShell

PS> echo $lastexitcode
0

Windows Command Prompt

C:\> echo %errorlevel%
0

The following are the return code values that can be returned at the end of running an vSSH CLI command.

Code	Description
0	There were no errors generated by the vSSH CLI or by the SSH Manager service the request was sent to.
1	The command failed. There were errors generated by the vSSH CLI or by the SSH Manager service to which the request was sent.
2	Command syntax was invalid: missing required subcommands or arguments, unknown commands or arguments, an unknown parameter, or a parameter value that was incorrect and prevented the command from running.
3	The command parsed and reached the service, but the service returned an authentication error. This usually means incorrect credentials or service address.
4	The command was interrupted by the user (Ctrl+C).
5	Applies only to vssh certificate renew. Renewal of the specified certificate was not performed because it is not due yet.

Handling codes in a script

Branch on the exit code instead of parsing the output. This example enrolls a certificate in a pipeline and reacts to each outcome:

vssh certificate enroll svc-deploy --auth jwt --no-prompt
case $? in
  0) echo "Enrolled" ;;
  2) echo "Bad arguments"; exit 2 ;;
  3) echo "Authentication failed"; exit 3 ;;
  *) echo "Failed"; exit 1 ;;
esac

Code 5 is useful for scheduled renewal, because it tells "renewed" apart from "not due yet":

vssh certificate renew /etc/ssh/svc_app_key-cert.pub --expires-in 30d --no-prompt
rc=$?
[ "$rc" -eq 5 ] && exit 0   # not due yet, nothing to do
exit "$rc"

See CI/CD automation for full pipeline examples.