Monitor
Usage
snyk monitor [<OPTIONS>]
Description
The snyk monitor
command creates a project in your Snyk account to be continuously monitored for open-source vulnerabilities and license issues, sending the results to snyk.io
Use the monitor
command command before integrating a project into production, to take a snapshot of the code to be monitored in order to avoid pushing vulnerabilities into production. Choose a test frequency in your Settings if you want to change the frequency from the default, which is daily.
A PR check will also do a test.
After running the snyk monitor
command, log in to the Snyk website and view your projects to see the monitor.
If you make changes to your code, you must run the monitor
command again.
For Snyk Container, see snyk container
help
The monitor
command is not supported for Snyk Code.
For Snyk Infrastructure as Code follow the instructions in "Regularly testing IaC files" on Snyk CLI for IaC
Exit codes
Possible exit codes and their meaning:
0: success, snapshot created
2: failure, try to re-run the command. Use -d
to output the debug logs.
3: failure, no supported projects detected
Configure the Snyk CLI
You can use environment variables to configure the Snyk CLI and set variables for connecting with the Snyk API. See Configure the Snyk CLI
Code execution warning
Before scanning your code, review the Code execution warning for Snyk CLI
Debug
Use the -d
option to output the debug logs.
Options
See also subsequent sections for options for specific build environments, package managers, languages and [<CONTEXT-SPECIFIC OPTIONS>]
which you specify last.
--all-projects
--all-projects
Auto-detect all projects in the working directory, including Yarn workspaces.
For more information see the article Does the Snyk CLI support monorepos or multiple manifest files?
--fail-fast
--fail-fast
Use with --all-projects
to cause scans to be interrupted when errors occur and to report these errors back to the user.
The exit code is 2 and the scan ends. No vulnerability information is reported for projects that did not produce errors.
To perform the scan, resolve the error and scan again.
Note: If you do not use --fail-fast
, Snyk scans all the projects but does not report any vulnerabilities for projects it could not scan due to misconfiguration or another error.
--detection-depth=<DEPTH>
--detection-depth=<DEPTH>
Use with --all-projects
or --yarn-workspaces
to indicate how many subdirectories to search. DEPTH
must be a number, 1
or greater; zero (0) is the current directory.
Default: no limit.
Example: --detection-depth=3
limits search to the specified directory (or the current directory if no <PATH>
is specified) plus three levels of subdirectories; zero (0) is the current directory.
--exclude=<NAME>[,<NAME>]...>
--exclude=<NAME>[,<NAME>]...>
Can be used with --all-projects
and --yarn-workspaces
to indicate directory names and file names to exclude. Must be comma-separated, and cannot include a path.
Example: $ snyk test --all-projects --exclude=dir1,file2
This will exclude any directories and files named dir1
and file2
when scanning for project manifest files such as: ./dir1
, ./src/dir1
, ./file2
, ./src/file2
and so on.
Note: --exclude=dir1
will find both ./dir1
, and ./src/dir1
.
However, --exclude=./src/dir1
will result in an error because it includes a path.
--prune-repeated-subdependencies
, -p
--prune-repeated-subdependencies
, -p
Prune dependency trees, removing duplicate sub-dependencies.
Continues to find all vulnerabilities, but may not find all of the vulnerable paths.
Use this option if any big projects fail to be tested.
Default: false
--print-deps
--print-deps
Print the dependency tree before sending it for analysis.
--remote-repo-url=<URL>
--remote-repo-url=<URL>
Set or override the remote URL for the repository that you would like to monitor.
Groups all Projects found under a single Target.
--dev
--dev
Include development-only dependencies. Applicable only for some package managers, for example, devDependencies
in npm or :development
dependencies in Gemfile.
Note: This option can be used with Maven, npm, and Yarn projects.
Default: false, scan only production dependencies.
--org=<ORG_ID>
--org=<ORG_ID>
Specify the <ORG_ID>
to run Snyk commands tied to a specific Snyk Organization. The <ORG_ID>
influences some features availability and private test limits.
If you have multiple Organizations, you can set a default from the CLI using:
$ snyk config set org=<ORG_
ID>
Set a default to ensure all newly monitored projects are created under your default Organization. If you need to override the default, use the --org=<ORG_ID>
option.
Default: <ORG_ID>
that is the current preferred Organization in your Account settings
Note: You can also use --org=<orgslugname>.
The ORG_ID
works in both the CLI and the API. The Organization slug name works in the CLI, but not in the API.
orgslugname
must match the slug name as displayed in the URL of your org in the Snyk UI: https://app.snyk.io/org/[orgslugname]
. The orgname does not work.
For more information see the article How to select the Organization to use in the CLI
--file=<FILE>
--file=<FILE>
Specify a package file.
When testing locally or monitoring a project, you can specify the file that Snyk should inspect for package information. When the file is not specified, Snyk tries to detect the appropriate file for your project.
See also the section on Options for Python projects
--package-manager=<PACKAGE_MANAGER_NAME>
--package-manager=<PACKAGE_MANAGER_NAME>
Specify the name of the package manager when the filename specified with the --file=<FILE>
option is not standard. This allows Snyk to find the file.
Example: $ snyk monitor --file=req.txt --package-manager=pip
For more information see Options for Python projects
--unmanaged
--unmanaged
For C++ only, scan all files for known open source dependencies.
For options you can use with --unmanaged
see Options for scanning using --unmanaged
--ignore-policy
--ignore-policy
Ignore all set policies, the current policy in the .snyk
file, org level ignores, and the project policy on snyk.io.
--trust-policies
--trust-policies
Apply and use ignore rules from the Snyk policies in your dependencies; otherwise ignore rules in the dependencies are only shown as a suggestion.
--project-name=<PROJECT_NAME>
--project-name=<PROJECT_NAME>
Specify a custom Snyk project name.
Example: $ snyk monitor --project-name=my-project
--target-reference=<TARGET_REFERENCE>
--target-reference=<TARGET_REFERENCE>
Specify a reference that differentiates this project, for example, a branch name or version. Projects having the same reference can be grouped based on that reference. Supported for Snyk Open Source and use with --unmanaged
.
For more information see Group projects by branch or version for monitoring
--policy-path=<PATH_TO_POLICY_FILE>
--policy-path=<PATH_TO_POLICY_FILE>
Manually pass a path to a .snyk
policy file.
--json
--json
Print results on the console as a JSON data structure.
Note: If you use an option that sets project attributes and your role lacks permission to edit project attributes the monitor
command fails. For instructions on how to proceed see Permissions (role) required to edit Project attributes from the Snyk CLI
--project-environment=<ENVIRONMENT>[,<ENVIRONMENT>]...>
--project-environment=<ENVIRONMENT>[,<ENVIRONMENT>]...>
Set the project environment project attribute to one or more values (comma-separated). To clear the project environment set --project-environment=
Allowed values: frontend, backend, internal, external, mobile, saas, onprem, hosted, distributed
For more information see Project attributes
--project-lifecycle=<LIFECYCLE>[,<LIFECYCLE>]...>
--project-lifecycle=<LIFECYCLE>[,<LIFECYCLE>]...>
Set the project lifecycle project attribute to one or more values (comma-separated). To clear the project lifecycle set --project-lifecycle=
Allowed values: production, development, sandbox
For more information see Project attributes
--project-business-criticality=<BUSINESS_CRITICALITY>[,<BUSINESS_CRITICALITY>]...>
--project-business-criticality=<BUSINESS_CRITICALITY>[,<BUSINESS_CRITICALITY>]...>
Set the project business criticality project attribute to one or more values (comma-separated). To clear the project business criticality set --project-business-criticality=
Allowed values: critical, high, medium, low
For more information see Project attributes
--project-tags=<TAG>[,<TAG>]...>
--project-tags=<TAG>[,<TAG>]...>
Set the project tags to one or more values (comma-separated key value pairs with an "=" separator).
Example, --project-tags=department=finance,team=alpha
To clear the project tags set --project-tags=
For more information including allowable characters see Project tags
--tags=<TAG>[,<TAG>]...>
--tags=<TAG>[,<TAG>]...>
This is an alias for --project-tags
Options for Maven projects
Note: The --dev
option can be used with Maven projects. See also the --dev
option help
--maven-aggregate-project
--maven-aggregate-project
Use --maven-aggregate-project
instead of --all-projects
when scanning Maven aggregate projects, that is, projects that use modules and inheritance.
Using --maven-aggregate-project
instructs Snyk to perform a compilation step to ensure all modules within the project are resolvable by the Maven reactor. This ensures a comprehensive scan that includes dependencies of all sub-modules.
Be sure to run the scan in the same directory as the root pom.xml
file.
Snyk reports the test results per individual pom.xml
file within the aggregate project.
Note: You can use --all-projects
when scanning Maven aggregate projects, but you cannot use --all-projects
with --maven-aggregate-project
.
--scan-unmanaged
--scan-unmanaged
To monitor individual JAR, WAR, and AAR files, use the following:
--scan-all-unmanaged
--scan-all-unmanaged
Auto-detect Maven, JAR, WAR, and AAR files recursively from the current folder.
Note: Custom-built JAR files, even with open-source dependencies, are not supported.
Options for Gradle projects
--sub-project=<NAME>
, --gradle-sub-project=<NAME>
--sub-project=<NAME>
, --gradle-sub-project=<NAME>
For Gradle multi project configurations, monitor a specific sub-project.
--all-sub-projects
--all-sub-projects
For multi project configurations, monitor all sub-projects.
Both a build.gradle file and a settings.gradle file, or equivalent files, based on the package manager, must exist in the current directory.
--all-projects
--all-projects
See also the --all-projects
option information in the Options section of this help.
Use for monorepos. This detects all supported manifests.
For Gradle monorepos Snyk looks only for root level build.gradle / build.gradle.kts files and applies the same logic as --all-sub-projects
behind the scenes.
This option is designed to be run in the root of your monorepo.
For more details, see the following support article: Scanning Gradle projects in CLI with --exclude
option does not exclude sub-projects
--configuration-matching=<CONFIGURATION_REGEX>
--configuration-matching=<CONFIGURATION_REGEX>
Resolve dependencies using the first configuration that matches the specified Java regular expression.
Example: ^releaseRuntimeClasspath$
--configuration-attributes=<ATTRIBUTE>[,<ATTRIBUTE>]...
--configuration-attributes=<ATTRIBUTE>[,<ATTRIBUTE>]...
Select certain values of configuration attributes to install dependencies and perform dependency resolution.
Example: buildtype:release,usage:java-runtime
--init-script=<FILE
--init-script=<FILE
Use for projects that contain a Gradle initialization script.
Options for NuGet projects
--assets-project-name
--assets-project-name
When you are monitoring a .NET project using NuGet PackageReference
uses the project name in project.assets.json
if found.
--packages-folder
--packages-folder
Specify a custom path to the packages folder.
--project-name-prefix=<PREFIX_STRING>
--project-name-prefix=<PREFIX_STRING>
When monitoring a .NET project, use this option to add a custom prefix to the name of files inside a project along with any desired separators.
Example: snyk monitor --file=my-project.sln --project-name-prefix=my-group/
This is useful when you have multiple projects with the same name in other .sln
files.
Options for .NET projects
--dotnet-runtime-resolution
--dotnet-runtime-resolution
Note: This option in in Early Access and may change until it is released.
Required. You must use this option when you test .NET projects using Runtime Resolution Scanning
Example: snyk test --dotnet-runtime-resolution
--dotnet-target-framework
--dotnet-target-framework
Note: This option in in Early Access and may change until it is released.
Optional. You may use this option if your solution contains multiple <TargetFramework>
directives. If you do not specify the option --dotnet-target-framework
, all supported Target Frameworks will be scanned.
The Target Framework specified with this option should be defined following the standard naming convention
Example: snyk test --dotnet-runtime-resolution --dotnet-target-framework=net6.0
Options for npm projects
Note: You can use the following options with npm projects:
--dev
. See the --dev
option help
--all-projects
to scan and detect npm projects and all other projects in the directory. See the --all-projects
option help
--prune-repeated-subdependencies, -p
. See the --prune-repeated subdependencies option help