Redis DBA cheat sheet: redis-cli, INFO, keys, memory, clients, replication and persistence

#How to use this sheet

Every command below runs in redis-cli (or valkey-cli, which takes the same options). Sections follow the order you usually need them during an incident: connect, check health, find the problem key or client, then look at replication and persistence.

Warning

Redis runs commands on a single main thread. A command that walks every key (KEYS *, FLUSHALL, DEL on a huge key, MONITOR on a busy server) blocks every other client while it runs. Use the safe alternatives in this sheet on production.

#Connect

# Plain TCP, default port
redis-cli -h redis01 -p 6379

# Password only (requirepass) - prefer the env var so it stays out of shell history
export REDISCLI_AUTH='S3cret!'
redis-cli -h redis01 -p 6379

# ACL user (Redis 6+)
redis-cli -h redis01 -p 6379 --user ops_ro --pass 'S3cret!'

# TLS (managed services usually require it; Azure uses 6380 or 10000 depending on the offering)
redis-cli -h myredis.example.com -p 6380 --tls --cacert /etc/ssl/certs/ca-bundle.crt

# Cluster mode: follow MOVED/ASK redirects
redis-cli -c -h redis-cluster01 -p 6379

# Run one command and exit
redis-cli -h redis01 PING

#Health at a glance

# Live one-line-per-second view: keys, memory, clients, ops
redis-cli -h redis01 --stat

# Pull just the fields you care about
redis-cli -h redis01 INFO memory | grep -E 'used_memory_human|maxmemory_human|mem_fragmentation_ratio'
redis-cli -h redis01 INFO stats  | grep -E 'evicted_keys|rejected_connections|keyspace_(hits|misses)'

Hit ratio = keyspace_hits / (keyspace_hits + keyspace_misses). A sudden drop usually means evictions or a deploy that changed key names.

#Find keys safely

KEYS pattern scans the whole keyspace in one blocking call. Use SCAN, which returns a cursor and a small batch each time.

# Iterate from the CLI (handles the cursor for you)
redis-cli -h redis01 --scan --pattern 'session:*' | head -20

# Count matching keys without blocking the server
redis-cli -h redis01 --scan --pattern 'session:*' | wc -l

# Inside redis-cli: cursor 0 to start, repeat with the returned cursor until it is 0 again
SCAN 0 MATCH session:* COUNT 1000
SCAN 0 MATCH * COUNT 1000 TYPE hash      # TYPE filter, Redis 6+

#Inspect one key

TYPE user:42
TTL user:42             # -1 = no expiry, -2 = key does not exist
PTTL user:42            # milliseconds
OBJECT ENCODING user:42 # listpack, hashtable, intset, skiplist...
OBJECT IDLETIME user:42 # seconds since last access (not available under an LFU policy)
MEMORY USAGE user:42    # bytes, including overhead
STRLEN / HLEN / LLEN / SCARD / ZCARD <key>   # size by type

#Change or remove keys

EXPIRE user:42 3600     # set a TTL
PERSIST user:42         # remove the TTL
UNLINK big:list:1       # delete, freeing memory in a background thread
DEL small:key           # delete synchronously; fine for small keys

Caution

FLUSHDB and FLUSHALL delete every key, immediately, with no undo. Check INFO server (host and port) and SELECTed database before you run either. Many teams rename or block them with ACLs (-flushall -flushdb).

#Memory and big keys

# Biggest key per type (samples with SCAN, safe on production)
redis-cli -h redis01 --bigkeys

# Biggest keys by bytes rather than element count (newer redis-cli builds; check redis-cli --help)
redis-cli -h redis01 --memkeys

# Inside redis-cli
MEMORY STATS
MEMORY DOCTOR
CONFIG GET maxmemory
CONFIG GET maxmemory-policy

#Clients and connections

INFO clients
CLIENT LIST                      # one line per connection: addr, name, age, idle, cmd, omem
CLIENT LIST TYPE normal          # skip replicas and pub/sub
CLIENT INFO                      # your own connection
CLIENT KILL ID 1234              # kill one client by id from CLIENT LIST
CLIENT KILL ADDR 10.0.4.17:51522
CONFIG GET maxclients
CONFIG GET timeout               # 0 = idle clients are never closed

# Connections per source IP, highest first
redis-cli -h redis01 CLIENT LIST | grep -o 'addr=[0-9.]*' | sort | uniq -c | sort -rn | head

Look for large omem (output buffer) values: a slow consumer or a pub/sub subscriber that cannot keep up.

#Slow commands and latency

SLOWLOG GET 10          # id, timestamp, microseconds, command and args, client
SLOWLOG LEN
SLOWLOG RESET
CONFIG GET slowlog-log-slower-than   # microseconds; default 10000

CONFIG SET latency-monitor-threshold 100   # ms; 0 disables the monitor
LATENCY LATEST
LATENCY DOCTOR

# Client-side round trip in ms, from the application host
redis-cli -h redis01 --latency
redis-cli -h redis01 --latency-history -i 15

MONITOR prints every command the server executes. It is useful for a few seconds on a test box and can roughly halve throughput on a busy production server. Prefer SLOWLOG and INFO commandstats.

#Replication and Sentinel

ROLE                       # master/replica, offsets, connected replicas
INFO replication           # master_link_status, master_last_io_seconds_ago, lag per replica

# On a replica: lag in bytes = master_repl_offset (primary) - slave_repl_offset (replica)

REPLICAOF 10.0.1.10 6379   # make this node a replica (Redis 5+; SLAVEOF on older builds)
REPLICAOF NO ONE           # promote this node to primary

Warning

Do not run REPLICAOF by hand on nodes managed by Sentinel, Redis Cluster or a managed service. The orchestrator will fight you, and pointing a node at the wrong primary wipes its data on the full resync.

Sentinel (connect to port 26379):

redis-cli -p 26379 SENTINEL get-master-addr-by-name mymaster
redis-cli -p 26379 SENTINEL master mymaster
redis-cli -p 26379 SENTINEL replicas mymaster     # SENTINEL slaves on builds before 5.0
redis-cli -p 26379 SENTINEL sentinels mymaster
redis-cli -p 26379 SENTINEL ckquorum mymaster
redis-cli -p 26379 SENTINEL failover mymaster     # planned failover

#Persistence and backups

INFO persistence      # rdb_last_bgsave_status, rdb_changes_since_last_save, aof_enabled, aof_last_write_status
CONFIG GET save       # RDB snapshot rules
CONFIG GET appendonly
CONFIG GET appendfsync
LASTSAVE              # unix time of the last successful RDB save
BGSAVE                # fork and write an RDB snapshot
BGREWRITEAOF          # compact the AOF
CONFIG GET dir        # where dump.rdb / appendonlydir live

# Take a backup copy of the dataset from a remote host
redis-cli -h redis01 --rdb /backup/redis01-$(date +%F).rdb

If rdb_last_bgsave_status:err, Redis may refuse writes (when stop-writes-on-bgsave-error yes). Check the Redis log for the reason, usually disk full, permissions or a fork failure from memory overcommit.

#ACLs and security

ACL WHOAMI
ACL LIST
ACL USERS
ACL GETUSER ops_ro
ACL LOG 10            # recent denied commands and failed auths

# Read-only user for dashboards and on-call checks
# Rules apply left to right, so remove @dangerous first, then add back the admin reads you want
ACL SETUSER ops_ro on '>S3cret!' '~*' '&*' +@read -@dangerous +info +ping +slowlog|get +latency|latest +client|list
ACL SAVE              # persist to the aclfile, if one is configured
CONFIG REWRITE        # otherwise persist to redis.conf

#Redis Cluster

CLUSTER INFO          # cluster_state:ok, cluster_slots_assigned:16384
CLUSTER NODES
CLUSTER SHARDS        # Redis 7+
CLUSTER KEYSLOT user:42
CLUSTER COUNTKEYSINSLOT 5474

redis-cli --cluster check  10.0.1.10:6379
redis-cli --cluster info   10.0.1.10:6379

#Config changes

CONFIG GET maxmemory*
CONFIG SET maxmemory 6gb
CONFIG REWRITE        # write running config back to redis.conf so it survives a restart

On ElastiCache and Azure, CONFIG, SAVE, BGSAVE, REPLICAOF and some DEBUG commands are blocked or renamed. Change settings through the parameter group or the resource's Redis configuration instead. The list varies by service and tier; check the provider's restricted-commands page.

#Prevent it next time

• Alert on used_memory / maxmemory, evicted_keys rate, rejected_connections, connected_clients, master_link_status and rdb_last_bgsave_status.
• Block KEYS, FLUSHALL, FLUSHDB and MONITOR for application users with ACLs (-@dangerous covers most of them).
• Give each application a client name (CLIENT SETNAME) so CLIENT LIST shows who owns each connection.
• Put a TTL on every cache key and review INFO keyspace (keys vs expires) monthly.