DOC-14357: Document cbcat tool

modules/ROOT/nav.adoc

@@ -280,6 +280,7 @@ include::cli:partial$cbcli/nav.adoc[]
 --
 
  ** xref:cli:cbanalyze-core-tool.adoc[cbanalyze-core]
+ ** xref:cli:cbcat.adoc[cbcat]
  ** xref:cli:cbcollect-info-tool.adoc[cbcollect_info]
  ** xref:cli:cbepctl-intro.adoc[cbepctl]
   *** xref:cli:cbepctl/set-checkpoint_param.adoc[set checkpoint_param]

modules/cli/pages/cbcat.adoc

@@ -0,0 +1,83 @@
+= cbcat
+:description: pass:q[The `cbcat` tool decrypts and displays the contents of encrypted logs and archive files.]
+:totoro: the next major release of Couchbase Server
+:page-status: {totoro}
+:page-topic-type: reference
+
+[abstract]
+{description}
+
+== Syntax
+
+The basic syntax is:
+
+----
+cbcat [options] file(s)
+----
+
+where `file(s)` is a list of files to decrypt and view.
+
+== Description
+
+This tool is available in {totoro} and later.
+
+When encryption at rest is active, Couchbase Server encrypts sensitive data stored on disk.
+This includes log files and archive files generated by Couchbase Server and by services that are running in the cluster.
+The `cbcat` tool enables you to decrypt and view the contents of encrypted logs and archive files that were created when encryption at rest was active.
+
+Depending upon your platform, this tool is at the following locations:
+
+[cols="1,3"]
+|===
+| Operating system | Location
+
+| Linux
+| `/opt/couchbase/bin/`
+
+| Windows
+| `C:\Program Files\Couchbase\Server\bin\`
+
+| Mac OS X
+| `/Applications/CouchbaseServer.app/Contents/Resources/couchbase-core/bin/`
+|===
+
+== Options
+
+--with-dump-keys <filename>::
+The name and location of the `dump-keys` binary.
+If not specified, the default is `/opt/couchbase/bin/dump-keys`.
+
+--with-gosecrets <filename>::
+The name and location of the `gosecrets.cfg` configuration file.
+If not specified, the default is `/opt/couchbase/var/lib/couchbase/config/gosecrets.cfg`.
+
+--password <password>::
+The password to use for authentication or as decryption key.
+Use `-` to read from standard input.
+
+--with-keystore <json>::
+The JSON containing the keystore to use.
+Use `-` to read from standard input.
+
+--print-header::
+Prints a header with the file name before the content of the file.
+
+--dump-encryption-header::
+Prints information from the encryption header if the file is encrypted.
+
+--version::
+Displays the program version.
+
+--help::
+Displays help text.
+
+== Environment Variables
+
+CB_DUMP_KEYS_DEBUG::
+Set this environment variable to enable debug output to see the command line used to run the `dump-keys` program.
+
+== See Also
+
+* xref:learn:security/native-encryption-at-rest-overview.adoc[]
+* xref:manage:manage-security/manage-native-encryption-at-rest.adoc[]
+* xref:rest-api:security/encryption-at-rest/encryption-at-rest.adoc[]

modules/cli/pages/cbqueryreportgen.adoc

@@ -1,19 +1,15 @@
 = cbqueryreportgen
-:description: pass:q[The `cbqueryreportgen` tool returns the complete details of any Query service to generate reports.]
+:description: pass:q[The `cbqueryreportgen` tool generates performance reports based on Query Service statistics.]
 :page-status: Couchbase Server 8.0
-:page-component: Query
-ifndef::doctype-manpage[:doctitle: cbqueryreportgen]
-:page-component-version: 8.0
 :page-topic-type: reference
 
 [abstract]
-A query tool that returns the complete details of any Query Service to generate reports.
+{description}
 
 == Syntax
 
 ----
-cbqueryreportgen [-<args>
-                  [ -c, --cluster <cluster> ]
+cbqueryreportgen  [ -c, --cluster <cluster> ]
                   [ -u, --username <username> ]
                   [ -p, --password <password> ]
                   [ -k, <keyspace> ]
@@ -22,20 +18,22 @@ cbqueryreportgen [-<args>
                   [ -o, --output <output> ]
                   [ -l, --limit <limit> ]
                   [ -v, --verbose ]
-                  [ -h, --help ] 
-                 ]
+                  [ -h, --help ]
 ----
 
 
 == Description
 
-ifeval::['{page-component-version}' == '8.0'] 
+ifeval::['{page-component-version}' == '8.0']
 This tool is only available in Couchbase Server 8.0 and later.
 endif::[]
 
 The `cbqueryreportgen` command connects to a Couchbase cluster and generates performance reports based on the Query Service's AWR statistics.
 
-The tool allows you to specify a time range for the report. You can specify 2 different time periods, allowing a report to be generated that compares query statistics over the different time periods. You can also specify the output file where the report must be saved. The output of the command is a report in HTML format.
+The tool allows you to specify a time range for the report.
+You can specify 2 different time periods, allowing a report to be generated that compares query statistics over the different time periods.
+You can also specify the output file where the report must be saved.
+The output of the command is a report in HTML format.
 
 Depending upon your platform, this tool is at the following locations:
 
@@ -44,49 +42,53 @@ Depending upon your platform, this tool is at the following locations:
 | Operating system | Location
 
 | Linux
-| [.path]`/opt/couchbase/bin/`
+| `/opt/couchbase/bin/`
 
 | Windows
-| [.path]`C:\Program Files\Couchbase\Server\bin\`
+| `C:\Program Files\Couchbase\Server\bin\`
 
 | Mac OS X
-| [.path]`/Applications/CouchbaseServer.app/Contents/Resources/couchbase-core/bin/`
+| `/Applications/CouchbaseServer.app/Contents/Resources/couchbase-core/bin/`
 |===
 
-== Options 
+== Options
 
-Required flags: 
+Required flags:
 
 The following flags are required to run the `cbqueryreportgen` command.
 
-The `-c, --cluster` flag specifies the hostname of the Couchbase cluster. Example: `couchbase://localhost`.
+The `-c` or `--cluster` flag specifies the hostname of the Couchbase cluster. Example: `couchbase://localhost`.
 
-The `-u, --username` flag specifies the username of the Couchbase cluster. Example: `-u Administrator`.
+The `-u` or `--username` flag specifies the username of the Couchbase cluster. Example: `Administrator`.
 
-The `-p, --password` flag specifies the password of the Couchbase cluster. Example: `-p password`.
+The `-p` or `--password` flag specifies the password of the Couchbase cluster. Example: `password`.
 
 The `-k` flag specifies the keyspace. The keyspace is the AWR repository in the `bucket.scope.collection` format. Example: `travel-sample._default.awr`.
 
 The `-t1` flag specifies the start-time and end-time for the report, in the local timezone. Enter both start-time and end-time in the `YYYY-MM-DDTHH:MM:SS` format, separated by a comma. Example: `2025-09-01T00:00:00,2025-09-02T00:00:00`.
 
-The `-o, --output` flag specifies the output file for the report. Example: `report.html`.
+The `-o` or `--output` flag specifies the output file for the report. Example: `report.html`.
 
 Optional flags:
 
-The `-t2` flag specifies the start-time and end-time of the second time period, in the local timezone. Enter both start-time and end-time in the `YYYY-MM-DDTHH:MM:SS` format, separated by a comma. Example: `2025-09-02T00:00:00,2025-09-03T00:00:00`.
+The `-t2` flag specifies the start-time and end-time of the second time period, in the local timezone.
+Enter both start-time and end-time in the `YYYY-MM-DDTHH:MM:SS` format, separated by a comma.
+Example: `2025-09-02T00:00:00,2025-09-03T00:00:00`.
 
-The `-l, --limit` flag specifies the maximum number of results to include for every query. The default is `1000`.
+The `-l` or `--limit` flag specifies the maximum number of results to include for every query.
+The default is `1000`.
 
-The `-v, --verbose` flag enables verbose logging for debugging purposes.
+The `-v` or `--verbose` flag enables verbose logging for debugging purposes.
 
-The `-h, --help` flag prints the help information.
+The `-h` or `--help` flag prints the help information.
 
 For more information about how the specific command works, run `cbqueryreportgen --help`.
 
 == Example
 
 This example creates a report showing all of the statistics for a single day.
-The AWR repository is `travel-sample._default.awr`. It's assumed that you have already specified this as the AWR repository, and created an index on the document key in the configured AWR location.
+The AWR repository is `travel-sample._default.awr`.
+It's assumed that you have already specified this as the AWR repository, and created an index on the document key in the configured AWR location.
 
 ====
 [source,sh]
@@ -101,6 +103,6 @@ cbqueryreportgen -c couchbase://localhost \
 
 The output of the command is a report in HTML format, saved to the file `report.html`.
 
-== See Also 
+== See Also
 
-For detailed information, see xref:n1ql:n1ql-manage/query-awr.adoc[Automatic Workload Repository].
+For more information, see xref:n1ql:n1ql-manage/query-awr.adoc[Automatic Workload Repository].