Server command and configuration catalog

This catalog follows the Cfx.re server-command source at c2b2125 . Defaults and supported values below belong to that snapshot. Inspect your running artifact and track before applying settings; a command reference is not a recommended production preset.

Commands can run in the server console, a configuration file, the process command line, RCon, or a resource with permission to invoke ExecuteCommand. Use RegisterCommand for new custom commands rather than the historical rconCommand event. Prefix startup commands with +, for example FXServer.exe +exec server.cfg. See ConVar kinds for the difference between set, setr and sets.

Resource and process commands

Game, build and slots

The official text discusses possible performance changes for several OneSync toggles. Do not interpret that as a measured improvement for your workload. Change one at a time on staging and verify ownership, population and sync correctness.

Game-build values in the pinned catalog

These numbers select documented content sets, not server artifact versions. A dash means the source does not supply a selectable value for that standalone update; do not invent one.

RedM lists build 1491, the September2022 update. Game-build settings, pure mode and pool-size changes may require client restart. Check Legacy versus Enhanced instead of assuming the same executable/package conventions apply to both.

Endpoint, listing and identity settings

See networking and proxies for the complete connect-token, file-download and raw TCP/UDP sequence. Server-list metadata is not authentication.

Security and event transport

Request-control modes

With a nonzero policy, cross-bucket requests are blocked and strict-lockdown senders are blocked. Test any resource that intentionally transfers ownership before changing policy. Do not confuse these transport controls with validation of custom Lua/JS events; secure events still require authorization, bounds and session checks.

Experimental handlers in Legacy configurations

sv_experimentalStateBagsHandler (introduced8510, default true) selects the newer state serialization. sv_experimentalOnesyncPopulation (8823, default true) corrects the old8192 versus65535 object-ID limit when population is disabled; it does not turn population spawning on or off, and it implies the state-bag handler. sv_experimentalNetGameEventHandler (9149, default true) adds serialization/relevance checks and implies both preceding handlers. Enhanced removes or internalizes several older toggles; consult Enhanced migration.

Access control and console filtering

A filter’s noprint prevents trace-listener printing; drop discards output before print listeners; devonly applies drop only outside developer mode. Filters affect observability, not whether the underlying code executes. Record and remove temporary diagnostic filters rather than hiding errors indefinitely. See grant/test/revoke permissions.

Pool-size increases

increase_pool_size "poolName" amount requests a positive increase, not a replacement total. It is startup-only. Client and server validate allowed pools and limits fetched from Cfx infrastructure; a rejected request logs a warning or prevents joining. Different pool settings can force a client restart. Inspect F8 > Tools > Streaming > Pool Monitor before tuning.

The source explicitly says its table can lag the actual startup-fetched limits. These are its recorded maxima, not authorization to override validation:

The upstream development-only escape hatch sets moo to31337 independently on a local test server and its test client, bypassing pool validation. Never use it to evade supported limits in production or bundle it into a public setup recipe. Remove both test settings afterward. Request a supported limit change upstream with measured evidence instead of distributing an unsupported preset.

Enhanced-only networking and world grid

Enhanced rate limiters

These use token buckets: rate refills tokens per second, burst caps stored tokens, and a depleted bucket limits requests. Size-oriented limits should not be interpreted as arbitrary application request counts. Configure with set rateLimiter_NAME_rate VALUE and set rateLimiter_NAME_burst VALUE.

Diagnose the producer and normal traffic before raising a limiter. Limits do not replace validation of resource-level requests, and disabling bounds can convert malformed traffic into memory or CPU exhaustion.

Enhanced recording and replay

sync_start_recording netId compressed records an entity’s network sync; the compression boolean is optional. sync_stop_recording netId ends that recording. replay_start fileName mode returns a replay ID: mode0 plays once,1 loops,2 requests a seamless/perfect loop. Pass the returned ID to replay_stop replayId.

Use owned test entities and protect recordings as potentially sensitive session data. Test that recording has actually stopped and remove test files under a deliberate retention policy. A replay is a diagnostic artifact, not a persistent gameplay backup.

Compatibility variables with no effect on Enhanced

onesync_enableBeyond, sv_enhancedHostSupport, and sv_protectServerEntities are retained as boolean compatibility variables with default false and no effect. Use actual entity lockdown rather than the unimplemented protection flag. Confirm the full migration reference before reusing a Legacy configuration.

Apply and verify a change

Save the old value, identify whether a full restart is required, test on staging and observe the exact affected flow. A console accepting set arbitrary_name value proves only that a ConVar can be stored; it does not prove the engine implements that name. Keep secrets outside published examples, and distinguish a successful configuration parse from a real client/server acceptance test.