--- schema_version: "1" id: 2fb9d6061ee02cd8002f014dc401e46899d436fcf5c299b07d9a2c76394e6fb8 title: sf scanner run dfa (Retired) collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/code-analyzer/salesforce-code-analyzer/guides/v3x/command-reference/dfa.md canonical_url: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/dfa.html source_site: developer.salesforce.com content_type: documentation content_hash: 439a4334c2c1d1a566b8b44f66490ea8b586245958bf1ea89aa935b3af2787df products: - Salesforce Code Analyzer --- # sf scanner run dfa (Retired) Scans codebase with all DFA rules by default. Specify the format of output and print results directly or as contents of a file that you provide with --outfile flag. **important:** The `scanner run dfa` command runs for a longer time than `scanner run`, and it requires a target code context path. If your codebase is complex, increase the Java heap space to avoid OutOfMemory errors. See [Understand LimitReached Errors](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/salesforce-graph-engine/working-with-graph-engine.md#understand-limitreached-errors). ## Examples Modify SFGE_RULE_THREAD_COUNT to adjust how long DFA-based rules execute before timing out (default: `900,000 ms or 15 minutes`). Use this control when you want Graph Engine to run longer and analyze more complex code. The equivalent flag on the `scanner run dfa` command is `--rule-thread-timeout`. ### Graph Engine Syntax These examples follow Graph Engine syntax. - The paths for all files in `--projectdir` are specified through `--target`. - Globs, when in use, are wrapped in quotes. #### Good Examples ``` $ sf scanner run dfa --target ./myproject/main/default/classes/*.cls --projectdir ./myproject/ $ sf scanner run dfa --target ./dir1/file1.cls,./dir2/file2.cls --projectdir ./dir1/,./dir2/ ``` #### Replace this value: - `./myproject/main/default/classes/*.cls`, `./dir1/file1.cls,./dir2/file2.cls`: Example source code locations. - `./myproject/`, `./dir1/,./dir2/`: The root project directory. #### Bad Example ``` $ sf scanner run dfa --target ./**/*.cls --projectdir ./myproject ``` ### CLS These two examples evaluate rules against all `.cls` files below the current directory, except for `IgnoreMe.cls`. #### Unix Example ``` $ sf scanner run dfa --target ./**/*.cls,!./**/IgnoreMe.cls ... ``` #### Replace this value: - `{./**/*.cls,!./**/IgnoreMe.cls}`: The source code location. #### Windows Example ``` $ sf scanner run dfa --target .\**\*.cls,!.\**\IgnoreMe.cls ... ``` #### Replace this value: - `{./**/*.cls,!./**/IgnoreMe.cls}`: The source code location. ### Individual Methods This example targets individual methods within a file. It uses a suffix of the file's path plus a hash (#) and a semicolon-delimited list of method names. This syntax is incompatible with globs and directories. This example also evaluates rules against all methods named `Method1` or `Method2` in `File1.cls`, and all methods named `Method3` in `File2.cls`. ``` $ sf scanner run dfa --target ./File1.cls#Method1;Method2,./File2.cls#Method3 ... ``` #### Replace this value: - `./File1.cls#Method1;Method2,./File2.cls#Method3`: The source code location. ### normalize-severity Example This example uses `--normalize-severity` to output a normalized severity across all engines in addition to the engine-specific severity. Values are `1` (high), `2` (moderate), and `3` (low). ``` $ sf scanner run dfa --target /some-project/ --projectdir /some-project/ --format csv --normalize-severity ``` #### Replace these values: - `/some-project/`: The source code location. - `csv`: The results output format. ### severity-threshold Example This example uses `--severity-threshold` to throw a non-zero exit code when rule violations of a specific normalized severity or greater are found. When there are rule violations with moderate (2) or high (1) severity, the exit code equals the severity of the most severe violation. ``` $ sf scanner run dfa --target /some-project/ --projectdir /some-project/ --severity-threshold 2 ``` #### Replace these values: - `/some-project/`: The source code location. - `2`: A severity value. Possible values are: 1 (high), 2 (moderate), and 3 (low). ### rule-thread-count Example This example uses `--rule-thread-count` so more or fewer entry points can be evaluated concurrently. ``` $ sf scanner run dfa --rule-thread-count 6 ``` #### Replace these values: - `6`: The number of rule evaluation threads. ### rule-thread-timeout Example This example uses `--rule-thread-timeout` to increase or decrease the maximum runtime for a single entry point evaluation. You can increase the timeout from 15 minutes (default) up to 150 minutes. ``` $ sf scanner run dfa --rule-thread-timeout 9000000 ... ``` #### Replace these values: - `9000000`: A time limit in milliseconds for evaluating a single entrypoint. ### sfgejvmargs Example This example uses `--sfgejvmargs` to pass JVM args to override system defaults while executing the Graph Engine rules. It overrides the system's default heapspace allocation to 2 GB and decreases the likelihood of encountering an OutOfMemory error. ``` $ sf scanner run dfa --sfgejvmargs -Xmx2g ... ``` #### Replace these values: - `-Xmx2g`: The Java Virtual Machine arguments. ## Usage `sf scanner run dfa `    [`-c` CATEGORY_LIST]    [`-f` FORMAT]    [`-o` OUTFILE]    [`-p` PROJECTDIR_LIST]    [`-s` SEVERITY-THRESHOLD]    [`-t` TARGET_LIST]    [`--json`]    [`--normalize-severity`]    [`--pathexplimit` PATHEXPLIMIT]    [`--rule-disable-warning-violation`]    [`--rule-thread-count` RULE-THREAD-COUNT]    [`--rule-thread-timeout` RULE-THREAD-TIMEOUT]    [`--sfgejvmargs` SFGEJVMARGS]    [`--verbose`]    [`--with-pilot`] ## Flags `-c` | `--category` CATEGORY_LIST > Optional > > One or more categories of rules to run. Specify multiple values as a comma-separated list. > > Type: option `-f` | `--format` FORMAT > Optional > > Specifies the output format for results written directly to the console. > > Type: option > > Possible Values: `csv` | `html` | `json` | `junit` | `sarif` | `table` | `xml` `-o` | `--outfile` OUTFILE > Optional > > Writes output to a file. > > Type: option `-p` | `--projectdir` PROJECTDIR_LIST > Optional > > Provides the relative or absolute root project directories used to set the context for Graph Engine's analysis. Specify multiple values as a comma-separated list. Each project directory must be a path, not a glob. If --projectdir isn’t specified, a default value is calculated. The default value is a directory that contains all the target files. > > Type: option `-s` | `--severity-threshold` SEVERITY-THRESHOLD > Optional > > Throws an error when violations are found with equal or greater severity than the provided value. Values are 1 (high), 2 (moderate), and 3 (low). Exit code is the most severe violation. Using this flag also invokes the --normalize-severity flag. > > Type: option `-t` | `--target` TARGET_LIST > Optional > > Specifies the source code location. Use glob patterns or specify individual methods with #-syntax. Multiple values are specified as a comma-separated list. Default is ".". > > Type: option `--json` > Optional > > Format output as JSON. > > Type: boolean `--normalize-severity` > Optional > > Returns normalized severity 1 (high), 2 (moderate), and 3 (low), and the engine-specific severity. For the html option, the normalized severity is displayed instead of the engine severity. > > Type: boolean `--pathexplimit` PATHEXPLIMIT > Optional > > Specifies a path expansion upper boundary to limit the complexity of code Graph Engine analyzes before failing fast. Set the value to -1 to remove any upper boundary. --pathexplimit inherits value from SFGE_PATH_EXPANSION_LIMIT env-var, if set. Its default value is derived from JVM heap space allocation. > > Type: option `--rule-disable-warning-violation` > Optional > > Disables warning violations, such as those on StripInaccessible READ access, to get only high-severity violations (default: false). Inherits value from SFGE_RULE_DISABLE_WARNING_VIOLATION env-var if set. > > Type: boolean `--rule-thread-count` RULE-THREAD-COUNT > Optional > > Specifies the number of rule-evaluation threads or how many entry points can be evaluated concurrently. Inherits its value from the SFGE_RULE_THREAD_COUNT environment variable, if set. The default is 4. > > Type: option `--rule-thread-timeout` RULE-THREAD-TIMEOUT > Optional > > Specifies the time limit for evaluating a single entry point in milliseconds. Inherits its value from the SFGE_RULE_THREAD_TIMEOUT environment variable, if set. The default is 900,000 ms or 15 minutes. > > Type: option `--sfgejvmargs` SFGEJVMARGS > Optional > > Specifies Java Virtual Machine arguments to override system defaults while executing Salesforce Graph Engine. For multiple arguments, add them to the same string separated by space. > > Type: option `--verbose` > Optional > > Emit additional command output to stdout. > > Type: boolean `--with-pilot` > Optional > > Allows pilot rules to execute. > > Type: boolean ## Environment-variable-based Controls Salesforce Graph Engine has these environment variable-based controls. ### SFGE_JVM_ARGS Set SFGE_JVM_ARGS to work around [Understand LimitReached Errors](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/salesforce-graph-engine/working-with-graph-engine.md#understand-limitreached-errors) and other JVM issues while executing the `scanner run dfa` command. Refer to the JVM documentation for more info. The equivalent flag on the `scanner run dfa` command is `--sfgejvmargs`. ### SFGE_RULE_DISABLE_WARNING_VIOLATION Set to `true` to suppress warning violations, such as those related to `StripInaccessable` READ access (default: `false`). The equivalent flag on the `scanner run dfa` command is `--rule-disable-warning-violation`. ### SFGE_RULE_THREAD_COUNT Modify SFGE_RULE_THREAD_COUNT to adjust the number of threads that each execute DFA-based rules (default: `4`). The equivalent flag on the `scanner run dfa` command is `--rule-thread-count`. ### SFGE_RULE_THREAD_TIMEOUT Modify SFGE_RULE_THREAD_TIMEOUT to adjust how long DFA-based rules execute before timing out (default: `900,000 ms or 15 minutes`). Use this control when you want Graph Engine to run longer and analyze more complex code. The equivalent flag on the `scanner run dfa` command is `--rule-thread-timeout`.