Adding or editing keywords
Keywords can be one of the following types:
- Event: Any event that is logged to the Event Log (for example from external syslog or user event).
- Change: BMC Network Automation detected a configuration file change or an OS image change.
- Discrepancy: BMC Network Automation detected a configuration file or an OS image discrepancy (for example difference between the trusted production configuration and the current configuration).
Note
The Change Detected keyword is used to detect changes to the Running, Startup, and other configurations and to the operating system. To detect hardware changes, use the Hardware Change Detected keyword (Type=Event, Category=Device, Event=Hardware inventory has been updated.).
This topic describes how to add, edit, or copy keywords for policy conditions and also shows some examples.
To add, edit, or copy keywords for policy conditions
- Open the Keywords page by clicking the Policies tab, and selecting Policies > Keywords.
On the Keywords page, perform one of the following actions:
Icon Action Description 
Add Add a new keyword. 
Edit Edit an existing keyword in the relevant row. 
Copy Create a new keyword by copying and editing an existing keyword in the relevant row. - Enter a unique name for the keyword, up to 40 characters.
- Select the type of keyword: Event, Change, or Discrepancy. You cannot edit the keyword type after it is saved.
- Enter or update information in the displayed fields:
For an Event keyword:
Field
Description
Severity
Select one or more severity levels for the event. This field is required only if you set the Event value to Any.
Category
(Optional) Select the category of event. Syslog messages are logged under the External category.
Event
(Optional) Specify the specific type of event for the selected category.
Search String
Specify one or more strings to match in the event. Start and terminate the string with the wildcard character * to find string anywhere in the event text. This field is required only if you set the Event value to Any.
For a Change keyword:
Field
Description
Trails
(Optional) Select if want to detect change to the Running, Startup, or other device specific configurations.
OS Image
(Optional) Select if want to detect change to the OS image.
Search String
Specifies which command lines in the configuration file have changed. For any command line, specify "*" as the search string. For a specific command-line change, specify a substring for the command (for example, *access-list*). You can enter multiple search strings. For OS Image changes, you must specify "*" as the search string.
For a Discrepancy keyword:
Field
Description
Running vs Trusted Running
(Optional) Select if want to detect a discrepancy between the current Running and trusted Running configuration files.
Startup vs Trusted Startup
(Optional) Select if want to detect discrepancy between the current Startup and trusted Startup configuration files.
Running vs Startup
(Optional) Select if want to detect discrepancies between the Running and Startup configuration files.
OS Image
(Optional) Select if want to detect discrepancies between the current Running and Trusted Running OS image versions.
Search String
Specifies which command lines in the configuration file have a discrepancy. For any command line, specify "*" as the search string. For a specific command line change, specify a substring for the command (for example, *access-list*). You can enter multiple search strings. For OS Image changes, you must specify "*" as the search string.
- Click Save.
Editing examples
The following figures show the editing of out-of-the-box keywords, one of each type (Change, Event, and Discrepancy). Click each figure to enlarge.
Comments