249
Usage guidelines
Policy runtime limits the amount of time that the monitor policy can run from the time it is triggered.
When the runtime is reached, the system stops executing the policy even if the execution is not
finished.
This setting prevents an incorrectly defined policy from running permanently to occupy resources.
Examples
# Set the runtime to
60
seconds for the CLI-defined policy
test
.
<Sysname> system-view
[Sysname] rtm cli-policy test
[Sysname-rtm-test] running-time 60
user-role
Use
user-role
to assign a user role to a CLI-defined policy.
Use
undo user-role
to remove a user role from a CLI-defined policy.
Syntax
user-role
role-name
undo user-role
role-name
Default
A monitor policy contains user roles that its creator had at the time of policy creation.
Views
CLI-defined policy view
Predefined user roles
network-admin
mdc-admin
Parameters
role-name
: Specifies a user role, a string of 1 to 63 characters.
Usage guidelines
For EAA to execute an action in a monitor policy, you must assign the policy the user role that has
access to the action-specific commands and resources. If EAA lacks access to an action-specific
command or resource, EAA does not perform the action and all the subsequent actions.
For example, a monitor policy has four actions numbered from 1 to 4. The policy has user roles that
are required for performing actions 1, 3, and 4, but it does not have the user role required for
performing action 2. When the policy is triggered, EAA executes only action 1.
A monitor policy supports a maximum of 64 valid user roles. User roles added after this limit is
reached do not take effect.
You cannot assign a monitor policy user roles that have higher privilege than the user roles you are
logged in with.
An EAA policy cannot have both the
security-audit
user role and any other user roles. Any
previously assigned user roles are automatically removed when you assign the
security-audit
user
role to the policy. The previously assigned
security-audit
user role is automatically removed when
you assign any other user roles to the policy
.
Examples
# Assign user roles to a CLI-defined policy.
