Keywords groups
Keywords groups enable the server to find log records and data objects (such as files, e-mails, or instant messages) by specific words and/or phrases, referred to as “keywords”. For example, by using groups of this type, one could find entries of shadow files/logs and audit logs in which specific keywords are encountered. A group can be configured to specify the desired keywords and search settings (for example, whether to search for all keywords or at least one of them). Then the server can search for objects containing the keywords specified in that group.
The Search Server provides a wide range of predefined (built-in) Keywords groups. Administrators can use built-in groups as they are, create editable copies (duplicates) of built-in groups, or create new custom groups to suit a particular organization’s needs. Built-in groups make it easy to configure search requests without necessarily having to define custom groups. Review
a list of built-in Keywords groups for further details.
For built-in groups of this type, one can only view their keywords and other settings in the dialog box described in the section that follows. Changing built-in groups is not allowed. To change the keywords in a built-in group, create an editable copy of it by duplicating the group (see
Dialog box for managing search groups).
Setting up, viewing or changing a Keywords group
When creating, duplicating, viewing, or editing a Keywords group (see
Dialog box for managing search groups), the console employs a dialog box with the following group setting control fields:
•Name, Description - Set, view, or change the name and description of the group.
•Condition - View or select the search condition:
•Match any keyword(s) - The group searches for objects that contain at least one of its keywords.
•Match all keyword(s) - The group searches for objects that contain each of its keywords.
•Keywords - View or change the group’s keywords:
•To add a keyword, click the Add button beneath the keyword list, and then type the desired word or phrase. When finished, press Enter.
•To change a keyword already in the list, double-click in the Keywords field of the respective list entry, and type the desired changes. When finished, press Enter.
•To remove keywords, select them in the list and click the Delete button beneath the keyword list.
•To add keywords from a text file, click the Load button beneath the keyword list and open the file in the dialog box that appears. Each keyword in this file must be on a separate line, with a line break after the last character of the keyword.
In the keyword list, one can view or change the following search option individually for each keyword:
•Whole Word - Determines whether to search for only those objects in which the keyword occurs as a separate word rather than a part of another word. When the Whole Word check box is selected, the server looks for a word that exactly matches the given keyword (for example, searching for the keyword test will not find the word contest or testimony). When this check box is cleared, the server also looks for words that contain the given keyword (contest and testimony will then appear in the search results along with the keyword test).