H3C S6812 Series Command Reference Manual page 45

A command with output redirection to the file system is permitted only when the command type write
is assigned to the file system feature.
The following guidelines apply to non-OID rules:
•
If two user-defined rules of the same type conflict, the rule with the higher ID takes effect. For
example, a user role can use the tracert command but not the ping command if the user role
contains rules configured by using the following commands:
rule 1 permit command ping

rule 2 permit command tracert

rule 3 deny command ping

•
If a predefined user role rule and a user-defined user role rule conflict, the user-defined user
role rule takes effect.
The following guidelines apply to OID rules:
•
The system compares an OID with the OIDs specified in rules, and it uses the longest match
principle to select a rule for the OID. For example, a user role cannot access the MIB node with
OID 1.3.6.1.4.1.25506.141.3.0.1 if the user role contains rules configured by using the following
commands:
rule 1 permit read write oid 1.3.6

rule 2 deny read write oid 1.3.6.1.4.1

rule 3 permit read write oid 1.3.6.1.4

•
If the same OID is specified in multiple rules, the rule with the higher ID takes effect. For
example, a user role can access the MIB node with OID 1.3.6.1.4.1.25506.141.3.0.1 if the user
role contains rules configured by using the following commands:
rule 1 permit read write oid 1.3.6

rule 2 deny read write oid 1.3.6.1.4.1

rule 3 permit read write oid 1.3.6.1.4.1

When you specify a command string, follow the guidelines in
Table 3 Command string configuration rules
Rule
Semicolon (;) is the delimiter.
Asterisk (*) is the wildcard.
Guidelines
Use a semicolon to separate the command of each view that you must
enter before you access a command or a set of commands. However, do
not use a semicolon to separate commands available in user view or any
view, for example, display and dir.
Each semicolon-separated segment must have a minimum of one
printable character.
To specify the commands in a view but not the commands in the view's
subviews, use a semicolon as the last printable character in the last
segment. To specify the commands in a view and the view's subviews,
the last printable character in the last segment must not be a semicolon.
For example, you must enter system view before you enter interface
view. To specify all commands starting with the ip keyword in any
interface view, you must use the "system ; interface * ; ip * ;" command
string.
For another example, the "system ; radius scheme * ;" command string
represents all commands that start with the radius scheme keywords in
system view. The "system ; radius scheme *" command string
represents all commands that start with the radius scheme keywords in
system view and all commands in RADIUS scheme view.
An asterisk represents zero or multiple characters.
In a non-last segment, you can use an asterisk only at the end of the
segment.
22
Table 3.