User's Guide

The memory consumption of the HIDS agent processes is charted against the rate of system call
audit records (events) in Appendix B.
3.1.4 Disk Capacity
One of the main functions of HIDS is to log alerts locally to disk on the server being monitored. By
default, the log file used is /var/opt/ids/alert.log. The amount of alerts will vary depending on what
HIDS is configured to monitor and the load activity on the system. The continuous operation of HIDS
can produce many alerts and can therefore consume a large amount of disk space. In addition, a 20
megabyte memory mapped file is created in /var/opt/ids. It is recommended to allocate at least
100MB to the disk partition that contains /var/opt/ids on each system running the HIDS agent. The
amount of disk space needed can be mitigated by performing log rotation of alert.log.
For swap, the HIDS agent requires between 97 MB and 157 MB.
3.2 Tuning Considerations
3.2.1 Product Tuning
3.2.1.1 Tuning the Surveillance Schedules
3.2.1.1.1 Background
A surveillance schedule contains one or more surveillance groups. A surveillance group defines a
collection of detection templates, their corresponding configurations, and when the templates are
scheduled to run. A detection template may exist in more than one surveillance group, but each
surveillance group may have at most one template instance of a particular template.
One can configure each detection template in the group with details specific to the threats to protect
against. For example, a surveillance group named "WebServer" may contain three templates:
Creating SetUID files, Changes to files/directories and Monitor logins/logouts. In this example, the
Changes to files/directories template can be configured to monitor the changes to files and directories
under /etc/opt/httpd.
3.2.1.1.2 Avoid duplicate copies of a template
It is possible to place the same detection template in two or more surveillance groups. However, if the
groups are scheduled to run concurrently in a surveillance schedule then multiple copies of a
detection template will be executing concurrently. A performance penalty will be incurred from running
more than one instance of the same template.
Try to schedule surveillance groups with duplicate templates to run at different times.
3.2.1.1.3 Avoid duplicate groups with overlapping functionality
A surveillance group should contain the least number of templates required to be effective, and no
more. One can reduce the likelihood of duplicate templates by keeping surveillance groups as small
as possible.
HP Company Internal Page 7 of 20