Host Intrusion Detection System Administrator's Guide Release 3.1

Templates and Alerts
Race Condition Template
Appendix A
145
NOTE See Table B-1 and Table B-2 in Appendix B for the definition of additional arguments
that can be used to access specific alert information (for example, pid and ppid) without
having to parse the string alert fields.
argv[5] Attacker String uid=<uid>, gid=<gid>,
pid=<pid>, ppid=<ppid>
The user ID, group ID,
process ID, and parent
process ID of the
process, if known, that
modified a privileged
program’s file reference.
All values set to -1 if
attacker is not known.
argv[6] Target of
Attack
String file=<full
pathname>,type=<type>,
mode=<mode>,uid=<uid>,gid
=<gid>,inode=<inode>,devi
ce=<device>
The full pathname of
the file whose reference
was modified, and the
file’s type, mode, uid,
gid, inode, and
device number.
argv[7] Summary String File reference change Alert summary.
argv[8] Details String File reference for file <full
pathname>(type=<type>,
inode=<inode>,
device=<device), has changed
unexpectedly for process with
pid <pid> and ppid <ppid>
when executing
<program>>(type=<type>,
inode=<inode>,
device=<device>). Attacker
is process <pid> when
executing
<program>>(type=<type>,
inode=<inode>,
device=<device>).
Detailed alert
description.
argv[9] Local Time Integer <secs> Local time in number of
seconds since epoch
when an unexpected file
reference was detected.
Table A-7 File Reference Modification Alert Properties (Continued)
Response
Program
Argument
Alert Field
Alert
Field
Type
Alert Value/Format Description