Host Intrusion Detection System Administrator's Guide Release 3.1

Troubleshooting
Troubleshooting
Appendix G
249
• /opt/ids/bin/idsagent -d -e -l /var/log/idslog
❏ The debug information can be found in the following files:
• /var/log/idslog
• /var/log/idslog_idskerndsp
• /var/log/idslog_idssysdsp
• /var/log/idslog_idscor
Agent does not start after installation
❏ Verify that there are no errors from the install: /var/adm/sw/swagent.log
❏ Be sure the product has been run as user ids. (No other user will work.)
❏ Verify that all keys have been generated as described in “Setting Up the HP-UX
HIDS Secure Communications” on page 20.
❏ Run /opt/ids/bin/IDS_checkInstall to verify that all required patches have been
installed properly prior to installing IDS. IDS_checkInstall should be run on an
OS where IDS is installed. If patches are missing, uninstall IDS (swremove), install
the patches (see the Release Notes cited in “Documentation” on page 3), and reinstall
IDS (swinstall).
Agents appear to be stuck in polling status
In some instances, the combination of the autostatus and autosync processes leave some
agents in “polling” status. The workaround is to use autostatus only or to perform a
manual status to get the agent display into a known state.
Alert date/time sort seems inconsistent
❏ Two factors come into play in this seeming inconsistency: First, the agent’s date/time
stamp is based on the local host time when the alert was received. Second, the time
the System Manager uses to sort the alert is based on the UTC when the alert
actually occurred. Under normal circumstances, these two times are identical. On
occasion, however, there may be a difference depending on internal processing time,
which may make the alert list inconsistent.
Alerts are not being displayed in the alert browser
❏ Check to see if they are appearing in /var/opt/ids/alert.log.
❏ Check for errors in the error browser.
❏ Determine whether IDDS failed at boot-up: Use the /etc/dmesg command to verify
that there are no messages saying, IDDS disabled.
❏ Verify that the host name and IP address are configured and valid.
❏ In the event that the keys have become corrupted, regenerate all key sets using
procedures from “Setting Up the HP-UX HIDS Secure Communications” on page 20.
❏ Verify that the agent system is set to “Running” (with a green background) in the
System Manager.