Host Intrusion Detection System Administrator's Guide Release 3.1

Troubleshooting
Troubleshooting
Appendix G
254
Schedule Manager timetable screen appears to hang
❏ The visual refresh of the day, time, and surveillance group matrix (which the System
Manager maintains in the Schedule Manager timetable screen) is CPU intensive
and hence may appear to be slow on some systems.
SSH does not perform a clean exit after idsgent is started
After starting idsagent from a ssh login, logging out of the agent system results in the
ssh session hanging indefinitely. The following are some workarounds:
ssh -l root <machine> /usr/dt/bin/dtterm ; then type in the
"/sbin/init.d/idsagent start" commands interactively .
ssh -l root <machine> "/sbin/init.d/idsagent start"
ssh -l root <machine> "su - ids -c ’/opt/ids/bin/idsagent -a’ 2>&1"
System Manager appears to hang
❏ This may result if the System Manager is in the process of resyncing a large number
of alerts from a specific host. There are two possible workarounds for this problem:
• Wait. The System Manager will resume normal behavior when it completes
resynchronizing.
• Kill the System Manager. Move the file /var/opt/ids/alert.log to another
name on the agent host with which the System Manager is attempting to
resynchronize; then restart the System Manager.
❏ The System Manager may also hang and not refresh itself as a result of interaction
with the System Manager screen (for example, when a user attempts to resize the
screen). This appears to be a synchronization problem between the native window
manager (typically, mwm) and the Java windowing manager. Restarting the native
window manager may resolve the problem; if not, the System Manager should be
restarted.
System Manager does not let you save files to specific directories
❏ Verify that the user ids has read/write permission for the directory to which you are
trying to save a file.
System Manager does not start after idsgui is started
❏ Verify that the DISPLAY environment variable is set correctly.
❏ Verify that the correct Java version and required patches are installed. Refer to the
Release Notes cited in “Documentation” on page 3 for specific version information.
Check /var/opt/ids/gui/guiError.log for Java errors.
❏ If Java is properly installed, the swlist command may be running too slowly. Verify
this by running swlist. If the problem persists, contact HP support.