HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

CMDLINEARGS Used to pass command line options to the idscor process. To measure
the average system call event rate on a host for the system calls monitored by HIDS,
while running a particular set of detection templates, set the value to -t <number>
where <number> is the number of events over which the rate is calculated.
For example, -t 100000 calculates the event rate for every 100,000 events. For more
information, see the “HP-UX HIDS Sizing and Tuning Primer”.
After setting the -t option with a value of 100,000, restart the schedule and look for
lines like the following in the agent’s error log:
Event# 100000: 2799.17 events/sec Event# 200000: 1742.62 events/sec Event# 300000:
1395.02 events/sec
The agent’s error log is defined by the IDS_ERRORFILE configuration variable described
in Table D-1 (page 240) (the default is /var/opt/ids/error.log).
If event rates do not start appearing in the agent’s error log after about a minute, the
rate of events generated on the system is probably low, so decrease the value of the -t
argument to 10,000 or 1,000 in order to calculate the rate more often (that is, for every
10,000 or 1,000 system call events instead of for every 100,000).
On the other hand, if there are continous large spikes in the event rate, the event rate
is not being calculated over a large enough sample. For example, the following output
shows that the event rate spikes constantly when calculated for every 1,000 events:Event#
1000: 155933.27 events/secEvent# 2000: 199.40 events/secEvent# 3000: 152975.38
events/secEvent# 4000: 199.41 events/secEvent# 5000: 199.42 events/secEvent# 6000:
156421.08 events/secEvent# 7000: 199.38 events/secEvent# 8000: 157505.12
events/secEvent# 9000: 199.40 events/secEvent# 10000: 141723.36 events/secThe spikes
are due to idscor receiving bursts of events and is probably a function of when HIDS
processes such as idskerndsp or idscor are scheduled to run.
For this example, using a sample rate of 10,000 (that is, -t 10000) results in a stable
average reading of the actual event rate:Event# 10000: 331.02 events/secEvent# 20000:
331.84 events/sec
NOTE: No intrusion detection is performed when the -t option is set. Make sure to
remove the -t option from CMDLINEARGS when deploying HIDS.
AGGREGATION
Used to override the schedule alert aggregation property value that specifies whether
alert aggregation is enabled or disabled. Set to 0 to disable alert aggregation. Set to 1
to enable alert aggregation.
Data Source Process Configuration
There is a configuration entry for each data source process. Each entry is surrounded
by [DSP] and [END] tags.
242 The Agent Configuration File