HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

This section is a subsection of the surveillance schedule section. The section is bracketed
by the GROUPPERIOD and ENDGROUPPERIOD keywords. Each GROUPPERIOD section
can have only one GROUP or ENDGROUP section. The templates and their property values
are stored in the corresponding group file and not in the schedule file. Each group
exists as individual files within the groups subdirectory and can be used across multiple
schedules. To include a group in a schedule, the name of the group must be added
within the GROUPPERIOD NAME keyword in the schedule file. If a change is made to
a particular group file, that change is applicable to all the schedules that reference that
group. However, the GMT , STARTTIME , and ENDTIME keywords in the schedule file
enable you to specify varying start and end times for the same group on different
schedules.
• The name in the GROUPPERIOD NAME keyword and the name of the group file
located in the groups subdirectory must match (not including the file extension)
and they must be unique across all surveillance group names specified in the
surveillance schedule text file. The name of a group must consist of an alphanumeric
character followed by one or more alphanumeric characters, an underscore (_) or
a hyphen (-).
• If the GMT keyword value is set to 0, then the time specified by the STARTTIME
and ENDTIME entries are interpreted as local time. If the GMT keyword value is set
to 1, then the time specified by the STARTTIME and ENDTIME entries are interpreted
as GMT time and is converted to local time when scheduling the surveillance group.
• The STARTTIME and ENDTIME keyword values denote when the surveillance
group’s templates start running and stop running, respectively. The keyword
values use the hh:mm:d syntax. The 2 digit hh field specifies the hour (that is, 00
for 12am, 01 for 1am, 11 for 11am, 13 for 1pm, 23 for 11pm). The 2 digit mm field
specifies the number of minutes elapsed after the hour (that is, 00 for on the hour,15
for 15 minutes after the hour, 59 for 59 minutes after the hour). The single digit d
field specifies the day of the week, where 0 is for Sunday, 1 is for Monday, 2 is for
Tuesday, etc...and 6 is for Saturday. For example, to run a surveillance group’s
templates only during the workweek, use a STARTTIME value of 00:00:1 and
ENDTIME value of 23:59:5. The combination of a STARTTIME value of 0:00:0 and
an ENDTIME value of 23:59:6 are special values that denote that a schedule should
continuously run.
Surveillance Group Section 251