HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

NOTE: In the Schedule Manger window, only the property values "N1 | N2 | ... |
Np" are entered when setting a template property. Do not enter the Property-name or
the first pipe( | ) character in the example when entering a template property in a
template property edit window.
The following semantics are used when parsing template properties:
• Multiple consecutive occurrences of space and tab characters are equivalent to a
single space character.
• The hash character (#) is the comment character. Everything to the right of the
comment character till the end of the template property is ignored.
• The comment character can be placed anywhere in a template property.
• Blank lines are ignored.
• A template property is terminated by a new line character \n, unless such character
is immediately preceded by a backslash character‚ in which case the new line
character is ignored. This allows for a template property to be spread over several
lines.
• If a filename contains a pipe (|), ampersand (&) or comma (,) character, then those
special characters must be escaped using a backslash (\) character because these
three characters are used as delimiters by the template property syntax. See “UNIX
Regular Expressions ” (page 138) for an example.
• Property names are case-insensitive.
• Each Ni is a particular value for the property-name in a given command line.
Property values are separated from property-name and from each other by a pipe
character (|).
• The actual interpretation of each property value will depend on the specific
property-name with which it is associated. Property types are listed at “Template
Property Syntax” (page 253). The valid interpretations are the following:
— A positive integer, possibly followed by a units symbol.
— A regular expression. Regular expressions can comprise the reserved separator
characters, which should then be escaped by a backslash character.
— A group of ampersand-separated subvalues Si, :
S1 & S2 & ... Sq
The interpretation of these subvalues will again depend on the particular
property they are assigned to. This is however mainly meant to be used in the
pathnames/programs lists listed on “Type II: Path Names/Programs Pairs”
(page 141)).
— A group of comma-separated subvalues Ti:
T1, T2,..., Tn
The subvalues are integers.
— Any property-name can have an arbitrary number of property values, but it
must have at least one. Properties without any values are considered to be an
error.
254 The Surveillance Schedule Text File