HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

Alert date/time sort seems inconsistent
□ Two factors come into play in this seeming inconsistency: First, the agent’s date/time
stamp is based on the local host time when the alert was received. Second, the time
the System Manager uses to sort the alert is based on the UTC when the alert
actually occurred. Under normal circumstances, these two times are identical. On
occasion, however, there may be a difference depending on internal processing
time, which may make the alert list inconsistent.
Alerts are not being displayed in the alert browser
□ Check to see if they are appearing in /var/opt/ids/alert.log.
□ Check for errors in the error browser.
□ Determine whether IDDS failed at boot-up: Use the /etc/dmesg command to
verify that there are no messages saying, IDDS disabled.
□ Verify that the host name and IP address are configured and valid.
□ In the event that the keys have become corrupted, regenerate all key sets using
procedures from “Setting Up HP-UX HIDS Secure Communications” (page 34).
□ Verify that the agent system is set to “Running” (with a green background) in the
System Manager.
□ Determine whether any changes have been made to the detection templates, which
may filter out the alerts (such as ignoring whole directories or users).
□ If no login/logout alerts are seen, /var/adm/wtmp might be corrupted. To check,
run the last command and see if it prints an error or segmentation faults. If so,
you need to do the following as root:
# rm /var/adm/wtmp
# touch /var/adm/wtmp
# chown adm:adm /var/adm/wtmp;
# chmod 644 /var/tmp/wtmp
On HP–UX 11i v2 operating systems, if removing wtmp still produces an error
when running the last command, also remove /var/adm/wtmps (it is automatically
recreated).
□ Is the communication to the agent timing out?. Check the agent’s
/var/opt/ids/error.log for timeout messages. If timeout messages appear,
try increasing the timeout values in the agent’s /etc/opt/ids/ids.cf
configuration file; see “Remote Communication Configuration” (page 245).
□ If /var/opt/ids/error.log contains out-of-memory errors, the maximum
data segment size may need to be increased or more swap space might need to be
added. Run kmtune -l -q maxdsiz (kctune on HP-UX 11i v2 and HP-UX 11i
v3) and /usr/sbin/swapinfo to determine your current tunable setting and
swap usage, respectively.
272 Troubleshooting