HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

screen). This appears to be a synchronization problem between the native window
manager (typically, mwm) and the Java windowing manager. Restarting the native
window manager may resolve the problem; if not, the System Manager should be
restarted.
System Manager does not let you save files to specific directories
□ Verify that the user ids has read/write permission for the directory to which you
are trying to save a file.
System Manager does not start after idsgui is started
□ Verify that the DISPLAY environment variable is set correctly.
□ Verify that the correct Java version and required patches are installed. Refer to the
HP-UX HIDS 4.1 Release Notes for specific version information. Check
/var/opt/ids/gui/guiError.logfor Java errors.
□ If Java is properly installed, the swlist command may be running too slowly.
Verify this by running swlist. If the problem persists, contact HP support.
System Manager starts with no borders or title bar in X client programs on Windows
□ This sometimes happens when Reflection X (or other X client programs on Microsoft
Windows) has been running for a while. Quit, restart the program, relogin to your
HP-UX HIDS administration system, and restart the System Manager. If the
problem persists, contact HP support.
System Manager times out on agent functions such as Activate and Status Poll
□ This may be the result of one of these problems: (1) idsagent has hung, (2)
idsagent has died or is not responding properly, or (3) the System Manager is
expecting responses back from the idsagent too quickly.
• If idsagent appears to have hung, restart idsagent. See “Forcing Active
Agent to Reread Configuration File” (page 239).
• If the idsagent has died, then restart it. See “Starting HP-UX HIDS Agents”
(page 61).
• If the System Manager seems to be expecting responses back too quickly, then
increasing the Agent Response Timeout value may help alleviate the problem.
See “General Preferences” (page 127).
UNKNOWN program and arguments in certain alert messages
Sometimes, alerts occur specifying an UNKNOWN program and arguments. For
example:
uid=-1, gid=-1, pid=-1, ppid=-1 file=/dev/dlpi,
type=4, mode=8630, uid=0, gid=3, inode=128,
device=1073741827 Non-owned file being modified
User with uid 0 opened for modificati on/truncation
/dev/dlpi (type=4,inode=128,device=1073741827)
(owned by user with uid 0) when executing UNKNOWN,
278 Troubleshooting