HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

To restart an agent, see “Starting HP-UX HIDS Agents” (page 61).
To halt agents remotely from the System Manager, follow these steps:
1. On the System Manager screen, in the Monitored Hosts list, select the hosts you
want to halt.
2. Perform one of the following tasks to halt the agent host:
• Choose the Actions > Halt IDS Agent menu item.
• Press Shift+F10.
The schedules, if any, are stopped on and removed from the selected host. The
agent is halted on the selected hosts. The Status fields are set to No Agent
Available and the Schedule field is set to None.
The schedules are not available for automatic restart.
Procedure 4-9 To halt the agent locally on the agent host, follow these steps:
• On the agent host, perform one of the following steps to halt the agent locally:
• Log in to the agent system as root and enter the following command:
$ kill -TERM $(cat /var/opt/ids/idsagent.pid)
NOTE: You can also do this as user ids.
• Log in to the agent system as superuser (root) and enter the command:
$/sbin/init.d/idsagent stop
This command is automatically executed when the agent system is shut down
with the shutdown command.
The agent is halted on the host. The status of the agent host on the System Manager
does not update itself automatically. The next time you run a System Manager
command for the agent, the Status field is set to No Agent Available and the
Schedule field is set to None on the System Manager screen.
When the agent is halted, the schedule, if any, is retained and remains available
for automatic restart.
IMPORTANT: If an agent did not halt as above, you may need to clean up the
message queues. For more information, see “Agent halts abnormally, leaving ids_*
files and message queues” (page 270).
Accessing Other Screens
You can access the following screens from the System Manager screen.
66 Using the System Manager Screen