HP-UX Host Intrusion Detection System Version 4.2 Administration Guide

Monitor Failed Attempts To Create / Modify / Delete Critical Files option box that is not selected.
By default, the property value is set to “0”.
• log_severity_def: This property defines the default severity level for alerts that are
generated by the Log File Monitoring Template. For more information, see “Log File
Monitoring Template” (page 155). The property value is specified using the syntax described
in “Type VIII: Scalars” (page 120). By default, the property value is set to “3”. For a list of
valid severity levels, see “Alerts Tab” (page 96).
For more information on regular expressions, see “UNIX Regular Expressions ” (page 114)
Surveillance Group Section
The section contains the following keywords and syntax:
GROUPPERIOD
NAME <group name>
GMT <integer>
STARTTIME hh:mm:d
ENDTIME hh:mm:d
GROUP <group name>...
ENDGROUP
ENDGROUPPERIOD
This section is a subsection of the surveillance schedule section. The section is bracketed by the
GROUPPERIOD and ENDGROUPPERIOD keywords. Each GROUPPERIOD section can have only
one GROUP or ENDGROUP section. The templates and their property values are stored in the
corresponding group file and not in the schedule file. Each group exists as individual files within
the groups subdirectory and can be used across multiple schedules. To include a group in a
schedule, the name of the group must be added within the GROUPPERIOD NAME keyword in
the schedule file. If a change is made to a particular group file, that change is applicable to all
the schedules that reference that group. However, the GMT , STARTTIME , and ENDTIME keywords
in the schedule file enable you to specify varying start and end times for the same group on
different schedules.
• The name in the GROUPPERIOD NAME keyword and the name of the group file located
in the groups subdirectory must match (not including the file extension) and they must be
unique across all surveillance group names specified in the surveillance schedule text file.
The name of a group must consist of an alphanumeric character followed by one or more
alphanumeric characters, an underscore (_) or a hyphen (-).
• If the GMT keyword value is set to 0, then the time specified by the STARTTIME and ENDTIME
entries are interpreted as local time. If the GMT keyword value is set to 1, then the time
specified by the STARTTIME and ENDTIME entries are interpreted as GMT time and is
converted to local time when scheduling the surveillance group.
• The STARTTIME and ENDTIME keyword values denote when the surveillance group’s
templates start running and stop running, respectively. The keyword values use the hh:mm:d
syntax. The 2 digit hh field specifies the hour (that is, 00 for 12am, 01 for 1am, 11 for 11am,
13 for 1pm, 23 for 11pm). The 2 digit mm field specifies the number of minutes elapsed after
the hour (that is, 00 for on the hour,15 for 15 minutes after the hour, 59 for 59 minutes after
the hour). The single digit d field specifies the day of the week, where 0 is for Sunday, 1 is
for Monday, 2 is for Tuesday, etc...and 6 is for Saturday. For example, to run a surveillance
group’s templates only during the workweek, use a STARTTIME value of 00:00:1 and
ENDTIME value of 23:59:5. The combination of a STARTTIME value of 0:00:0 and an ENDTIME
value of 23:59:6 are special values that denote that a schedule should continuously run.
200 The Surveillance Schedule Text File