HP-UX Host Intrusion Detection System Version 4.2 Administration Guide

□ Verify that all keys have been generated as described in “Setting Up HP-UX HIDS Secure
Communications” (page 29).
□ Run /opt/ids/bin/IDS_checkInstall to verify that all required patches have been
installed properly prior to installing IDS. IDS_checkInstall should be run on an OS
where IDS is installed. If patches are missing, uninstall IDS (swremove), install the patches
(see the HP-UX HIDS Release 4.1 Release Notes ), and reinstall IDS (swinstall).
Agents appear to be stuck in polling status
In some instances, the combination of the autostatus and autosync processes leave some agents
in “polling” status. The workaround is to use autostatus only or to perform a manual status to
get the agent display into a known state.
Aggregated alerts targets or details field are truncated and the same aggregated
alert has several entries logged in the IDS_ALERTFILE
Problem: You may notice that the targets field or details field of an aggregated alert are truncated.
You may also notice that the aggregated alert has several entries in the IDS_ALERTFILE.
Cause: The maximum size of a message on an IPC message queue is smaller than the size of the
aggregated alert. The idscor process that generates the alerts and sends alerts to the idsagent
process using an IPC message queue, must therefore send the aggregated alert in chunks. The
idsagent process logs the alert chunks to IDS_ALERTFILE and then sends only the first chunk
to the System Manager.
Action: Increase the value of msgmax and msgmnb kernel tunables, preferably to a value greater
than or equal to the size of the aggregrated alert.
Alert date/time sort seems inconsistent
□ Two factors come into play in this seeming inconsistency: First, the agent’s date/time stamp
is based on the local host time when the alert was received. Second, the time the System
Manager uses to sort the alert is based on the UTC when the alert actually occurred. Under
normal circumstances, these two times are identical. On occasion, however, there may be a
difference depending on internal processing time, which may make the alert list inconsistent.
Alerts are not being displayed in the alert browser
□ Check to see if they are appearing in /var/opt/ids/alert.log.
□ Check for errors in the error browser.
□ Determine whether IDDS failed at boot-up: Use the /etc/dmesg command to verify that
there are no messages saying, IDDS disabled.
□ Verify that the host name and IP address are configured and valid.
□ In the event that the keys have become corrupted, regenerate all key sets using procedures
from “Setting Up HP-UX HIDS Secure Communications” (page 29).
□ Verify that the agent system is set to “Running” (with a green background) in the System
Manager.
□ Determine whether any changes have been made to the detection templates, which may
filter out the alerts (such as ignoring whole directories or users).
□ If no login/logout alerts are seen, /var/adm/wtmp might be corrupted. To check, run the
last command and see if it prints an error or segmentation faults. If so, you need to do the
following as root:
# rm /var/adm/wtmp
# touch /var/adm/wtmp
# chown adm:adm /var/adm/wtmp;
# chmod 644 /var/tmp/wtmp
On HP–UX 11i v2 operating systems, if removing wtmp still produces an error when running
the last command, also remove /var/adm/wtmps (it is automatically recreated).
Troubleshooting 215