HP-UX Host Intrusion Detection System Version 4.2 Administration Guide

In either case, you can try running the command again.
The solution is to apply the latest Software Distributor (SD) Cumulative Patch. For 11i and 11i
version 1.6, install PHCO_25887 or a superseding patch, if any.
Large files in /var/opt/ids
□ The communication between idskerndsp and idscor uses a memory-mapped file, which
normally only exists (in the /var/opt/ids directory) when a surveillance schedule is
running. The files are named ids_n, where n is incremented from 1001 for each activated
schedule.
□ If idsagent has a problem, the files may not be deleted normally. If no schedule is running
on the agent, there should be no ids_n files. You can safely delete them with the rm
command.
Log files are filling up
□ The log files on both the agent and the administration systems can grow without bounds.
It’s a good idea to practise log file rotation. See “Log File Rotation” (page 191).
No Agent Available
□ The Status field for an agent on the System Manager screen shows No Agent Available.
See also “Agent and System Manager cannot communicate with each other” (page 212).
1. Is the agent running? On the agent host, run
ps -ef grep idsagent
If there is no entry for idsagent, start the agent on the agent system, as in “Starting
HP-UX HIDS Agents” (page 51).
Then, on the System Manager screen, click the Status button.
2. Is the IP address for the agent correct in the Host Manager screen? Test with nslookup.
3. Is the Domain Name Service (DNS) set up correctly? Test with nslookup.
4. Can the administration system communicate with the agent system? Test with ping.
5. Is the agent communicating correctly with the administration system? Check the entry
for REMOTEHOST in the /etc/opt/ids/ids.cf agent configuration file. It must be
set to the host name or IP address of the administration system. If the INTERFACE
variable is set to an IP address (other than 0.0.0.0 or ::) in /opt/ids/bin/idsgui
on the administration system, REMOTEHOST must be set to the same value. See
“Configuring a Multihomed Administration System” (page 37) and “Setting Up HP-UX
HIDS Secure Communications” (page 29).
6. Have the secure communications certificates expired?
– On the administration system, run the script
/opt/ids/bin/IDS_checkAdminCert. If the certificate has expired, rerun
/opt/ids/bin/IDS_genAdminKeys with the update parameter. See “Setting
Up HP-UX HIDS Secure Communications” (page 29).
– On the agent system, run the script /opt/ids/bin/IDS_checkAgentCert. If
the certificate has expired, rerun /opt/ids/bin/IDS_genAgentCerts for the
agent on the administration system. Then reimport the certificates on the agent
system with /opt/ids/bin/IDS_importAgentKeys. See “Setting Up HP-UX
HIDS Secure Communications” (page 29) .
Normal operation of an application generates heavy volume of alerts
□ To avoid becoming overwhelmed with unnecessary alert generation, you will need to
customize the detection templates to meet the needs of your particular environment. If you
have an application that generates a heavy volume of alerts during its normal mode of
operation, you can reduce this occurrence by entering additional filtering into the necessary
218 Troubleshooting