HP-UX Host Intrusion Detection System Version 4.2 Administration Guide

detection templates (most offer mechanisms by which these spurious alerts can be
suppressed).
□ For example, a system with the Resource Management subsystem might trigger a heavy
volume of alerts since it frequently updates some files in /etc/opt/resmon. You can go
to the Schedule Manager and modify the “Modification of files/directories” template to
have it ignore the /etc/opt/resmon directory. (This filtering is provided by default in
HP-UX HIDS version 2.2.)
□ See “Suggested Best Practices” (page 69).
Reflection X rlogin produces multiple login and logout alerts
When logging in using rlogin within Reflection X, the login/logout template will report two
login alerts followed immediately by a logout alert. This is expected behaviour and reflects how
Reflection X immediately terminates a login session after bringing up a remote window.
Schedule Manager timetable screen appears to hang
□ The visual refresh of the day, time, and surveillance group matrix (which the System Manager
maintains in the Schedule Manager timetable screen) is CPU intensive and hence may
appear to be slow on some systems.
SSH does not perform a clean exit after idsagent is started
After starting idsagent from a ssh login, logging out of the agent system results in the ssh session
hanging indefinitely. The following are some workarounds:
ssh -l root <machine> /usr/dt/bin/dtterm
ssh -l root <machine> "/sbin/init.d/idsagent start
ssh -l root <machine> "su -ids -c '/opt/ids/bin/idsagent -a' 2>&1"
System Manager appears to hang
□ This may result if the System Manager is in the process of resyncing a large number of alerts
from a specific host. There are two possible workarounds for this problem:
• Wait. The System Manager will resume normal behavior when it completes
resynchronizing.
• Kill the System Manager. Move the file /var/opt/ids/alert.log to another name
on the agent host with which the System Manager is attempting to resynchronize; then
restart the System Manager.
□ The System Manager may also hang and not refresh itself as a result of interaction with the
System Manager screen (for example, when a user attempts to resize the screen). This
appears to be a synchronization problem between the native window manager (typically,
mwm) and the Java windowing manager. Restarting the native window manager may resolve
the problem; if not, the System Manager should be restarted.
System Manager does not let you save files to specific directories
□ Verify that the user ids has read/write permission for the directory to which you are trying
to save a file.
System Manager does not start after idsgui is started
□ Verify that the DISPLAY environment variable is set correctly.
□ Verify that the correct Java version and required patches are installed. Refer to the HP-UX
HIDS 4.1 Release Notes for specific version information. Check /var/opt/ids/gui/
guiError.logfor Java errors.
□ If Java is properly installed, the swlist command may be running too slowly. Verify this
by running swlist. If the problem persists, contact HP support.
Troubleshooting 219