HP-UX Host Intrusion Detection System Version 4.2 Administration Guide

2. Select one of the following options to resynchronize:
• Click the Resync button.
• Choose the Actions > Resync menu item.
• Press Shift+F6.
• Right-click in the Monitored Hosts area and select Resync from the menu.
Any alerts in each agent’s log file that are newer than the last one seen by the System Manager
are transferred to the System Manager’s log files. The numbers are updated on the Monitored
Hosts list and the alerts and errors are displayed on the Network Node screen for each host.
The updates continue as alerts and errors are generated and the System Manager runs.
Activating Schedules on Agent Hosts
To provide intrusion detection, you must activate surveillance schedules on the agent hosts. You
also use this procedure to replace a schedule on one or more hosts.
To activate a surveillance schedule on agent hosts, follow these steps:
1. On the System Manager screen, in the Monitored Hosts list, select the hosts to be activated.
Their Status fields must show Available, Scheduled, or Running.
2. In the Schedules list, select the surveillance schedule you want to activate.
3. Select one of the following options to activate the schedule:
• Click the Activate button.
• Choose the Actions > Activate Schedule menu item.
• Press Shift+F8.
• Right-click (in the Monitored Hosts area) and select Activate Schedule from the menu.
4. If any of the agent hosts is already running a schedule, the Confirm Schedule Activation
dialog box appears. Click Yes to override existing surveillance schedule, and No to cancel.
5. If the activation is successful, the Status column indicates Scheduled or Running, and the
name of the downloaded surveillance schedule is displayed in the Schedule column of the
selected hosts; otherwise, Error or No Agent Available is displayed in the Status
column.
6. If Error is shown for a host, view the error messages on the Network Node Error tab for
the host. For more information see “Network Node Screen” (page 56) and “Errors Tab ”
(page 97) then check the status. For more information, see “Getting the Status of Agent
Hosts” (page 51).
If No Agent Available is shown for a host, see “No Agent Available” (page 218) for
troubleshooting options.
Stopping Schedules on Agent Hosts
When you stop a surveillance schedule on an agent host, the schedule is removed from the agent
and ceases to be scheduled or running. The agent program continues running, ready to accept
future actions.
If you want to replace one schedule with another, just activate the new one. For more information,
see “Activating Schedules on Agent Hosts” (page 53).
To stop a surveillance schedule on agent hosts, follow these steps:
1. On the System Manager screen, in the Monitored Hosts list, select one or more hosts on
which you want to stop the schedules.
Activating Schedules on Agent Hosts 53