HP-UX Host Intrusion Detection System Version 4.3 administrator guide

values of 23 seconds, 10 minutes, 1 hour and 23 seconds; the s component in the last line is
redundant, but can be used for clarity.
fail_interval | 23
warning_interval | 10m
fail_interval | 1h
warning_interval | 23s
NOTE: You cannot specify the time unit value in the Schedule Manager screen.
Type VII: Flags
The Type VII property value is an integer used to enable or disable a flag. A value of 1 means
enabled, and a value of 0 means disabled. For example, the following properties of the
Login/Logout template specify that the monitoring of logins is enabled, and the monitoring of
successful su commands is disabled:
monitor_login_flag | 1
monitor_su_flag | 0
Type VIII: Scalars
The Type VIII property value is a single integer. However, this value can be any integer. For
example, the following property of the Buffer Overflow template specifies that 500 is considered
an unusually long argument length when invoking a priviledged setuid program:
unusual_arg_len | 500
Type IX: Path Names / Integer Pairs
The Type IX property specifies pairs of path names and integers. In each pair, the two members
are separated by a comma and pairs are separated by a pipe. The path name is interpreted as
regular expressions and extended regular expressions. For more information on regular
expressions, see “UNIX Regular Expressions ” (page 114). The integer is interpreted to be of type
Type VI: Time Strings.
Currently, only the global alert aggregation tuples property is of this type. For more information,
see “Surveillance Schedule Text File” (page 198).
Type X: String Patterns
The Type X property value is a list of regular expression string patterns that are separated by
the pipe (|) character and that can be grouped using the ampersand (&) character. Type X
properties are similar to Type I properties. However, Type I properties are regular expressions
for specifying pathnames while Type X properties are regular expressions for specifying string
patterns in general. Type X property values must be enclosed using double quotes to denote the
start and end of the string pattern.
This property type is currently used only in the Log File Modification Template for
specifying log file entries to monitor or ignore.
NOTE: When specifying the template property value in the Schedule Manager window, enter
only string patterns enclosed in double quotes and the ampersand (&) character if grouping 2
or more string patterns.
For example, the following line specifies the Log File Monitoring template property to monitor
log file entries that contain either the string "file system full" or both the string "fail" and
"authentication":
watch | "file system full" | "fail" & "authentication"
For examples of regular expressions, see “UNIX Regular Expressions ” (page 114).
120 Templates and Alerts