HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Table A-28 Repeated Failed Su Attempts Alert Properties (continued)
DescriptionAlert Value/FormatAlert Field
Type
Alert FieldResponse
Program
Argument
Indicates a failed su alert versus
a failed login alert
2IntegerFlagargv[10]
The tty from which a failed su
attempt was made
<tty>
StringDeviceargv[11]
The name of the user attempting
to su
<username>
StringFromargv[12]
The target user of the last failed
su attempt
<username>
StringToargv[13]
Limitations
The Repeated Failed su Commands Template has no limitations.
Log File Monitoring Template
How this template is useful
Log files are critical files because applications or the system typically logs messages that can
indicate they are compromised or misused by unauthorized users. This template enables
administrators to receive real-time alerts when log entries considered either critical or indicative
of an intrusion or misuse are logged in a plain text log file. Administrators specify the path names
of the log files to monitor and the patterns to monitor for each log file.
How this template is configured
Table A-29 “Log File Monitoring Template Properties” lists the configurable properties that this
template supports. Each property can be specified for each log file being monitored. See examples
below.
Table A-29 Log File Monitoring Template Properties
DescriptionDefault ValueTypeName
The absolute pathname of the log file
being monitored.
/opt/apache/logs/error_logXI
logfile
Regular expression string patterns that
specify log entries of interest.
“authentication failure for"X
watch
Regular expression string patterns to
selectively filter out log entries that
matched a "watch" pattern.
"user ids"X
ignore
Severity of alert generated when a log
entry of interest is detected.
2VIII
severity
If a log entry matches a string pattern in the watch property and does not match a string pattern
in the ignore property, then an alert is generated. If a log entry matches a string pattern in the
watch property as well as a string pattern in the ignore property, then the log entry will be
ignored and an alert will not be issued. The watch and ignore properties are optional. However,
the template will not monitor a log file unless there is at least one string pattern specified by the
watch property.
The string patterns specified as values for the watch and ignore properties must be enclosed
within double quotes (") even if the pattern contains no white space characters; otherwise, a
parsing error will occur. String patterns that contain one of the special delimiter characters used
by the template parser (that is, pipe(|), ampersand (&) and comma (,)) should not have those
Log File Monitoring Template 155