HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Table B-3 Additional Arguments Passed to Response Programs for File Modification Failed
Attempt Alerts
DescriptionAlert Value/ FormatAlert Field TypeAlert Field
Response Program
Argument
Number
representing the
error.
<Error Number>
IntegerError Number
argv[36]
Return value of the
system call.
<System Call
Return Value>
IntegerSystem Call Return
Value
argv[37]
Table B-4 lists the additional arguments that are passed to response programs while
attempting the modification of files that belong to Modification of files/
directories template, Changes to Log File template, and Modification of
Another User’s File template when Duplicate Alert Suppression (DAS) is enabled.
Table B-4 Additional Arguments Passed to Response Programs for File Modification Failed
Attempt Alerts With DAS Enabled
DescriptionAlert Value/ FormatAlert Field TypeAlert Field
Response Program
Argument
Number
representing the
error.
<Error Number>
IntegerError Number
argv[38]
Return value of the
system call.
<System Call
Return Value>
IntegerSystem Call Return
Value
argv[39]
Table B-5 (page 163) lists the additional arguments that are passed to response programs for
Race Condition Template alerts.
Table B-5 Additional Arguments Passed to Response Programs for Race Condition Template
Alerts
DescriptionAlert Value/FormatAlert Data TypeAlert FieldResponse
Program
Argument
Full path name of the program
under attack
<full pathname>StringAttacked
Program Path
name
argv[36]
File type of the program under
attack. Corresponds to an enum
vtype value defined invnode.h
<type>IntegerAttacked
Program File
Type
argv[37]
Mode of the program under attack<mode> (decimal)IntegerAttacked
Program Mode
argv[38]
Owner of the program under attack
(uid)
<uid>IntegerAttacked
Program Owner
argv[39]
Group of the program under attack
(gid)
<gid>IntegerAttacked
Program Group
argv[40]
Inode number of the program
under attack
<inode>IntegerAttacked
Program Inode
argv[41]
Device number of the program
under attack
<device>IntegerAttacked
Program Device
argv[42]
How Automated Response Works in HP-UX HIDS 163