HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Correlator Process Configuration
The correlator section is bracketed by the [Correlator] ... [END] keywords. Only the parameters
in Table E-2 may be edited.
Table D-2 Correlator Configuration Variables
Default ValueName
““
CMDLINEARGS
“not set”
AGGREGATION
CMDLINEARGS Used to pass command line options to the idscor process. To measure the
average system call event rate on a host for the system calls monitored by HIDS, while running
a particular set of detection templates, set the value to -t <number> where <number> is the
number of events over which the rate is calculated.
For example, -t 100000 calculates the event rate for every 100,000 events. For more information,
see the “HP-UX HIDS Sizing and Tuning Primer”.
After setting the -t option with a value of 100,000, restart the schedule and look for lines like the
following in the agent’s error log:
Event# 100000: 2799.17 events/sec
Event# 200000: 1742.62 events/sec
Event# 300000: 1395.02 events/sec
The agent’s error log is defined by the IDS_ERRORFILE configuration variable described in
Table D-1 (page 192) (the default is /var/opt/ids/error.log).
If event rates do not start appearing in the agent’s error log after about a minute, the rate of
events generated on the system is probably low, so decrease the value of the -t argument to 10,000
or 1,000 in order to calculate the rate more often (that is, for every 10,000 or 1,000 system call
events instead of for every 100,000).
On the other hand, if there are continous large spikes in the event rate, the event rate is not being
calculated over a large enough sample. For example, the following output shows that the event
rate spikes constantly when calculated for every 1,000 events:
Event# 1000: 155933.27 events/sec
Event# 2000: 199.40 events/sec
Event# 3000: 152975.38 events/sec
Event# 4000: 199.41 events/sec
Event# 5000: 199.42 events/sec
Event# 6000: 156421.08 events/sec
Event# 7000: 199.38 events/sec
Event# 8000: 157505.12 events/sec
Event# 9000: 199.40 events/sec
Event# 10000: 141723.36 events/sec
The spikes are due to idscor receiving bursts of events and is probably a function of when
HIDS processes such as idskerndsp or idscor are scheduled to run.
For this example, using a sample rate of 10,000 (that is, -t 10000) results in a stable average
reading of the actual event rate:
Event# 10000: 331.02 events/sec
Event# 20000: 331.84 events/sec
NOTE: No intrusion detection is performed when the -t option is set. Make sure to remove the
-t option from CMDLINEARGS when deploying HIDS.
AGGREGATION
Used to override the schedule alert aggregation property value that specifies whether alert
aggregation is enabled or disabled. Set to 0 to disable alert aggregation. Set to 1 to enable alert
aggregation.
Correlator Process Configuration 193