HP-UX Host Intrusion Detection System Version 4.3 administrator guide

IDDS_MODE 0
Turn off status gathering and block
processes if audit data is generated faster
than the agent can consume it. This
option sacrifices system performance for
totally reliable information gathering.
IDDS_MODE 2
Gather status information on numbers of
audit records read or written but still
block the kernel. Do not drop audit
records in the kernel but a read of
/dev/idds will return immediately if no
data is available.
IDDS_MODE 4
Gather status information on numbers of
audit records read or written but still
block the kernel.
IDDS_MODE 7
Gather status information, but do not
block the processes. Instead, audit records
will be dropped if there is no space to
read them into. This option sacrifices
reliability of information for system
performance.
Recommended settings:
IDDS_MODE 2
Provides greater security at expense of
performance.
IDDS_MODE 3
Provides performance at the expense of
lost audit data, which could lead to
missed intrusion attempts.
LOW_WATERMARK
When audit records have been dropped and then are no
longer being dropped, this watermark specifies the
maximum percent of space in the high channel that must be
in use before a notification message is sent to the main
idsagent process to indicate that audit records are no
longer being dropped. The default is 50 (percent).
MONITOR_FAILED_ATTEMPTS
This parameter can be used to override the
monitor_failed_attempt schedule global property. See
“Surveillance Schedule Section” (page 198) for details about
the monitor_failed_attempt schedule property.
Remote Communication Configuration
The remote communication configuration section lies between the [RemoteSA] and [END] tags.
Only the parameters in Table D-4 may be edited.
CAUTION: Do not edit any other variables between [RemoteSA] and its [END] tag.
Table D-4 Correlator Configuration Variables
Default ValueName
12IDS_CONNECT_TIMEOUT
12IDS_READ_TIMEOUT
12IDS_WRITE_TIMEOUT
60IDS_SSL_TIMEOUT
(hostname passed to IDS_importAgentKeys)
REMOTEHOST
They are defined as follows:
Remote Communication Configuration 195