HP-UX Host Intrusion Detection System Version 4.3 administrator guide
Table Of Contents
- HP-UX Host Intrusion Detection System Version 4.3 administrator guide
- Table of Contents
- About This Document
- 1 Introduction
- 2 Configuring HP-UX HIDS
- 3 Getting Started with HP-UX HIDS
- 4 Using the System Manager Screen
- Starting the HP-UX HIDS System Manager
- Stopping the HP-UX HIDS System Manager
- System Manager Components
- Starting HP-UX HIDS Agents
- Getting the Status of Agent Hosts
- Resynchronizing Agent Hosts
- Activating Schedules on Agent Hosts
- Stopping Schedules on Agent Hosts
- Halting HP-UX HIDS Agents
- Accessing Other Screens
- 5 Using the Schedule Manager Screen
- The Schedule Manager
- Configuring Surveillance Schedules
- Configuring Surveillance Groups
- Configuring Detection Templates
- Setting Surveillance Schedule Timetables
- Configuring Alert Aggregation
- Configuring Monitor Failed Attempts
- Configuring Duplicate Alert Suppression
- Viewing Surveillance Schedule Details
- Predefined Surveillance Schedules and Groups
- 6 Using the Host Manager Screen
- 7 Using the Network Node Screen
- 8 Using the Preferences Screen
- A Templates and Alerts
- Alert Summary
- UNIX Regular Expressions
- Limitations
- Template Property Types
- Buffer Overflow Template
- Race Condition Template
- Modification of files/directories Template
- Changes to Log File Template
- Creation and Modification of setuid/setgid File Template
- Creation of World-Writable File Template
- Modification of Another User’s File Template
- Login/Logout Template
- Repeated Failed Logins Template
- Repeated Failed su Commands Template
- Log File Monitoring Template
- B Automated Response for Alerts
- C Tuning Schedules and Generating Alert Reports
- D The Agent Configuration File
- E The Surveillance Schedule Text File
- F Error Messages
- G Troubleshooting
- Troubleshooting
- Agent and System Manager cannot communicate with each other
- Agent complains that idds has not been enabled, yet lsdev shows /dev/idds is present
- Agent does not start on system boot
- Agent halts abnormally, leaving ids_* files and message queues
- Agent host appears to hang and/or you see message disk full
- Agent needs further troubleshooting
- Agent does not start after installation
- Agents appear to be stuck in polling status
- Agent displays error if hostname to IP mapping is not registered in name service
- Aggregated alerts targets or details field are truncated and the same aggregated alert has several entries logged in the IDS_ALERTFILE
- Alert date/time sort seems inconsistent
- Alerts are not being displayed in the alert browser
- Buffer overflow triggers false positives
- Duplicate alerts appear in System Manager
- Getting several aggregated alerts for the same process
- GUI runs out of memory after receiving around 19,000 alerts
- The idsadmin Command needs installed agent certificates
- The idsadmin Command notifies of bad certificate when pinging a remote agent
- IDS_checkInstall fails with a kmtune error
- IDS_genAdminKeys or IDS_genAgentCerts does not complete successfully
- IDS_genAdminKeys or idsgui quits early
- Large files in /var/opt/ids
- Log files are filling up
- No Agent Available
- Normal operation of an application generates heavy volume of alerts
- Reflection X rlogin produces multiple login and logout alerts
- Schedule Manager timetable screen appears to hang
- SSH does not perform a clean exit after idsagent is started
- System Manager appears to hang
- System Manager does not let you save files to specific directories
- System Manager does not start after idsgui is started
- System Manager starts with no borders or title bar in X client programs on Windows
- System Manager times out on agent functions such as Activate and Status Poll
- UNKNOWN program and arguments in certain alert messages
- Using HP-UX HIDS with IPFilter and SecureShell
- Unable to Generate Administrator Keys and Agent Certificates on PA–RISC 1.1 Systems
- Troubleshooting
- H HP Software License
Table F-1 Agent Error Messages (continued)
ActionMeaningError Message
Contact HP support.An internal error occurred while
attempting to reopen error reporting. The
per-process limit on file descriptors may
have been reached.
idsagent: failed to reopen stderr in
append mode
Contact HP support.
The idsagent encountered an error while
attempting to activate a surveillance
group. The surveillance group may
contain detection templates that are not
supported on this version of the idsagent.
idsagent: failed to start group
Contact HP support.
The idsagent encountered an error while
attempting to deactivate a surveillance
group.
idsagent: failed to stop group
Evaluate the errors in the /var/
opt/ids/error.log log file.
Contact HP support.
A problem occurred during idagent
initialization.
idsagent: idsagent initialization
failed. See /var/opt/ids/error.log for
details. Exiting
Verify that the crontab entry for
user ids exists. Contact HP support.
The idsagent was unable to correctly
determine which surveillance group to
start or stop.
idsagent: internal error in handling
signature groups
Contact HP support.An HP-UX HIDS subprocess has died
unexpectedly.
idsagent: one of the IDS processes
died abnormally: halting schedule
execution
Execute the
IDS_importAgentKeys program
to import the certificates for this
agent.
The final stage of the certificate installation
process was not performed.
idsagent: please run the /opt/
ids/bin/
IDS_importAgentKeys script to
complete IDS installation
Contact HP support.An HP-UX HIDS agent subprocess with
PID pid and name pname has failed
unexpectedly, as described in msg.
idsagent: process (PID:pid) pname
died abnormally with error: msg
Contact HP support.An internal error occurred in handling
signals.
idsagent: unable to set up
SIGCHLD signal handler
Contact HP support.An internal error occurred in handling
signals.
idsagent: unable to set up SIGHUP
signal handler
Contact HP support.An internal error occurred in handling
signals.
idsagent: unable to set up signal
handler
Contact HP support.An internal error occurred in handling
signals.
idsagent: unable to set up
SIGSEGV signal handler
Contact HP support.An internal error occurred in handling
signals.
idsagent: unable to set up
SIGTERM signal handler
Contact HP support.An internal error occurred in handling
signals.
idsagent: unable to set up SIGUSR1
signal handler
Contact HP support.An internal error occurred in handling
signals.
idsagent: unable to set up SIGUSR2
signal handler
Contact HP support.The idsagent failed to parse the
surveillance schedule.
idsagent: an error occurred parsing
the schedule
Contact HP support.An internal error occurred while opening
the surveillance schedule file file.
idsagent: cannot get file pointer for
schedule file - file.
Verify that the alert response script
has execute permissions.
The idsagent was unable to execute alert
response script script.
idsagent: could not execute alert
response script script.
204 Error Messages