HP-UX Host Intrusion Detection System Version 4.3 administrator guide
Table Of Contents
- HP-UX Host Intrusion Detection System Version 4.3 administrator guide
- Table of Contents
- About This Document
- 1 Introduction
- 2 Configuring HP-UX HIDS
- 3 Getting Started with HP-UX HIDS
- 4 Using the System Manager Screen
- Starting the HP-UX HIDS System Manager
- Stopping the HP-UX HIDS System Manager
- System Manager Components
- Starting HP-UX HIDS Agents
- Getting the Status of Agent Hosts
- Resynchronizing Agent Hosts
- Activating Schedules on Agent Hosts
- Stopping Schedules on Agent Hosts
- Halting HP-UX HIDS Agents
- Accessing Other Screens
- 5 Using the Schedule Manager Screen
- The Schedule Manager
- Configuring Surveillance Schedules
- Configuring Surveillance Groups
- Configuring Detection Templates
- Setting Surveillance Schedule Timetables
- Configuring Alert Aggregation
- Configuring Monitor Failed Attempts
- Configuring Duplicate Alert Suppression
- Viewing Surveillance Schedule Details
- Predefined Surveillance Schedules and Groups
- 6 Using the Host Manager Screen
- 7 Using the Network Node Screen
- 8 Using the Preferences Screen
- A Templates and Alerts
- Alert Summary
- UNIX Regular Expressions
- Limitations
- Template Property Types
- Buffer Overflow Template
- Race Condition Template
- Modification of files/directories Template
- Changes to Log File Template
- Creation and Modification of setuid/setgid File Template
- Creation of World-Writable File Template
- Modification of Another User’s File Template
- Login/Logout Template
- Repeated Failed Logins Template
- Repeated Failed su Commands Template
- Log File Monitoring Template
- B Automated Response for Alerts
- C Tuning Schedules and Generating Alert Reports
- D The Agent Configuration File
- E The Surveillance Schedule Text File
- F Error Messages
- G Troubleshooting
- Troubleshooting
- Agent and System Manager cannot communicate with each other
- Agent complains that idds has not been enabled, yet lsdev shows /dev/idds is present
- Agent does not start on system boot
- Agent halts abnormally, leaving ids_* files and message queues
- Agent host appears to hang and/or you see message disk full
- Agent needs further troubleshooting
- Agent does not start after installation
- Agents appear to be stuck in polling status
- Agent displays error if hostname to IP mapping is not registered in name service
- Aggregated alerts targets or details field are truncated and the same aggregated alert has several entries logged in the IDS_ALERTFILE
- Alert date/time sort seems inconsistent
- Alerts are not being displayed in the alert browser
- Buffer overflow triggers false positives
- Duplicate alerts appear in System Manager
- Getting several aggregated alerts for the same process
- GUI runs out of memory after receiving around 19,000 alerts
- The idsadmin Command needs installed agent certificates
- The idsadmin Command notifies of bad certificate when pinging a remote agent
- IDS_checkInstall fails with a kmtune error
- IDS_genAdminKeys or IDS_genAgentCerts does not complete successfully
- IDS_genAdminKeys or idsgui quits early
- Large files in /var/opt/ids
- Log files are filling up
- No Agent Available
- Normal operation of an application generates heavy volume of alerts
- Reflection X rlogin produces multiple login and logout alerts
- Schedule Manager timetable screen appears to hang
- SSH does not perform a clean exit after idsagent is started
- System Manager appears to hang
- System Manager does not let you save files to specific directories
- System Manager does not start after idsgui is started
- System Manager starts with no borders or title bar in X client programs on Windows
- System Manager times out on agent functions such as Activate and Status Poll
- UNKNOWN program and arguments in certain alert messages
- Using HP-UX HIDS with IPFilter and SecureShell
- Unable to Generate Administrator Keys and Agent Certificates on PA–RISC 1.1 Systems
- Troubleshooting
- H HP Software License

Table F-1 Agent Error Messages (continued)
ActionMeaningError Message
Contact HP support.An internal error occurred.idsagent internal error occurred in
PM_StopGroup
Verify that the log file is owned by
user:group ids:ids, that the ids
user has read and write permissions
on the file, and that its parent
directory has read and write
permissions.
If a log file created by idsagent was
changed, then idsagent attempts to
reopen it. The open attempt failed.
idsagent: logfile file was changed
and cannot be reopened
Verify that the configuration file is
owned by user:group ids:ids, that
it is readable by user ids, and that
it has not been corrupted.
The idsagent received a SIGHUP but
encountered an error while rereading the
/etc/opt/ids/ids.cf configuration
file.
idsagent: new configuration failed
Contact HP support.A surveillance schedule contains a
reference to a detection template that is
not supported on this agent.
idsagent: No support for template
named template
Free up disk space in the /var
partition.
The /var partition is full.
idsagent: not enough disk space
available to create log file file
Ensure that there is at least 20 MB
of free disk space in the /var
partition. You can remove any files
with names in the form /var/opt/
ids/ids_10*.
The system does not have enough disk
space to create the interprocess
communication files in /var/opt/ids.
HP-UX HIDS uses memory mapped files,
each 20 MB in size.
idsagent: not enough disk space to
create memory mapped file
Ensure that there is at least 10 MB
of free disk space in the /var
partition.
The /var partition is full and the
idsagent cannot save the schedule to
disk.
idsagent: not enough disk space to
create schedule
Ensure that there is free disk space
in the /var partition.
The idsagent was unable to parse the
surveillance schedule because the system
has exhausted its disk space.
idsagent: not enough disk space to
parse schedule
Clean up the root file system
partition to free space.
The system has exhausted the disk space
in the root file system partition.
idsagent: not enough disk space to
save config file
Your system has run out of process
table space. Either kill unneeded
processes or reconfigure the kernel
to allow for more user processes.
There are no process table slots free on the
system.
idsagent: out of process table space
Verify that you have the latest
version of HP-UX HIDS installed on
the agent system.
The surveillance schedule contains
detection templates that are not supported
by this version of the idsagent.
idsagent: schedule cannot be
executed as specified
Verify that the surveillance schedule
contains surveillance groups in the
Schedule Manager window of the
HP-UX HIDS System Manager.
A surveillance schedule sched was
activated on the agent that did not contain
any valid surveillance groups.
idsagent: Surveillance Schedule
sched does not contain any
surveillance group periods
If running on a multihomed system,
set the IDS_LISTEN_IFACE
parameter in /etc/opt/ids/
ids.cf.
The idsagent does not know which
network interface to listen on for
commands. The IDS_LISTEN_IFACE
parameter must be set in the configuration
file /etc/opt/ids/ids.cf. Specify a
host name or IP address in the
configuration file.
idsagent: this host (host) has
multiple network addresses
206 Error Messages