HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Table F-1 Agent Error Messages (continued)
ActionMeaningError Message
Either specify a specific IP address
or 0.0.0.0 ( or "::" for IPV6). If you
specify a specific IP address, it must
correspond to the network interface
for the network connecting the agent
and system manager systems.
If 0.0.0.0 ( or "::" for IPV6) is selected,
the agent system can be connected
to the system manager or the
idsadmin that are reachable on any
of the agent's network interfaces.
On your agent system, edit /etc/
opt/ids/ids.cf to set the
IDS_LISTEN_IFACE variable to
either the IP address you have
chosen, or to 0.0.0.0 ( or "::" for IPV6)
.
NOTE: By setting the value of the
IDS_LISTEN_IFACE variable to
0.0.0.0 (or "::" for IPv6), the agent
will listen for the system manager
or theidsadmin connections on a
port (see “Configuring Ports”) on all
available interfaces. Any potential
risk from listening on all available
interfaces can be avoided by setting
the IDS_LISTEN_IFACE variable
to an IP address that the name
service maps to the local host name.
For example, change the
IDS_LISTEN_IFACE line to read
IDS_LISTEN_IFACE=192.0.2.4.
If theIDS_LISTEN_IFACE variable in the
[global] section of /etc/opt/ids/
ids.cf is empty, then the local host name
maps to multiple IP addresses according
to the name service and the agent does not
know which IP address (and the
corresponding interface) to listen for
System Manager or idsadmin
connections.
If the IDS_LISTEN_IFACE variable is set
to a host name, then the specified host
name maps to multiple IP addresses
according to the name service and the
agent does not know which IP address
(and the corresponding interface) to listen
for System Manager or idsadmin
connections.
If theIDS_LISTEN_IFACE variable is set
to an IP address, then the IP address does
not map to the local host name according
to the name service and the agent assumes
that an invalid IP address was specified.
idsagent: the IDS_LISTEN_IFACE
parameter is specified as:
<IP Address or Host name>
in the configuration file /etc/
opt/ids/ids.cf. This is not a
valid address or name for this host.
Please change the
IDS_LISTEN_IFACE parameter
in the [global] section of the
configuration file to be a valid
address or name for this host.
If the file should not have changed,
treat it as a potential intrusion.
File filename, which is being monitored
by the idssysdsp process, has been moved.
This is acceptable if the file has just
undergone expected log file rotation.
idssysdsp: NOTE: inode of file
filename was changed (ok if log
rotation expected on this file)
If the file should not have changed,
treat it as a potential intrusion.
File filename, which is being monitored
by the idssysdsp process, changed in size.
This is acceptable if the file has just
undergone expected log file rotation.
idssysdsp: NOTE: size of file
filename decreased (ok if log
rotation expected on this file)
Contact HP support.An internal error occurred.Internal error
Contact HP support.An internal error occurred.Internal error: unknown state
Ensure that the directory exists, that
it is owned by user:group ids:ids,
and that it is readable and
executable by user ids.
idsagent was unable to open or read the
/opt/ids/response directory which
contains the alert response scripts.
unable to open the response script
directory dir
System Manager Messages
This section describes the error messages that are displayed on the HP-UX HIDS System Manager
system.
System Manager Messages 207