HP-UX Host Intrusion Detection System Version 4.3 administrator guide
Table Of Contents
- HP-UX Host Intrusion Detection System Version 4.3 administrator guide
- Table of Contents
- About This Document
- 1 Introduction
- 2 Configuring HP-UX HIDS
- 3 Getting Started with HP-UX HIDS
- 4 Using the System Manager Screen
- Starting the HP-UX HIDS System Manager
- Stopping the HP-UX HIDS System Manager
- System Manager Components
- Starting HP-UX HIDS Agents
- Getting the Status of Agent Hosts
- Resynchronizing Agent Hosts
- Activating Schedules on Agent Hosts
- Stopping Schedules on Agent Hosts
- Halting HP-UX HIDS Agents
- Accessing Other Screens
- 5 Using the Schedule Manager Screen
- The Schedule Manager
- Configuring Surveillance Schedules
- Configuring Surveillance Groups
- Configuring Detection Templates
- Setting Surveillance Schedule Timetables
- Configuring Alert Aggregation
- Configuring Monitor Failed Attempts
- Configuring Duplicate Alert Suppression
- Viewing Surveillance Schedule Details
- Predefined Surveillance Schedules and Groups
- 6 Using the Host Manager Screen
- 7 Using the Network Node Screen
- 8 Using the Preferences Screen
- A Templates and Alerts
- Alert Summary
- UNIX Regular Expressions
- Limitations
- Template Property Types
- Buffer Overflow Template
- Race Condition Template
- Modification of files/directories Template
- Changes to Log File Template
- Creation and Modification of setuid/setgid File Template
- Creation of World-Writable File Template
- Modification of Another User’s File Template
- Login/Logout Template
- Repeated Failed Logins Template
- Repeated Failed su Commands Template
- Log File Monitoring Template
- B Automated Response for Alerts
- C Tuning Schedules and Generating Alert Reports
- D The Agent Configuration File
- E The Surveillance Schedule Text File
- F Error Messages
- G Troubleshooting
- Troubleshooting
- Agent and System Manager cannot communicate with each other
- Agent complains that idds has not been enabled, yet lsdev shows /dev/idds is present
- Agent does not start on system boot
- Agent halts abnormally, leaving ids_* files and message queues
- Agent host appears to hang and/or you see message disk full
- Agent needs further troubleshooting
- Agent does not start after installation
- Agents appear to be stuck in polling status
- Agent displays error if hostname to IP mapping is not registered in name service
- Aggregated alerts targets or details field are truncated and the same aggregated alert has several entries logged in the IDS_ALERTFILE
- Alert date/time sort seems inconsistent
- Alerts are not being displayed in the alert browser
- Buffer overflow triggers false positives
- Duplicate alerts appear in System Manager
- Getting several aggregated alerts for the same process
- GUI runs out of memory after receiving around 19,000 alerts
- The idsadmin Command needs installed agent certificates
- The idsadmin Command notifies of bad certificate when pinging a remote agent
- IDS_checkInstall fails with a kmtune error
- IDS_genAdminKeys or IDS_genAgentCerts does not complete successfully
- IDS_genAdminKeys or idsgui quits early
- Large files in /var/opt/ids
- Log files are filling up
- No Agent Available
- Normal operation of an application generates heavy volume of alerts
- Reflection X rlogin produces multiple login and logout alerts
- Schedule Manager timetable screen appears to hang
- SSH does not perform a clean exit after idsagent is started
- System Manager appears to hang
- System Manager does not let you save files to specific directories
- System Manager does not start after idsgui is started
- System Manager starts with no borders or title bar in X client programs on Windows
- System Manager times out on agent functions such as Activate and Status Poll
- UNKNOWN program and arguments in certain alert messages
- Using HP-UX HIDS with IPFilter and SecureShell
- Unable to Generate Administrator Keys and Agent Certificates on PA–RISC 1.1 Systems
- Troubleshooting
- H HP Software License

NOTE: These messages are produced by the System Manager. If you see a message that is not
described and you cannot resolve the problem, contact HP support.
Table F-2 System Manager Error Messages
ActionMeaningError Message
Stop any currently active
surveillance schedules before
attempting to load the host list file.
Before loading the previously saved list
of hosts, all surveillance schedules must
be stopped.
All Surveillance Schedules must be
stopped prior to loading a Host List
File - Program State Error.
Check the name and location of the
file.
The file, that you attempted to open,
cannot be found.
Cannot find filename - File Error.
Make sure that the file to be loaded
exists in the directory from which
it is being opened.
Your requested file cannot be loaded.
Cannot load file: filename - Load
Error.
Ensure that there is enough disk
space to save the desired file.
The file you specified cannot be saved.
Cannot save file: filename - Save
Error.
Specify another file name.The file cannot be saved in the file named
filename.
Can’t overwrite filename. Please
specify a different file to save.
Ensure that the size of the file is not
too large for download.
The schedule was too large for the
communication pipe.
Download Aborted! Surveillance
Schedule buffer overflow: schedname.
Surveillance Schedule File Size Error
- Surveillance Schedule File Size
Error.
Ensure that the specified port
number is valid.
A check is made to make sure that the
program can receive messages on the
requested port. An error is generated if
an unknown interface is specified.
FATAL ERROR: Cannot listen on
adminPort. Check if port is already
in use on this host - Exiting......
When adding a host, specify both
the IP address and the host name.
You tried to add a host without giving
either the IP address or host name.
Host Name and IP address must be
provided - Add Host Error.
Specify the action.The application was unable to open the
specified file.
I/O Exception while opening file:
filename - File Save Error.
Before activating a surveillance
schedule, ensure that the selected
hosts are in ready, scheduled, or
running state.
The host was in an invalid state for the
selected action.
In order to activate a Surveillance
Schedule, selected hosts must have a
status of Ready, Scheduled, or
Running.
Before deleting a host list entry,
make sure that the surveillance
schedule associated with the
selected host has been stopped.
The host selected for deletion has
running schedules associated with it.
These schedules must be stopped before
attempting to remove the host.
In order to delete host list entries, the
scheduled or running surveillance
schedule must first be manually
stopped.
Before resynchronizing an HP-UX
HIDS agent, make sure that the
agent is in the state of ready,
scheduled, or running.
You attempted to resync an IDS agent in
an invalid state.
In order to resync with an Ids Agent,
the selected hosts must have a status
of Ready, Scheduled, or Running.
Before attempting to stop a
surveillance schedule, the hosts
running the schedule must be in
running or scheduled state.
You attempted to stop a surveillance
schedule, whose associated host was not
in running or scheduled state.
In order to stop a Surveillance
Schedule, hosts must have a status of
Running or Scheduled.
Use the dotted decimal notation
when specifying the IPv4 address
or the network mask and IPv6
address notation inet6(3) while
specifying IPv4 address and prefix
notation (/x) while specifying IPv6
network mask
The IP address or the network mask was
specified using an incorrect format.
Incomplete or Invalid Entry - Data
Entry Error.
208 Error Messages