HP-UX Host Intrusion Detection System Version 4.3 administrator guide
Table Of Contents
- HP-UX Host Intrusion Detection System Version 4.3 administrator guide
- Table of Contents
- About This Document
- 1 Introduction
- 2 Configuring HP-UX HIDS
- 3 Getting Started with HP-UX HIDS
- 4 Using the System Manager Screen
- Starting the HP-UX HIDS System Manager
- Stopping the HP-UX HIDS System Manager
- System Manager Components
- Starting HP-UX HIDS Agents
- Getting the Status of Agent Hosts
- Resynchronizing Agent Hosts
- Activating Schedules on Agent Hosts
- Stopping Schedules on Agent Hosts
- Halting HP-UX HIDS Agents
- Accessing Other Screens
- 5 Using the Schedule Manager Screen
- The Schedule Manager
- Configuring Surveillance Schedules
- Configuring Surveillance Groups
- Configuring Detection Templates
- Setting Surveillance Schedule Timetables
- Configuring Alert Aggregation
- Configuring Monitor Failed Attempts
- Configuring Duplicate Alert Suppression
- Viewing Surveillance Schedule Details
- Predefined Surveillance Schedules and Groups
- 6 Using the Host Manager Screen
- 7 Using the Network Node Screen
- 8 Using the Preferences Screen
- A Templates and Alerts
- Alert Summary
- UNIX Regular Expressions
- Limitations
- Template Property Types
- Buffer Overflow Template
- Race Condition Template
- Modification of files/directories Template
- Changes to Log File Template
- Creation and Modification of setuid/setgid File Template
- Creation of World-Writable File Template
- Modification of Another User’s File Template
- Login/Logout Template
- Repeated Failed Logins Template
- Repeated Failed su Commands Template
- Log File Monitoring Template
- B Automated Response for Alerts
- C Tuning Schedules and Generating Alert Reports
- D The Agent Configuration File
- E The Surveillance Schedule Text File
- F Error Messages
- G Troubleshooting
- Troubleshooting
- Agent and System Manager cannot communicate with each other
- Agent complains that idds has not been enabled, yet lsdev shows /dev/idds is present
- Agent does not start on system boot
- Agent halts abnormally, leaving ids_* files and message queues
- Agent host appears to hang and/or you see message disk full
- Agent needs further troubleshooting
- Agent does not start after installation
- Agents appear to be stuck in polling status
- Agent displays error if hostname to IP mapping is not registered in name service
- Aggregated alerts targets or details field are truncated and the same aggregated alert has several entries logged in the IDS_ALERTFILE
- Alert date/time sort seems inconsistent
- Alerts are not being displayed in the alert browser
- Buffer overflow triggers false positives
- Duplicate alerts appear in System Manager
- Getting several aggregated alerts for the same process
- GUI runs out of memory after receiving around 19,000 alerts
- The idsadmin Command needs installed agent certificates
- The idsadmin Command notifies of bad certificate when pinging a remote agent
- IDS_checkInstall fails with a kmtune error
- IDS_genAdminKeys or IDS_genAgentCerts does not complete successfully
- IDS_genAdminKeys or idsgui quits early
- Large files in /var/opt/ids
- Log files are filling up
- No Agent Available
- Normal operation of an application generates heavy volume of alerts
- Reflection X rlogin produces multiple login and logout alerts
- Schedule Manager timetable screen appears to hang
- SSH does not perform a clean exit after idsagent is started
- System Manager appears to hang
- System Manager does not let you save files to specific directories
- System Manager does not start after idsgui is started
- System Manager starts with no borders or title bar in X client programs on Windows
- System Manager times out on agent functions such as Activate and Status Poll
- UNKNOWN program and arguments in certain alert messages
- Using HP-UX HIDS with IPFilter and SecureShell
- Unable to Generate Administrator Keys and Agent Certificates on PA–RISC 1.1 Systems
- Troubleshooting
- H HP Software License

Table F-2 System Manager Error Messages (continued)
ActionMeaningError Message
Ensure that the host to be disabled
is in a valid state.
The host was not in a valid state for
disabling.
Invalid Host State - Unable to disable
host.
Use the correct format for the
property value.
The text of the property value was not in
correct format.
Invalid Property Value: value -
Property Value Error.
Two hosts cannot have the same IP
address. All hosts must have
unique IP addresses.
You tried to add a host using an IP
address that was already in use.
IP Address must be unique - Add
Host Error.
Before editing host information,
select a host.
You attempted to edit host information
without selecting a host.
No Host selected. A Host must be
selected for editing - Host Selection
Error.
Before requesting any action, select
a host.
The requested action on the host cannot
be performed, since no host was selected.
No host selected. At least one host
must be selected - Host Selection
Error.
Search is discontinued, since no
instances of the search string can
be found.
No further occurrences of the search
string have been found.
No more instances of searchstring
found - Find Error.
Select only one property.You tried to select more than one
property for edit at a time.
Only one property may be edited at
a time - Selection Error.
Search was unsuccessful, and is
discontinued.
The search string you specified cannot
be found.
searchstring not found - Find
Error.
A property must be selected before
it can be edited.
You attempted to edit a property without
selecting one.
Select Property to be edited -
Selection Error.
Select a node before activating an
associated schedule.
A node must be selected before
attempting schedule activation.
Select node(s) for Schedule
Activation.
Select a node before attempting a
status poll.
A node must be selected before a status
poll is made.
Select node(s) for Status Poll.
Select a node before halting an
agent running on it.
The halt agent action was attempted
without selecting a node.
Select node(s) to Halt Agent.
Select a node before attempting to
resynchronize with agent
associated with the node.
A resync of nodes was requested without
selecting a node.
Select node(s) to resync.
Select a node before stopping the
schedule.
Only schedules associated with a node
can be stopped. No node was selected.
Select node(s) to Stop Schedule.
Select a surveillance schedule
before activating it.
A schedule must be selected before it can
be activated.
Select a Surveillance Schedule to
Activate.
Select a surveillance group to
delete before attempting the delete
function.
You tried to delete surveillance group
without selecting one.
Select Surveillance Group Name to
delete - Selection Error.
Before modifying a surveillance
group, select a surveillance group
name.
You tried to modify a surveillance group
without selecting a surveillance schedule.
Select Surveillance Group Name to
be modified - Selection Error.
Select a surveillance group before
copying it.
You attempted to copy a surveillance
group without selecting one.
Select Surveillance Group to copy -
Selection Error.
Select a surveillance schedule
before copying it.
You attempted to copy a surveillance
schedule without selecting a surveillance
schedule.
Select Surveillance Schedule to copy
- Selection Error.
Select a surveillance schedule
before deleting it.
You tried to delete a schedule without
selecting one.
Select Surveillance Schedule to delete
- Selection Error.
System Manager Messages 209