HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Agent halts abnormally, leaving ids_* files and message queues
□ If a running agent was not halted as described in “Halting HP-UX HIDS Agents” (page 54)
(for example, the agent was stopped with kill -9), then you need to clean up the message
queues, which the agent uses for interprocess communication (IPC). This is important because
the kernel has a limited number of message queues that IDS and other applications need in
order to run.
You should also remove any file in /var/opt/ids/ whose name starts with the string
“ids_” and ends with a number (e.g., ids_1001). These are memory mapped files that are
used by HIDS processes for interprocess communication. If they are not cleaned up, the
corresponding partition might become full. A new memory mapped file will be automatically
created the next time the agent starts a schedule. You should *not* remove any memory
mapped files when a schedule is running.
Procedure G-1 To clean up the IDS message queues
1. Determine which message queues are used by HP-UX HIDS:
ipcs -q grep ids
2. Remove the /var/opt/ids/ids_* files.
3. Remove each queue:
ipcrm -q <qid1> -q <qid2>...-q <qidn>
Here’s an example of a hard kill followed by a message queue cleanup.
# ps -fu ids # display the ids processes
ids 16546 1 0 Apr 7 ? 3:09 ./idsagent
# kill -9 16546 # hard kill of idsagent
# ipcs -q grep ids # display the message queue
q 602 0x000003e8 --rw------- ids ids
# ipcrm -q 602 # delete the message queue
Agent host appears to hang and/or you see message disk full
□ Check the local disk for available capacity. The following files have a tendency to become
large and may need to be archived and truncated, or moved to a different disk partition
with more space:
• /var/opt/ids/alert.log
• /var/opt/ids/gui/logs/hostname_alert.log
• /var/opt/ids/error.log
• /var/opt/ids/gui/logs/Trace.log
• /var/opt/ids/gui/guiError.log
Agent needs further troubleshooting
□ Create a directory for the logging information (for example, /var/log)
□ Restart the idsagent process with debugging enabled:
• /sbin/init.d/idsagent stop
• /opt/ids/bin/idsagent -d -e -l /var/log/idslog
□ The debug information can be found in the following files:
• /var/log/idslog
• /var/log/idslog_idskerndsp
• /var/log/idslog_idssysdsp
• /var/log/idslog_idscor
Agent does not start after installation
□ Verify that there are no errors from the install: /var/adm/sw/swagent.log
□ Be sure the product has been run as user ids. (No other user will work.)
216 Troubleshooting