HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Cause: The maximum alert delay specified in the alert aggregation tuple for the program being
run by this process is too small.
Action: Increase the maximum alert delay in the alert aggregation tuple to aggregate over a
longer period of time.
GUI runs out of memory after receiving around 19,000 alerts
Problem: During resynchronization, after receiving around 19,000 alerts, the process slows down
drastically. On the admin host, the following error message is logged in the
/var/opt/ids/gui/guierror.log file:
java.lang.OutOfMemoryError <<no stack trace available>>
On the agent host, the following error messages is logged in the /var/opt/ids/error.log
file:
libcomm: pid=11983 thread_id=3: ssl_write_bytes: Timed out attempting
to write 5 bytes.libcomm: pid=11983 thread_id=3: write_msg: error writing
message header, errno=11: Resource temporarily unavailable
Cause: These errors occur when the Java Virtual Machine (JVM) has insufficient memory.
Action: To avoid this problem, increase the heap size of JVM to 256M. To increase the heap size
of JVM to 256M, uncomment the following line in idsgui:
# -Xmx256m \
Move the above line after $JAVA_RUN in the idsgui script.
The idsadmin Command needs installed agent certificates
You must run the idsadmin command on an administration host where agent certificates are
installed. You can use IDS_genAgentCerts to generate a local agent certificate on the
administration host. If the agent filesets, which include IDS_genAgentCerts, are not installed,
you can copy the directory /etc/opt/ids/ids/certs/agent (and its contents) from a remote
agent host to the administration host.
The idsadmin Command notifies of bad certificate when pinging a remote agent
Idsamin may notify of bad certificates if the certificate created on the admin host for the agent
is not yet valid on the agent host due to the system time difference between the admin host and
the remote agent host. For example:
./idsadmin -a hostname -i 1.2.3.4 -l /tmp/fooooo
Successfully opened /tmp/fooooo
Enter command>>ping
Wed Nov 24 20:53:23 2004: libcomm: pid=14582
thread_id=1:open_connection: Handshake error
(ssl_err=1,ret=0) as client
1:error:14094412:SSL routines:
SSL3_READ_BYTES:sslv3 alert bad
certificate:s3_pkt.c:1052:SSL alert number 42 Wed Nov 2
4 20:53:23 2004:
libcomm: pid=14582 thread_id=1: write_msg: error
opening connection to remote host, errno=607:Error
during SSL handshake.
Wed Nov 24 20:53:23 2004: libcomm: pid=14582 thread_id
=1: write_msg:
Returning failure, errno=607:Error during SSL
handshake Wed Nov 24
20:53:23 2004: libcomm: pid=14582 thread_id=1:
comm_write_msg: Error writing message, errno==607:
Error during SSL handshake
Use IDS_checkAgentCert to get the validity duration of the agent certificate, and compare it
with the system time of the agent host. If the certificate is not yet valid on the agent host, either
adjust the system time of the agent host, or wait until the certificate becomes valid.
Troubleshooting 219