HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Log files are filling up
□ The log files on both the agent and the administration systems can grow without bounds.
It’s a good idea to practise log file rotation. See “Log File Rotation” (page 191).
No Agent Available
□ The Status field for an agent on the System Manager screen shows No Agent Available.
See also “Agent and System Manager cannot communicate with each other” (page 214).
1. Is the agent running? On the agent host, run
ps -ef grep idsagent
If there is no entry for idsagent, start the agent on the agent system, as in “Starting
HP-UX HIDS Agents” (page 51).
Then, on the System Manager screen, click the Status button.
2. Is the IP address for the agent correct in the Host Manager screen? Test with nslookup.
3. Is the Domain Name Service (DNS) set up correctly? Test with nslookup.
4. Can the administration system communicate with the agent system? Test with ping.
5. Is the agent communicating correctly with the administration system? Check the entry
for REMOTEHOST in the /etc/opt/ids/ids.cf agent configuration file. It must be
set to the host name or IP address of the administration system. If the INTERFACE
variable is set to an IP address (other than 0.0.0.0 or "::" for IPv6) in /opt/ids/
bin/idsgui on the administration system, REMOTEHOST must be set to the same value.
See “Configuring a Multihomed Administration System” (page 37) and “Setting Up
HP-UX HIDS Secure Communications” (page 29).
NOTE: There is security issue in running idsagent ( IDS_LISTEN_IFACE) or idsgui
(INTERFACE) with 0.0.0.0 or "::" for IPv6. For information on the security issue,
see “Agent displays error if hostname to IP mapping is not registered in name service”
6. Have the secure communications certificates expired?
– On the administration system, run the script
/opt/ids/bin/IDS_checkAdminCert. If the certificate has expired, rerun
/opt/ids/bin/IDS_genAdminKeys with the update parameter. See “Setting
Up HP-UX HIDS Secure Communications” (page 29).
– On the agent system, run the script /opt/ids/bin/IDS_checkAgentCert. If
the certificate has expired, rerun /opt/ids/bin/IDS_genAgentCerts for the
agent on the administration system. Then reimport the certificates on the agent
system with /opt/ids/bin/IDS_importAgentKeys. See “Setting Up HP-UX
HIDS Secure Communications” (page 29) .
Normal operation of an application generates heavy volume of alerts
□ To avoid becoming overwhelmed with unnecessary alert generation, you will need to
customize the detection templates to meet the needs of your particular environment. If you
have an application that generates a heavy volume of alerts during its normal mode of
operation, you can reduce this occurrence by entering additional filtering into the necessary
detection templates (most offer mechanisms by which these spurious alerts can be
suppressed).
□ For example, a system with the Resource Management subsystem might trigger a heavy
volume of alerts since it frequently updates some files in /etc/opt/resmon. You can go
to the Schedule Manager and modify the “Modification of files/directories” template to
have it ignore the /etc/opt/resmon directory. (This filtering is provided by default in
HP-UX HIDS version 2.2.)
□ See “Suggested Best Practices” (page 69).
Troubleshooting 221