HP-UX Host Intrusion Detection System Version 4.3 administrator guide

max_thread_proc = 2 * <num_agents> + 18
Where: num_agents is the number of agent systems to be monitored.
By default, max_thread_proc is set to its minimum value, 64, which allows for 23 agents. The
maximum value of max_thread_proc is governed by the configurable kernel parameter nkthread,
which you can increase if you have a larger number of agents.
NOTE: The max_thread_proc is a dynamic tunable in HP-UX 11i version 1.6 and later. In earlier
versions of HP-UX, a change to this parameter requires a reboot.
The max_thread_proc tunable can be modified using SAM (on HP-UX 11i v2 operating systems)
or SMH (on HP-UX 11i v3 operating systems). Based on your operating system version, follow
one of the procedures listed below to modify this tunable:
Procedure 2-6 To change the value of max_thread_proc on HP-UX 11i v2:
1. Launch sam, the HP-UX System Administration Manager (SAM).
2. Select Kernel Configuration.
3. Select Configurable Parameters .
4. Highlight the max_thread_proc parameter.
5. Select Actions > Modify Configurable Parameter.
6. Enter your new value in the Formula/Value box.
7. Select OK.
Your new value shows in the Pending column.
8. Select File > Exit.
9. If you changed the value create a new kernel and reboot. Follow the steps provided by SAM.
NOTE: In HP-UX 11i v2, the modification of kernel tunables and kernel configuration was
moved from SAM to the kcweb system configuration interface. For more information, see Managing
Systems and Workgroups: A Guide for HP-UX System Administrators for details.
Procedure 2-7 To change the value of max_thread_proc on HP-UX 11i v3:
1. Launch smh, the HP-UX System Management Homepage (SMH).
2. Select the max_thread_proc parameter.
3. Select the Modify Tunable option located on the right hand side of your screen.
4. Enter your new value in the New Setting [Expression/Value] box.
5. Choose Modify. Your new value shows in the Pending column.
6. Select OK to save the configuration. .
7. If you changed the value, select View Pending Changes and reboot option located in the
right hand side of the screen. Follow the steps provided by SMH.
Enabling More than 20 Inbound Requests
The HP-UX HIDS administration system communicates with agent systems using the TCP
protocol. On some systems, the TCP parameter, tcp_conn_request_max, is set initially to
allow up to 20 inbound requests to be active at one time. If you have a larger number of agent
systems, this value can be inadequate.
If the tcp_conn_request_max value is too small an agent’s error log can contain messages,
such as write_msg: error opening connection to remote host...,
open_connection: connect error, and open_connection: Timed out waiting
on select() for connect to complete.
You can view and change this parameter using the ndd command.
To view and change the value of tcp_conn_request_max, follow these steps:
Enabling Multiple Agents 41