HP-UX Host Intrusion Detection System Version 4.3 administrator guide

• “Halting HP-UX HIDS Agents” (page 54)
• “Accessing Other Screens” (page 55)
— “Schedule Manager Screen” (page 55)
— “Host Manager Screen” (page 55)
— “Network Node Screen” (page 56)
— “Preferences Screen” (page 56)
— “Returning to the System Manager Screen” (page 56)
Starting HP-UX HIDS Agents
Normally, after valid certificates have been imported, the HP-UX HIDS agent starts automatically
with /sbin/init.d/idsagent start when the agent host is booted. To start it manually,
use the following procedure.
• On each agent host, perform one of the following steps:
• Log in to the agent system as root and enter the following command:
#/sbin/init.d/idsagent start
This starts /opt/ids/bin/idsagent under user ids and activates any schedule that
was retained when the agent halted.
• Log in to the agent system as root, switch to user ids, and enter the command:
$/opt/ids/bin/idsagent -a
This starts /opt/ids/bin/idsagent under user ids and activates any schedule that
was retained when the agent halted.
• Log in to the agent system as user root, switch to user ids, and enter the command:
$/opt/ids/bin/idsagent
This starts /opt/ids/bin/idsagent under user ids and does not activate any schedule
that was retained when the agent halted.
Once it has started, idsagent executes in the background as a daemon process on the host
system, awaiting commands from the System Manager via an SSL connection.
If another agent is running, idsagent fails with the following message:
idsagent: another idsagent (PID:pid) process
is running
Or a stale lockfile
/var/opt/ids/idsagent.pid exists
Remove it and attempt to restart - exiting
If no idsagent is running, delete the existing /var/opt/ids/idsagent.pid file and
restart idsagent.
If the lock file /var/opt/ids/idsagent.pid exists and there is no agent running, the
new idsagent runs and resets the lock file, displaying the following message:
idsagent: possibly stale lockfile
/var/opt/ids/idsagent.pid - unlinking
Getting the Status of Agent Hosts
When the System Manager is started, it automatically checks the status of all agent hosts if
Automatic Startup Status Poll is enabled. For more information, see Section : “General Preferences”
(page 105).
If the Status field information does not reflect the correct information or displays the Status
as Unknown, you can manually update the status information for one or more hosts.
To get the status of agent hosts, follow these steps:
Starting HP-UX HIDS Agents 51