HP-UX Host Intrusion Detection System Version 4.3 release notes

The swverify command reports error after removing the IDS Agent or the IDS Admin Sub-product

from a server that has HIDS bundle installed.

After installing HP-UX HIDS v4.3 on a server, and if IDS Agent (IDS-AGT-RUN fileset) or IDS

Admin (IDS-ADM-RUN and IDS-ADM-SHLIB filesets) sub product is removed from the

installation, the swverify IDS command report displays the following error message:

ERROR: File "/opt/ids/lbin/ssl-tool" missing. ERROR: Fileset

"IDS.IDS-AGT-RUN,l=/opt/ids,r=F.04.03.01" had file errors.

NOTE: Similar error will be displayed if IDS Agent sub product is removed from the server.

Defect Fixes in HP-UX HIDS Version 4.3

HP-UX HIDS version 4.3 includes defect fixes for the following issues:

• The following message appears on the admin command prompt or the System Manager

screen, when an agent loads a surveillance schedule. The message is seen after upgrading

to version 4.2:

Code: 10002 Message: The dir (/var/opt/ids/tmp//kerndsp_parser/) does not exist.

• The idsadmin report command prints the following warning messages when processing

suppressed and aggregated alerts:

WARNING: /var/opt/ids/gui/logs/_alert.log (line XX) WARNING: <alert string>

• The agent reports the following error messages in /var/opt/ids/error.log and the

idsagent process dies unexpectedly:

<Date and Time>: libcomm: pid=2041 thread_id=3: write_msg: error writing message payload,

errno=32:Broken pipe

<Date and Time>: libcomm: pid=2041 thread_id=2: read_thread: Error closing cached write

connection, errno=9, Bad file number

idsagent: process (PID: <PID of idskerndsp>) idskerndsp died abnormally with error:

unknown error

• The idsadmin report command does not always generate reports that contain all failed

• An HIDS surveillance schedule file is deleted after the corresponding surveillance schedule

is activated by the HIDS GUI System Manager if the System Manager screen is closed abruptly

(for example, by sending it a signal).

• Multiple disjoint group-periods selected in a Surveillance Schedule's time table are not

preserved across multiple invocations of the System Manager.

• The edit dialog box of HIDS Schedule Manager does not appear after selecting the Edit

button for editing a program list template property.

Known Problems, Limitations, and Fixes 15