HP-UX Host Intrusion Detection System Version 4.4 Administrator Guide (5900-1634, April 2011)

d Days
w Weeks
When the unit component is not present, the integer component is assumed to be in seconds. For
example, the following lines in the template configuration file contain time strings representing
values of 23 seconds, 10 minutes, 1 hour and 23 seconds; the s component in the last line is
redundant, but can be used for clarity.
fail_interval | 23
warning_interval | 10m
fail_interval | 1h
warning_interval | 23s
NOTE: You cannot specify the time unit value in the Schedule Manager screen.
Type VII: Flags
The Type VII property value is an integer used to enable or disable a flag. A value of 1 means
enabled, and a value of 0 means disabled. For example, the following properties of the
Login/Logout template specify that the monitoring of logins is enabled, and the monitoring of
successful su commands is disabled:
monitor_login_flag | 1
monitor_su_flag | 0
Type VIII: Scalars
The Type VIII property value is a single integer. However, this value can be any integer. For
example, the following property of the Buffer Overflow template specifies that 500 is considered
an unusually long argument length when invoking a priviledged setuid program:
unusual_arg_len | 500
Type IX: Path Names / Integer Pairs
The Type IX property specifies pairs of path names and integers. In each pair, the two members
are separated by a comma and pairs are separated by a pipe. The path name is interpreted as
regular expressions and extended regular expressions. For more information on regular expressions,
see “UNIX Regular Expressions ” (page 106). The integer is interpreted to be of type Type VI: Time
Strings.
Currently, only the global alert aggregation tuples property is of this type. For more information,
see “Surveillance Schedule Text File” (page 193).
Type X: String Patterns
The Type X property value is a list of regular expression string patterns that are separated by the
pipe (|) character and that can be grouped using the ampersand (&) character. Type X properties
are similar to Type I properties. However, Type I properties are regular expressions for specifying
pathnames while Type X properties are regular expressions for specifying string patterns in general.
Type X property values must be enclosed using double quotes to denote the start and end of the
string pattern.
This property type is currently used only in the Log File Modification Template for specifying
log file entries to monitor or ignore.
NOTE: When specifying the template property value in the Schedule Manager window, enter
only string patterns enclosed in double quotes and the ampersand (&) character if grouping 2 or
more string patterns.
For example, the following line specifies the Log File Monitoring template property to monitor log
file entries that contain either the string "file system full" or both the string "fail" and "authentication":
watch | "file system full" | "fail" & "authentication"
For examples of regular expressions, see “UNIX Regular Expressions ” (page 106).
112 Templates and Alerts