HP-UX Host Intrusion Detection System Version 4.4 Administrator Guide (5900-1634, April 2011)

in the schedule file enable you to specify varying start and end times for the same group on different
schedules.
• The name in the GROUPPERIOD NAME keyword and the name of the group file located in
the groups subdirectory must match (not including the file extension) and they must be unique
across all surveillance group names specified in the surveillance schedule text file. The name
of a group must consist of an alphanumeric character followed by one or more alphanumeric
characters, an underscore (_) or a hyphen (-).
• If the GMT keyword value is set to 0, then the time specified by the STARTTIME and ENDTIME
entries are interpreted as local time. If the GMT keyword value is set to 1, then the time specified
by the STARTTIME and ENDTIME entries are interpreted as GMT time and is converted to
local time when scheduling the surveillance group.
• The STARTTIME and ENDTIME keyword values denote when the surveillance group’s templates
start running and stop running, respectively. The keyword values use the hh:mm:d syntax.
The 2 digit hh field specifies the hour (that is, 00 for 12am, 01 for 1am, 11 for 11am, 13
for 1pm, 23 for 11pm). The 2 digit mm field specifies the number of minutes elapsed after the
hour (that is, 00 for on the hour,15 for 15 minutes after the hour, 59 for 59 minutes after the
hour). The single digit d field specifies the day of the week, where 0 is for Sunday, 1 is for
Monday, 2 is for Tuesday, etc...and 6 is for Saturday. For example, to run a surveillance
group’s templates only during the workweek, use a STARTTIME value of 00:00:1 and
ENDTIME value of 23:59:5. The combination of a STARTTIME value of 0:00:0 and an
ENDTIME value of 23:59:6 are special values that denote that a schedule should continuously
run.
196 The Surveillance Schedule Text File