HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)

Table 53 Correlator Configuration Variables
Default ValueName
““CMDLINEARGS
“not set”AGGREGATION
CMDLINEARGS Used to pass command line options to the idscor process. To measure the
average system call event rate on a host for the system calls monitored by HIDS, while running a
particular set of detection templates, set the value to -t <number> where <number> is the number
of events over which the rate is calculated.
For example, -t 100000 calculates the event rate for every 100,000 events. For more information,
see the “HP-UX HIDS Sizing and Tuning Primer”.
After setting the -t option with a value of 100,000, restart the schedule and look for lines like the
following in the agent’s error log:
Event# 100000: 2799.17 events/sec
Event# 200000: 1742.62 events/sec
Event# 300000: 1395.02 events/sec
The agent’s error log is defined by the IDS_ERRORFILE configuration variable described in
Table 52 (page 183) (the default is /var/opt/ids/error.log).
If event rates do not start appearing in the agent’s error log after about a minute, the rate of events
generated on the system is probably low, so decrease the value of the -t argument to 10,000 or
1,000 in order to calculate the rate more often (that is, for every 10,000 or 1,000 system call
events instead of for every 100,000).
On the other hand, if there are continous large spikes in the event rate, the event rate is not being
calculated over a large enough sample. For example, the following output shows that the event
rate spikes constantly when calculated for every 1,000 events:
Event# 1000: 155933.27 events/sec
Event# 2000: 199.40 events/sec
Event# 3000: 152975.38 events/sec
Event# 4000: 199.41 events/sec
Event# 5000: 199.42 events/sec
Event# 6000: 156421.08 events/sec
Event# 7000: 199.38 events/sec
Event# 8000: 157505.12 events/sec
Event# 9000: 199.40 events/sec
Event# 10000: 141723.36 events/sec
The spikes are due to idscor receiving bursts of events and is probably a function of when HIDS
processes such as idskerndsp or idscor are scheduled to run.
For this example, using a sample rate of 10,000 (that is, -t 10000) results in a stable average
reading of the actual event rate:
Event# 10000: 331.02 events/sec
Event# 20000: 331.84 events/sec
NOTE: No intrusion detection is performed when the -t option is set. Make sure to remove the -t
option from CMDLINEARGS when deploying HIDS.
AGGREGATION
Used to override the schedule alert aggregation property value that specifies whether alert
aggregation is enabled or disabled. Set to 0 to disable alert aggregation. Set to 1 to enable alert
aggregation.
Data Source Process Configuration
There is a configuration entry for each data source process. Each entry is surrounded by [DSP]
and [END] tags.
184 The Agent Configuration File