HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)

E The Surveillance Schedule Text File
This appendix describes the surveillance schedule in text format to enable administrators to edit
surveillance schedules using their preferred editor, instead of using the GUI Schedule Manager,
for those administrators who want to automate the activation of surveillance schedules (using scripts)
instead of using the GUI System Manager.
The following topics are discussed in this appendix:
• “Getting Started” (page 188)
• “Automating the Activation of Surveillance Schedules” (page 188)
• “Surveillance Schedule Text File” (page 189)
• “Surveillance Schedule Section” (page 189)
• “Surveillance Group Section” (page 191)
Getting Started
For deployments that do not have an X window environment or where the activation of surveillance
schedules needs to be automated, HP-UX HIDS provides a means to edit and activate surveillance
schedules without the use of the HP-UX Administrator GUI.
A surveillance schedule is normally created using the GUI Schedule Manager (see “Configuring
Surveillance Schedules” (page 50)) and activated using the GUI System Manager (see “Activating
Schedules on Agent Hosts” (page 44)). The GUI System Manager saves any newly created or
modified schedule or group files to a corresponding text file in a directory. You can also choose
to edit surveillance schedules using a preferred editor instead of using the GUI Schedule Manager
or the GUI System Manager.
To avoid constructing a surveillance schedule text file from scratch, start with one of the predefined
schedules in /etc/opt/ids/schedules and the corresponding group(s) in /etc/opt/ids/
schedules/groups. Each group is defined in an individual file and can be used across multiple
schedules.
NOTE: The schedules in /etc/opt/ids/schedules/sample and the groups in /etc/opt/
ids/schedules/sample/groups are read-only copies of the predefined schedules and groups
in /etc/opt/ids/schedules and /etc/opt/ids/schedules/groups, respectively. The
read-only versions can be copied if an unmodified predefined schedule or group is ever needed
when creating a new schedule or group from scratch.
Automating the Activation of Surveillance Schedules
The idsadmin command can be used to automate the activation of surveillance schedules. The
idsadmin command supports an interactive interface and a non-interactive interface. The activation
of schedules can be scripted by using the command’s --activate and -a options. Use the
--activate option to specify the name of the surveillance schedule and -a option to specify the
name or IP address of the agent host(s). For example, the following idsadmin command activates
a schedule specified in a file named MySchedule.txt on an agent host with IP address 10.0.0.2:
# /opt/ids/bin/idsadmin --activate MySchedule -a 10.0.0.2
For more information about the idsadmin command, see idsadmin( 1m).
NOTE: All schedule files must be located in /etc/opt/ids/schedules.
188 The Surveillance Schedule Text File