HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)

2. Select one of the following options to stop the schedule:
• Click the Stop button.
• Choose the Actions > Stop Schedule menu item.
• Press Shift+F3.
• Right-click in the Monitored Hosts area and select Stop Schedule from the menu
The schedules are stopped and removed from the selected hosts. The Status field is set to
Available and the Schedule field is set to None. To restart the schedules, you must activate
them again. For more information, see “Activating Schedules on Agent Hosts” (page 44).
Halting HP-UX HIDS Agents
You can stop the agent process on one or more agent hosts for system maintenance or other
reasons.
Normally, you halt agent hosts from the System Manager. However, it can be necessary to halt
the agent software directly from the agent host. For example, if you misconfigure the installation
of the key certificates needed for SSL encryption, the agent starts, but cannot communicate with
the System Manager. In this scenario, you must halt the agent host and restart it.
To restart an agent, see “Starting HP-UX HIDS Agents” (page 41).
To halt agents remotely from the System Manager, follow these steps:
1. On the System Manager screen, in the Monitored Hosts list, select the hosts you want to halt.
2. Perform one of the following tasks to halt the agent host:
• Choose the Actions > Halt IDS Agent menu item.
• Press Shift+F10.
The schedules, if any, are stopped on and removed from the selected host. The agent is halted
on the selected hosts. The Status fields are set to No Agent Available and the Schedule
field is set to None.
The schedules are not available for automatic restart.
Procedure 4 To halt the agent locally on the agent host, follow these steps:
• On the agent host, perform one of the following steps to halt the agent locally:
• Log in to the agent system as root and enter the following command:
$ kill -TERM $(cat /var/opt/ids/idsagent.pid)
NOTE: You can also do this as user ids.
• Log in to the agent system as superuser (root) and enter the command:
$/sbin/init.d/idsagent stop
This command is automatically executed when the agent system is shut down with the
shutdown command.
The agent is halted on the host. The status of the agent host on the System Manager does not
update itself automatically. The next time you run a System Manager command for the agent,
the Status field is set to No Agent Available and the Schedule field is set to None on the
System Manager screen.
When the agent is halted, the schedule, if any, is retained and remains available for automatic
restart.
IMPORTANT: If an agent did not halt as above, you may need to clean up the message
queues. For more information, see “Agent halts abnormally, leaving ids_* files and message
queues” (page 206).
Halting HP-UX HIDS Agents 45