topic Re: HIDS agent fails to start in Operating System - HP-UX

HIDS agent fails to start

Jon Ford — Mon, 20 Oct 2008 19:40:35 GMT

I've got 6 other nodes up and running in the IDS gui, but have a server that is giving me some issues. My system administrators installed HIDS on all of my servers at the same time so I'm somewhat confident that the installation between the servers that do work and the server that does not work is uniform.

After successfully importing keys, I try to start the service in init.d and get this error message:

#/sbin/init.d/idsagent start
ERROR: kernel does not have idds support

I check /dev and idds is not present on the server. Is this my problem? Does this device file get installed with HIPS or is it normally installed with a different process/app? If so, what is it?

Re: HIDS agent fails to start

Tim Nelson — Mon, 20 Oct 2008 20:22:34 GMT

idds is probably simply not enabled in the kernel as it states.

OS Version ??

If 11.11 then kmadmin |grep idds

If 11.23 or above then kcmodule|grep idds

to see the status of the driver.

Re: HIDS agent fails to start

Pierre Pasturel — Mon, 27 Oct 2008 18:14:49 GMT

Hi Jon -

Please run /opt/ids/bin/IDS_checkInstall to make sure you have the necessary patches. Also check out the troubleshooting entries at http://docs.hp.com/en/5992-2108/apgs01.html#caccabjb and http://docs.hp.com/en/5992-2108/apgs01.html#ciabechd

Pierre

Re: HIDS agent fails to start

Jon Ford — Fri, 07 Nov 2008 19:48:03 GMT

Here's what I get when I run the check install

$ sudo /opt/ids/bin/IDS_checkInstall

Checking all required kernel patches are installed on aulhpux4...
PHKL_35091 is installed
PHKL_34466 is installed
WARNING: The idds driver is not configured into the kernel.

Installation check failed.

Re: HIDS agent fails to start

Pierre Pasturel — Tue, 11 Nov 2008 19:51:44 GMT

There was probably an error when attempting to rebuild the kernel for enabling the IDS kernel component. Please try the suggestion at
http://docs.hp.com/en/5992-2108/apgs01.html#caccabjb

You can also check your swagent.log for where the kernel was rebuilt when installing the IDS-KRN.IDS-AGT-KRN fileset. Look for an entry like :

* Installing fileset "IDS-KRN.IDS-AGT-KRN,r=B.03.00.00" (1 of
5).
NOTE: Building a new kernel based on template file "/stand/system"
Generating module: krm...
Compiling /stand/build/conf.c...
....

Pierre