topic Re: HIDS Alert Log Format in Operating System - HP-UX

HIDS Alert Log Format

KPS — Mon, 26 Mar 2007 13:50:29 GMT

Hi,

We just installed HIDS 4.0 agent on some clients. All is working well except for the format of the alert logs. It seems as though there are control characters in the alert logs and the format is very much of as far as the legibility. Could anyone tell us why we may be seeing this? I'll attach a sample of one of our alert.log files.

Thanks in advance.....

KPS

Re: HIDS Alert Log Format

KPS — Mon, 26 Mar 2007 13:55:04 GMT

I just realized after attaching an ASCII format of the alert.log, it looks a little better. This seems a little off, and I was just wondering if this is normal or should it be more legible to the eye?

Thanks,
KPS

Re: HIDS Alert Log Format

Hein van den Heuvel — Mon, 26 Mar 2007 14:48:08 GMT

Well, those 'funny' characters appear to all be a byte with value 1: 0x01

You can make it more readable by bulk replacing them with a newline.

For example:

# perl -pe 's/\001/\n/g' tmp.txt

or

# tr [\001] [\n] < tmp.txt

Hein.

Re: HIDS Alert Log Format

KPS — Mon, 26 Mar 2007 15:22:52 GMT

Thanks for the response, we're in better shape with better legibility of the alert logs.

Re: HIDS Alert Log Format

Pierre Pasturel — Tue, 27 Mar 2007 18:11:21 GMT

Hi KPS -

The alert.log file on each agent was not designed for viewing but is instead a persistent alert respository on each agent in case the admin GUI/CLUI ever needs to retrieve those alerts for viewing. HIDS v4.0 and prior versions require that you use the admin GUI or CLUI to view formatted alerts.

HIDS v4.1 (to be released soon this spring) has a new alert reporting command-line feature that allows you to generate consolidated alert reports across any number of agents. The reports can be generated in HTML, text, or "raw" format. For the "raw" formatted reports, the delimiter character can be configured to be any character. Raw reports facilitates post-processing of alerts by customized scripts that you write, much like the alert response programs allow you to do post-processing of alerts in near real-time. Both the content and the presentation of the HTML and text formatted reports are configurable and, using cron, you can have incremental reports sent periodically to specified email addresses.

HIDS v4.1 will also come with a useful tool for fine tuning schedules by presenting consolidated alerts reports and generating the corresponding filtering rules for those alerts you deem safe to ignore.

HIDS v4.1 also contains a new feature for proactively suppressing duplicate alerts.

A list of new features and benefits will be available in the Release Notes when V4.1 is released.

Pierre