topic An HIDS question in Operating System - HP-UX

An HIDS question

Andrew Pollard — Wed, 02 Mar 2005 11:06:05 GMT

Hi,

I am currently testing and configuring HIDS and I am wondering if "*" works?

I would like to monitor specific subdirs in a file system, for example my directory tree is:
/andrew/u1/code/test1
/andrew/u1/code/test2
/andrew/u2/code/test1
/andrew/u2/code/test2

I only want to monitor changes made in "test1" subdir, but when I use: /andrew/*/code/test1
in Schedule Manager, I don't get any alerts.

Any help would be great.
Thanks
Andrew

Re: An HIDS question

Pierre Pasturel — Wed, 02 Mar 2005 14:38:30 GMT

Andrew -

Please refer to p.126 (Unix Regular Expressions) in the v3.0 Admin Guide for good examples that will answer your question. This page also encourages you to refer to the regexp(5) man page. The last example on page 126 describes what you need to do. Try something like this:

^/andrew/u[1,2]/code/test1/
or something a bit more general such as
^/andrew/[^/]*/code/test1/

Be sure to anchor your RE at the beginning (^) and to specify the last slash at the end (also see examples for why this makes a difference).

When you specify "/andrew/*/code/test1" you are tryig to match 0 or more forward slahes and nothing else, so the "u1" or "u2" are not matched. Also, the subdirectory test11, test1hello, test123, etc... and its contents will also be matched unintentionally if you do not specify the trailing slash (/).

Pierre

Re: An HIDS question

Andrew Pollard — Wed, 02 Mar 2005 15:11:15 GMT

Hi Pierre,

That worked perfectly.

Thanks very much.

Andrew