topic Re: idsagent problem in Operating System - HP-UX

idsagent problem

David_711 — Thu, 07 Oct 2004 12:47:08 GMT

Hi,
I had a problem with the idsagent on my hpux 11.11, the idsagent process used 98% of the cpu and i can´t stopped it.
In the /var/opt/ids/error.log file, i found this message:

rcm_init: Could not initialize communication library: errno=226:Address already in use.

Please somebody can tellme what happend?
Thanks
Davi

Re: idsagent problem

Steffi Jones_2 — Thu, 07 Oct 2004 14:14:46 GMT

Hi David,

check with swlist -l fileset -a state if the IDS software is installed properly.
It should show 'configured'.

If it shows 'installed' run swconfig against the fileset and see if that helps.

Steffi

Re: idsagent problem

Olivier Decorse — Thu, 07 Oct 2004 14:39:51 GMT

Does idsagent shutdown before ? It seems that it was running and has not correctly stopped. So now, some ports/address are always in use.
Try to kill any ids process still in memory, from a previous run and let us know.

Olivier.

Re: idsagent problem

David_711 — Thu, 07 Oct 2004 15:59:41 GMT

Ok,thanks.
I stopped the idsagent with kill command, but why the idsagent used 98% of my processor and why i can not stopped it with /sbin/init.d/idsagent stop??

Thanks

David

Re: idsagent problem

Olivier Decorse — Fri, 08 Oct 2004 02:31:15 GMT

High cpu idsagent usage can be explained with a bad ids configuration.
For example, monitoring "buffer overflow" and "race condition" produce high load.

Also, having scripts in /opt/ids/response make the system running this scripts on every ids event !!! If you don't use (mail or vpo) alerts, move any program in an other directory.

And for stopping ids with "/etc/init.d/idsagent stop", what are the error message displayed ? you have to be root to run this script, etc.

Olivier.

PS : please don't forget to assign points : it is important for other peer to see if you receive the solution, and you will have more chance to receive responses for any other question !

Re: idsagent problem

Pierre Pasturel — Mon, 11 Oct 2004 11:54:31 GMT

David -

The "Address already in use" error most likely means that the port used by the idsagent to communicate with the admin GUI is in use. You can run "netstat -na |grep 2985" to see if the default port used by the agent is in use (run this when idsagent is not running).

The templates you are running has nothing to do with the CPU usage of idsagent. idscor is the process that runs the templates and can show high CPU. I don't know why idsagent used up so much CPU.

IDS v3.0 is due out soon and addresses performance and CPU utilization issues, as well as providing more powerful filtering of unwanted alerts. I am very excited about this release.

Pierre

Re: idsagent problem

Petr Simik_1 — Wed, 13 Oct 2004 10:01:16 GMT

did you performed correctly Authkeys?

I get this err when I did bad import of Client keys.
Try to repeat conf steps.

su - ids
/opt/ids/bin/IDS_genAdminKeys
/opt/ids/bin/IDS_genAgentCerts
/opt/ids/bin/IDS_importAgentKeys /var/opt/ids/tmp/hostname.tar.Z manager-hostname
/sbin/init.d/idsagent start