topic Re: HIDS problem in Operating System - HP-UX

HIDS problem

Rene Mendez_4 — Wed, 27 Oct 2004 11:09:00 GMT

Hi have many problems with IDS 9000 version 2.2 when download new version the HIDS.

Problem with:
Message KernelDSP:idskerndsp
Now no audit login (this is configured)
Problem with performance the idscor.

Regards.
Rene

Re: HIDS problem

Pierre Pasturel — Wed, 27 Oct 2004 13:44:17 GMT

Rene -

I will need more details about the problem
with the kernel dsp and with no "audit login." Please provide any error messages you are observing, details about your schedule, expected vs actual behavior, etc....

As far as performance, this is being addressed in the upcoming V3.0 release due out before the end of the year.

Pierre

Re: HIDS problem

Rene Mendez_4 — Thu, 28 Oct 2004 14:47:15 GMT

Hello thanks for you response

I send top in this show idsagent use all processor.

In manager present error:
1%Tue Oct 19 10:22:51 2004%10002%KernelDSP:idskerndsp: Dropping audit records due to heavy load. First notice.
1%Tue Oct 19 10:23:03 2004%10002%KernelDSP:idskerndsp: No longer dropping audit records.

I send the configurations.

Regards
Rene

Re: HIDS problem

Gratien D'haese_2 — Fri, 29 Oct 2004 08:11:49 GMT

Did you activate the templates "race condition attacks" and "buffer overflow attacks"? If yes, then try to de-activate those and watch how the CPU behaves?

Another reason could be the use of "blocking mode" (IDDS_MODE 2 set by default). If the problem persists set IDDS_MODE to 3 in the /etc/opt/ids/ids.cf file.

Gratien

PS: HIDS A.03 will address this problem according HP (cfr. Pierre Pasturel who follows this forum for HIDS & HP).

Re: HIDS problem

Dennis E. James — Fri, 29 Oct 2004 09:22:01 GMT

Just curious any idea when HIDS A3.0 will be available.

Re: HIDS problem

Pierre Pasturel — Wed, 03 Nov 2004 15:13:04 GMT

Rene-

These issues are addressed by V3.0, although under heavy load conditions, running the Race Condition template might still result in audit records being dropped by the idskerndsp.

V3.0 is due out before the end of the calendar year. I will post a notice on this forum when it is available on software.hp.com.

Pierre