topic Re: IDS9000 in Operating System - HP-UX

IDS9000

Michael O'brien_1 — Thu, 22 Aug 2002 09:54:04 GMT

Hi,

I was thinking of implementing IDS on serveral HP servers. I was planning on using a HP workstation as the management server. Is this a good idea? If a workstation is capable of being the IDS management server, can anyone recommend a suitable model.

Thanks
Mike

Re: IDS9000

Rainer von Bongartz — Thu, 22 Aug 2002 10:05:17 GMT

Mike,

According to my experience a WS should be ok.I you need to keep the logs care for a big HD.

I use a small A-Class as mangement station; I prefer servers for tasks running 24*7*365

Regards
Rainer

Re: IDS9000

Joanne Keegan — Fri, 23 Aug 2002 01:00:19 GMT

Hi Mike,

I have been testing this on a D & K class (as management servers). While there doesn't appear to be any problems, depending on how it is configured (the templates) and how many messages that are generated, will set a requirement for possibly a bit of disk space. Also note that depending on which options being used, there can be and I/O overhead (especially on the agent systems) - from my experience, anyway.

Regards,

Joanne

Re: IDS9000

Michael O'brien_1 — Fri, 23 Aug 2002 11:23:52 GMT

Rainer/Joanne,

Thanks for the replys, I think I will be using an A-Class, I am interested in the overhead Joanne mention on the agents as this would be a major concern if it impacts the service. We have just upgraded the application and are starting to get some decent performance from our servers. If I was to implement IDS and performance took a big hit, I don't think I would be too popular.

Thanks
Mike

Re: IDS9000

Rainer von Bongartz — Fri, 23 Aug 2002 11:51:43 GMT

Mike,

check out my top output to figure out what IDS will mean to perfomance on your system.

You'll find all ids processes among the top 10.

BUT: performance depends very heavily on what you monitor, so carefully design your schedules bases on the temlates

And last but not least: IDS is a great tool if you are really concerned about security.

System: venus Fri Aug 23 14:52:13 2002
Load averages: 1.02, 1.33, 1.38
324 processes: 314 sleeping, 9 running, 1 zombie
Cpu states:
CPU LOAD USER NICE SYS IDLE BLOCK SWAIT INTR SSYS
0 1.46 22.6% 0.0% 9.6% 67.8% 0.0% 0.0% 0.0% 0.0%
1 1.05 10.7% 0.0% 1.6% 87.7% 0.0% 0.0% 0.0% 0.0%
2 0.70 8.2% 0.0% 3.3% 88.5% 0.0% 0.0% 0.0% 0.0%
3 0.88 9.0% 0.0% 3.7% 87.3% 0.0% 0.0% 0.0% 0.0%
--- ---- ----- ----- ----- ----- ----- ----- ----- -----
avg 1.02 12.7% 0.0% 4.5% 82.8% 0.0% 0.0% 0.0% 0.0%

Memory: 414312K (286788K) real, 367352K (250444K) virtual, 63376K free Page# 1/9

CPU TTY PID USERNAME PRI NI SIZE RES STATE TIME %WCPU %CPU COMMAND
1 ? 19219 ids 168 20 25760K 12080K sleep 71:55 78.79 78.65 idscor
0 ? 17438 root 154 20 7100K 6084K sleep 3:28 9.13 9.11 lmx.srv
0 ? 6516 root 127 20 88K 176K run 7:49 7.71 7.70 nktl_daemon
2 ? 11469 root 154 20 11548K 6920K sleep 1817:11 7.65 7.64 oninit
1 ? 19220 ids 168 20 13044K 208K sleep 4:46 4.19 4.18 idssysdsp
0 ? 19179 ids 152 20 14168K 10712K run 3:45 3.41 3.41 idsagent
0 ? 4307 root 191 20 6956K 5888K run 5:50 3.17 3.16 lmx.srv
3 ? 20188 root 154 20 16568K 7476K sleep 97:39 2.51 2.50 admagent
3 ? 24318 root 152 20 3108K 3856K run 8:12 2.22 2.22 ns-admin
0 ? 15230 root 154 20 6668K 5584K sleep 3:13 2.15 2.14 lmx.srv
0 tty0p3 11612 root 156 20 11548K 6492K sleep 424:43 1.97 1.97 oninit
1 ? 11506 root 156 20 11548K 6276K sleep 380:11 1.77 1.77 oninit
0 ? 19221 ids 168 20 13316K 304K sleep 1:25 1.49 1.48 idskerndsp
0 ? 15504 root 154 20 6620K 5564K sleep 1:19 1.16 1.16 lmx.srv
3 ? 23836 root 152 20 4280K 4980K run 4:47 1.13 1.13 ns-slapd

Regards
Rainer