topic questions on using IDS in Operating System - HP-UX

questions on using IDS

shacharg — Mon, 08 Apr 2002 06:33:32 GMT

Hello,

I have IDS/9000 v2 on HPUX11.0 server.
I recieve many alerts "Filesystem change detected" for activities made on files :
"/etc/syslog.conf.[0-9]+" (for example /etc/syslog.conf.6757). I tried regular expression with *, <*> to exclude it but it doesn't work.

Is any way to exclude these files ?

Thanks,
Alex

Re: questions on using IDS

Clemens van Everdingen — Mon, 08 Apr 2002 07:15:13 GMT

Hi,

Did you check the Administrator guide:

http://www.docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/J5083-90007/J5083-90007_top.html&con=/hpux/onlinedocs/J5083-90007/00/00/37-con.html&toc=/hpux/onlinedocs/J5083-90007/00/00/37-toc.html&searchterms=IDS&queryid=20020408-012039

C.

Re: questions on using IDS

Steve Steel — Mon, 08 Apr 2002 07:39:39 GMT

Re: questions on using IDS

Pierre Pasturel — Mon, 22 Apr 2002 23:24:31 GMT

Use "/etc/syslog.conf." in the "Ignore these directories" in the Modifcation of files/directories template.
This string will match /etc/syslog.conf.1212 but also /etc/syslog.conf.otherstuff.

If you refer to the regular expression section in the appendix of the admin guide, /etc/syslog.conf.<#>$ is what you really want, but unfortunately this does not work.

BTW, you can only specify regular expressions for the "directory property;" the "file" properties are only used for exact string matches.

Pierre