topic Re: questions on using IDS in Operating System - HP-UX

questions on using IDS

Greta Blamire — Thu, 14 Mar 2002 21:50:58 GMT

I've installed the IDS agent and server on a test system. I read the IDS admin guide which answered most of my questions, but I'm still having some problems. I wanted to start out simple so I just have the login monitoring scheduled for 24x7. However, it doesn't send an alert when I log off and on the system. Also, everytime I bring up the system manager the agent isn't in "running" status even though it was in running status the last time I wan in sytem manager. Shouldn't it be running whether I have the system manager up or not

Re: questions on using IDS

Krishnan Viswanathan — Fri, 15 Mar 2002 04:18:41 GMT

Couple of things:

a) Is your "schedule" on the agents supposed to be running all the time ? If so, to verify, pl log into your agent boxes and check this :
ps -ef |grep ids . If you see processes such as idskerndsp, idscor, idssysdsp etc.. then it means that the scheduler is active.

b) When you start up the idsgui, typically the admin console first "polls" for agents, if they are there, then they are synchronised and the status is shown as "available". If there is schedule running then the status is shown as "running". However, if you had disabled the automatic polling/synchronisation option at startup then (via the "preferences" menu) then you would have do a manual polling to make the status "available" or "running" as the case maybe

Hope this helps
Krishnan

Re: questions on using IDS

Greta Blamire — Tue, 26 Mar 2002 22:24:10 GMT

Thanks for the reply, when I check for the agent, I do see idskern and idsagent in the processes. And it does the polling automatically when I bring up the ids system manager. But, even with those processes showing up, whenever I bring up the IDS system manager the status is "no agent available" after the polling is complete. So then I resync it, which takes about 10 minutes to complete, but still it comes up with no agent. But in the processes there is idskerndsp and idscor. How can I get my agent to run all the time

Re: questions on using IDS

Pierre Pasturel — Mon, 22 Apr 2002 23:49:04 GMT

Which version of IDS are you running?

Which templates are running in your schedule? If you are running the preconfigured LoginMonitoringAlwaysOn, you should only see the processes idsagent, idssysdsp, and idscor. If you see idskerneldsp, then you must also be running a template which requires audit data.

Run "top" and let me the CPU usage of idscor.

Pierre

Re: questions on using IDS

Joanne Keegan — Tue, 23 Apr 2002 01:42:34 GMT

Hi Greta,

I have been working with IDS on my site, and find that once I start the IDS gui, if I check its status once the polling has completed, it ususally comes back saying that the agent is available, etc.

Good luck,

Jo

Re: questions on using IDS

Rainer von Bongartz — Tue, 23 Apr 2002 06:05:19 GMT

Greta,

two things to check

1) are you running 1.0 or 2.0
running on 1.0 will always produce this problems

2)
running on 2.0 (which is a must!!) check the timeout values using your gui. Getting messages 'no agent running' usually means you'll have to double this time out values.

There will be a patched version of IDS out soon I guess. I did some beta testing on this and most of this problems will be gone with 2.x.

Regards
Rainer

Re: questions on using IDS

Greta Blamire — Tue, 23 Apr 2002 12:42:00 GMT

Thanks everyone,
I ended up opening a log on this and we came up with the following solutions:
1. Fully patch IDS - I was missing PHCO_16127, PHKL_24266, KL-24502 & KL_25210.
This made a huge difference in the cpu usage of IDS. After I patched then the problem with "no agent available" status was resolved. I found that when my CPU was pegged at 100% IDS often reported no agent, even though the agent was running.
2. Copying the template and running that as a schedule, not running the template. The templates are in a read only sector and so when you run a template it can't write alert log entries.
So it's working for me now, it's great product once you figure out how to use it!