IDS-9000 Trim Alert Database

[Glenn Mitchell_2]

System: HP 9000/800 L1000
OS: HP-UX 11.11
Application: HP IDS 9000 B.02.01.32 (J5083AA)

How and where do I trim the ids databases to eliminate alerts and errors that are greater than 3 months old? I have over 35,000 alerts that are displayed when I bring up the gui (/opt/ids/bin/idsgui). Dates shown go back years. I mark all alerts as “read” and delete those whose dates are greater than 3 months old. I then save the file and exit the gui. Later when I open the IDS gui, all 35,000+ alerts are again displayed as unread new alerts.

[Adisuria Wangsadinata_1]

Hi,

There's a process called 'log file rotation'. Check this document at url below about 'HP Intrusion Detection System/9000 Administrator's Guide: Software Release 2.0' :

http://docs.hp.com/en/J5083-90007/index.html

And also check the thread below :

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=725998

Hope this information can help you.

Cheers,
AW

[Glenn Mitchell_2]

The Log File Rotation does not solve my problem. I exited the ids gui and renamed the /var/opt/ids/gui/logs/alert.log file. I restarted the ids gui and noted that a new alert.log file is created. After the polling activity the System Manager view once again counts up 35000+ alerts and continues to display a message that â No Agent is Availableâ . I select â Statusâ and its report changes to â Readyâ . After reading the reports I check all as "read" and delete all but the 3 months needed - and save the results. I exit and reenter the gui and once again it counts up all 35000+ entries as before.

[Pierre Pasturel]

Glenn -

When performing alert file rotation, you need to rotate the alert.log file on the agent (sensor) system (i.e., /var/opt/ids/alert.log), not the GUI's local alert file.

Regardless, during a resync, the GUI will resync all alerts with a timestamp newer than the most recent alert currently displayed by the GUI. So if you have left recent alerts in the GUI, as it appears that you have, you should only see more recent alerts during a resync. If you remove *all* alerts in the GUi and then perform a resync, you will get *all* alerts in the agent's alert.log file (i.e., all 35K). See p. 49 of the V3.1 Admin Guide available on docs.hp.com.

I noticed that you are running an old version of HIDS. I would encourage you to upgrade to the latest release (V3.1 available on software.hp.com) that has significant performance improvements.

I can't remember off hand if V2.1 had problems with a resync.

Pierre

[Glenn Mitchell_2]

I finally got my alerts trimmed down to a more manageable 1200+ (it was up to 43000+ by the time I got it to work under a more reasonably configured schedule). Because the system is a validated Production server, I must evaluate the software upgrade first on the Development server and then submit a ton of paperwork for the upgrade to be approved. For now I am in good shape and I thank you for your assistance.