HIDS problem

[Rene Mendez_4]

Hi have many problems with IDS 9000 version 2.2 when download new version the HIDS.

Problem with:
Message KernelDSP:idskerndsp
Now no audit login (this is configured)
Problem with performance the idscor.

Regards.
Rene

[Pierre Pasturel]

Rene -

I will need more details about the problem
with the kernel dsp and with no "audit login." Please provide any error messages you are observing, details about your schedule, expected vs actual behavior, etc....

As far as performance, this is being addressed in the upcoming V3.0 release due out before the end of the year.

Pierre

[Rene Mendez_4]

Hello thanks for you response

I send top in this show idsagent use all processor.

In manager present error:
1%Tue Oct 19 10:22:51 2004%10002%KernelDSP:idskerndsp: Dropping audit records due to heavy load. First notice.
1%Tue Oct 19 10:23:03 2004%10002%KernelDSP:idskerndsp: No longer dropping audit records.

I send the configurations.

Regards
Rene

[Gratien D'haese_2]

Did you activate the templates "race condition attacks" and "buffer overflow attacks"? If yes, then try to de-activate those and watch how the CPU behaves?

Another reason could be the use of "blocking mode" (IDDS_MODE 2 set by default). If the problem persists set IDDS_MODE to 3 in the /etc/opt/ids/ids.cf file.

Gratien

PS: HIDS A.03 will address this problem according HP (cfr. Pierre Pasturel who follows this forum for HIDS & HP).

[Dennis E. James]

Just curious any idea when HIDS A3.0 will be available.

[Pierre Pasturel]

Rene-

These issues are addressed by V3.0, although under heavy load conditions, running the Race Condition template might still result in audit records being dropped by the idskerndsp.

V3.0 is due out before the end of the calendar year. I will post a notice on this forum when it is available on software.hp.com.

Pierre