HIDS: problems using GUI

[MWTRemoteUnix]

I'm having problems getting the gui to come up using the /opt/ids/bin/idsgui script. After I export my display, I run the script, and it gives the standard "staring in the background" message but it never comes up. I can start up an xterm, xclock, etc. with no problems, but no IDS GUI. I found this error log, hopefully it can shed some light.

/var/opt/ids/gui/guiError.log:

java.lang.NullPointerException
at com.hp.Sentinalv0101.util.TableEntryObjectSortComparator.lessThan(TableEntryObjectSortComparator.java:18)
at com.hp.Sentinalv0101.util.MergeSorter.merge(MergeSorter.java:41)
at com.hp.Sentinalv0101.util.MergeSorter.mergeSort(MergeSorter.java:100)
at com.hp.Sentinalv0101.util.MergeSorter.mergeSort(MergeSorter.java:98)
at com.hp.Sentinalv0101.util.MergeSorter.mergeSort(MergeSorter.java:98)
at com.hp.Sentinalv0101.util.MergeSorter.mergeSort(MergeSorter.java:98)
at com.hp.Sentinalv0101.util.MergeSorter.mergeSort(MergeSorter.java:98)
at com.hp.Sentinalv0101.util.MergeSorter.sort(MergeSorter.java:115)
at com.hp.Sentinalv0101.commonInterfaces.AbsSortableTable.sort(AbsSortableTable.java:368)
at com.hp.Sentinalv0101.alertTable.AlertEventTable.getLatestEntry(AlertEventTable.java:295)
at com.hp.Sentinalv0101.alertTable.AlertEventBrowser.getLatestAlertEventTime(AlertEventBrowser.java:814)
at com.hp.Sentinalv0101.alertTable.AlertEventBrowser.setBrowserInformation(AlertEventBrowser.java:306)
at com.hp.Sentinalv0101.commonInterfaces.AbsEventBrowser$UpdateTableCommand.execute(AbsEventBrowser.java:686)
at com.hp.Sentinalv0101.commonComponents.GenericTextFileManager.doCompletionCommand(GenericTextFileManager.java:108)
at com.hp.Sentinalv0101.commonComponents.GenericTextFileManager.access$400(GenericTextFileManager.java:33)
at com.hp.Sentinalv0101.commonComponents.GenericTextFileManager$1.run(GenericTextFileManager.java:284)
java.lang.NullPointerException
at com.hp.Sentinalv0101.util.TableEntryObjectSortComparator.lessThan(TableEntryObjectSortComparator.java:18)
at com.hp.Sentinalv0101.util.MergeSorter.merge(MergeSorter.java:41)
at com.hp.Sentinalv0101.util.MergeSorter.mergeSort(MergeSorter.java:100)
at com.hp.Sentinalv0101.util.MergeSorter.mergeSort(MergeSorter.java:98)
at com.hp.Sentinalv0101.util.MergeSorter.mergeSort(MergeSorter.java:98)
at com.hp.Sentinalv0101.util.MergeSorter.mergeSort(MergeSorter.java:98)
at com.hp.Sentinalv0101.util.MergeSorter.mergeSort(MergeSorter.java:98)
at com.hp.Sentinalv0101.util.MergeSorter.sort(MergeSorter.java:115)
at com.hp.Sentinalv0101.commonInterfaces.AbsSortableTable.sort(AbsSortableTable.java:331)
at com.hp.Sentinalv0101.commonInterfaces.AbsSortableTable$SortActionListener.actionPerformed(AbsSortableTable.java:750)
at javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:1445)
at javax.swing.AbstractButton$ForwardActionEvents.actionPerformed(AbstractButton.java:1499)
at javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:373)
at javax.swing.JToggleButton$ToggleButtonModel.setPressed(JToggleButton.java:263)
at javax.swing.AbstractButton.doClick(AbstractButton.java:274)
at javax.swing.AbstractButton.doClick(AbstractButton.java:254)
at com.hp.Sentinalv0101.commonInterfaces.AbsSortableTable.buildSortMenu(AbsSortableTable.java:478)
at com.hp.Sentinalv0101.commonInterfaces.AbsEventBrowser.buildSortMenu(AbsEventBrowser.java:414)
at com.hp.Sentinalv0101.commonComponents.NetworkNode.(NetworkNode.java:320)
at com.hp.Sentinalv0101.commonComponents.NetworkNodeManager.addNetworkNode(NetworkNodeManager.java:94)
at com.hp.Sentinalv0101.hostTable.HostList$HostListCommand.execute(HostList.java:253)
at com.hp.Sentinalv0101.commonComponents.GenericTextFileManager.doCompletionCommand(GenericTextFileManager.java:108)
at com.hp.Sentinalv0101.commonComponents.GenericTextFileManager.access$400(GenericTextFileManager.java:33)
at com.hp.Sentinalv0101.commonComponents.GenericTextFileManager$1.run(GenericTextFileManager.java:284)

[Pierre Pasturel]

Please give the output of the following commands:

swlist -l product | grep Java
swlist HPUX-HIDS

Pierre

[MWTRemoteUnix]

I should also note, that this was working up until late last week. Nothing that I know of has changed on the server.


ml048-root> swlist -l product | grep Java
Jdk13 1.3.1.13.00 Java2 1.3 SDK
Jre13 1.3.1.13.00 Java2 1.3 RTE 1.3
ml048-root> swlist HPUX-HIDS
# Initializing...
# Contacting target "ml048"...
#
# Target: ml048:/
#

# HPUX-HIDS B.03.01.03 HP-UX Host IDS B.03.01
HPUX-HIDS.IDS B.03.01.03 HP-UX Host IDS B.03.01
HPUX-HIDS.IDS-KRN B.03.00.00 HP-UX Host IDS B.03.00

[Pierre Pasturel · Accepted solution]

Run swverify on the the Java and HIDS bundles and see if it reports any errors.

If swverify does not report any errors, try the following on the server (gui) host:
- Move any _alert.log and _error.log files from /var/opt/ids/gui/logs to /var/opt/ids/tmp or any temporary directory.
- Remove /var/opt/ids/gui/guiError.log and /var/opt/ids/gui/logs/Trace.log
- Run /opt/ids/bin/idsgui

If the GUI comes up, then you can resync the alerts from the agents if you wish. The problem was probably a corrupt _alert.log or _error.log file.

If the GUI does not come up, contact your normal support channel and be sure to give them the new guiError.log and Trace.log files.

Pierre

[MWTRemoteUnix]

Bingo, must have been a corrupt file, moved all the log files out, and it started right up. Thanks!