HIDS vs. auditing

[Lev Assinovsky]

Hi All!
I have HIDS newbie question. I have found that many auditing commands (audisp, audwrite etc) will be obsoleted in the future releases and auditing will be based on /dev/idds interface. Does it mean that HIDS replaces current auditing or auditing will just use such piece of HIDS as /dev/idds?
Thanks.

[R. Sri Ram Kishore_1]

Hi,

I guess it will be the other way around... HIDS will use the new idds for auditing HP-UX.

Regards,
Sri Ram

[Sridhar Bhaskarla · Accepted solution]

Hi,

The latest I heard from HP is that they are going to have both. Both will use the same data source. There may be a change in the commands like audisp used by Auditing as a result of this.

I personally like Auditing than IDS/9000 may be because Auditing doesn't have a GUI :-). I find it easier to work with Auditing than click and wait as with IDS.

-Sri

[Hemanth Gurunath Basrur]

Hello Lev,

Also, refer to the foll. link for more information on HIDS:

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=J5083AA

HTH.

Regards,
Hemanth