HP IDS (IDS/9000) Admin GUI is Too Slow

[Alzhy]

I've just tred the release 2.2.. installed it on a rp8400 vPar ( with 2 x 875Mhz CPU's, 4 GB RAM, 11.11 JUN2003, Java 1.3.1.X -- latest and greates patches).. I am running both agent and admin on same box... just launchingthe GUI is sooo slow... Finally have the GUI but interaction is soo slow... Leaft it for about an hour, java is still hogging CPU and the GUI is still virtually unresponsive...

Any clues? Am about to separate agent and admin but the only available Admin box that I have is a D390 with 2 x 250Mhz CPU's... is htis enough?

[Steven E. Protter]

IDS/9000 gets very piggy if you have it checking too many things.

Though your hardware is lighning fast, in the Internet Security lab, we kept the client and server on two different boxes, physically. Since we were using D boxes, we made sure nothing especially hard was running on the server box.

If we turned on all options, we ground the hardware to a halt.

SEP

[Emil Velez]

The race condition template is pretty invasive. If you are careful with what templates you use it works ok.

It is written in java..

[Alzhy]

Conclusion:

I think HP IDS is not ready (yet) for primetime....

[Hazem Mahmoud_3]

Check the templates you chooose, like what was recommended before, but also check the values of the properties for these templates. For example, make sure that the "Modification of Files/Directories" does not check too many files. Situations like that can cause consumption of the processor. I had a similar problem when configuring it, and after tweaking some of the values, I was able to get it to work at an acceptable level. You also probably want your admin server to be a dedicated server. Do not use it for any other purposes. The D390 should be enough, but again it depends on what it is checking.

-Hazem
Sr. Unix Admin

[Skand]

Hi,

The startup of ids/9000 admin GUI *is* quite CPU intensive. The primary culprit for this being the random seed generator in the java.security package. Depending on the system load and the length of the seed bytes it may take from 6sec to >60sec to seed. This might give some explanation as to why the startup of the GUI is so slow.

This still does not justify the sluggish behaviour that you are seeing ( especially with the m/c configuration that you have mentioned ). Can you provide with some more details on the environment under which you have configured the ids/9000 product? I am mainly looking for the system load ( including any other CPU intensive processes )that you are running and the schedules( templates that have been configured and the time schedules for the same ) that you have configured in ids/9000.

Skand.