IDS/9000: Logins/logouts

[Ron Levy]

One of the level 2 warnings I get from IDS/9000 is: Logout:""
It appears to be the signal I get when an FTP
user logs out; no username, just blank.
(This happens to be the result of one of our internal applications and happens very often).
How can I configure IDS/9000 not to warn me about this? Blanks don't seem to be allowed, nor are wildcards that match, and I would like to keep the logins/logouts template running.

Thanks,
-Ron Levy

[Steven E. Protter]

You might want to track it down further and match it against /var/adm/syslog/syslog.log and make sure you don't have a security problem. Also the application should not be doing that.

Here are the docs on configuring IDS/9000

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/J5083-90008/J5083-90008_top.html&con=/hpux/onlinedocs/J5083-90008/00/00/20-con.html&toc=/hpux/onlinedocs/J5083-90008/00/00/20-toc.html&searchterms=configuration%7cIDS/9000&queryid=20030613-110728

What IDS/9000 doesn't do.
http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/J5083-90007/J5083-90007_top.html&con=/hpux/onlinedocs/J5083-90007/00/00/9-con.html&toc=/hpux/onlinedocs/J5083-90007/00/00/9-toc.html&searchterms=configuration%7cIDS/9000&queryid=20030613-110728

http://docs.hp.com/hpux/pdf/J5083-90001.pdf

An itrc thread that might be relavent.

http://search.hp.com/redirect.html?url=http%3A//forums.itrc.hp.com/cm/QuestionAnswer/1,,0x35bf6af52b04d5118fef0090279cd0f9,00.html&qt=IDS/9000+configuration+blank+ftp+user&hit=10

SEP

SEP