IDS/9000 System Manager startup

[Bosco Tsang]

Everytime when I startup System Manager, the monitored host status always return "agent not found" even though the idsagent (on the same machine as System Manager) is running. I will have to click on Status again (something need to click a few times) before the status is reported "running". I am running latest version (2.01) now. Any idea on what happen? How can I fix this?

[Jeff Schussele]

Hi Bosco,

I'm not sure you have a problem here. I can't remember whether the client or server broadcasts or polls, but there will be some delay before the server sees the agent. Think this period can be adjusted.

See figure 7.1 in chapter 7 "Selecting IDS/9000 Preferences" of the guide - here's the URL for PDF the on-liune doc:

http://docs.hp.com/hpux/pdf/J5083-90001.pdf

HTH,
Jeff

[Pierre Pasturel]

If you have a large number of alerts, you have the automatic resynchronzation at statup, and you have the default "alert response time" setting of 30 seconds, a timeout can be expected.

Since it sometimes takes you a few tries to manually poll the agent, you might want to try to increment the agent response time to 60 seconds in the admin gui preferences window and modify the timeout values for the agent (see the Remote Communication Configuration section in Appendix D of the admin guide).

You can use the -c option of the agent to print error messages coming from the agent communication layer.

Pierre

[Bosco Tsang]

I have increased the timeout value to 90 sec and since then it works fine. Thanks.

However, what I am wondering is that as I am only test run this service, and got only one agent install (in fact, it's on the same host as the admin server), wonder why it's still that slow?

[Pierre Pasturel · Accepted solution]

The admin and agent perform an SSL handshake when they first establish connections, and this handshake can take several seconds.

The GUI will set the timeout on the SSL handshake to be equal to 1/3 of the agent response timeout, so, 10 seconds for an agent response time equal to 30sec.

My guess is that the SSL handshake is taking longer than 10 secs on your system and perhaps more than 20secs if you tried an agent response timeout of 60secs.

BTW, the admin does spawn a thread for each agent connection, so connections are established with multiple agents in parallel.

You can find out more about whether this is an SSL timeout issue by setting debugging on for the GUI (TRACE_LEVEL=2 in idsgui) and for the agent (-c 2) and check their corresponding debug files
(/var/opt/ids/gui/logs/Trace.log for the gui). The agent log file will contain a line such as "accept_connection: Timed out attempting to perform SSL Handshake as server. Time ellapsed = X secs." if a time out occurs or "accept_connection: SSL handshake successful on server side! Took X seconds." if the SSL handshake is successfull. There is also a second handshake that occurs to establish another connection from the agent to the admin.

Pierre


Pierre