IDS/9000 tweaking

[Terrence]

One of the default actions by IDS/9000 is to watch /var/adm/wtmp for modifications. It's supposed to be append only. However fairly frequent it's reporting that the file is opened by user 0 for modification/truncation.

Yet I know that no one is logging on to that server. Does anyone know of any other action that might modify wtmp?

[Pierre Pasturel · Accepted solution]

I just want to verify that the alert itself is saying "UNKNOWN" program, yes? If so, try the following in this order:

1) Try running "ps -ef |grep " where is the process ID in the alert. Hopefully the process is persistent.

2) With the schedule you are running in /var/opt/ids/schedule, reboot the system, at which time the agent will automatically restart with that schedule and hopefully you will see the alert again, this time with the name of the program doing the modification.

The reason why the agent is displaying "UNKNOWN" for the program is because the schedule was started AFTER the program was exec-ed, so the agent can't map the pid to the program executable. This is a problem we hope to resolve in a future release.

Pierre