IDS dropping records!!

[Chetan_5]

We are looking at an enterprise-wide deployment of IDS. As a pilot, I have installed IDS server on an L2000 system and have an rp7410 as a client.

Periodically, the IDS agent on the client switches to an error status with the message
"Dropping audit records due to heavy load"

I have the following templates enabled for the client:
Monitor start of interactive sessions
Monitor login/logout
Monitor SetUID files
Change to log files
Failed su logins
Failed login attempts

I do not have the race condition and buffer overflow templates enabled as I understand that these templates are resource hogs.

Why does the agent keep running into the error status?

[Steven E. Protter]

This is proabably a performance or tuning issue. You might want to collect less data. It could also be a network bandwidth issue.

IDS Perf
http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/5187-0701/5187-0701_top.html&con=/hpux/onlinedocs/5187-0701/00/00/83-con.html&toc=/hpux/onlinedocs/5187-0701/00/00/83-toc.html&searchterms=Performance%7cIDS&queryid=20040803-095204
http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/A6829-96002/A6829-96002_top.html&con=/hpux/onlinedocs/A6829-96002/00/00/16-con.html&toc=/hpux/onlinedocs/A6829-96002/00/00/16-toc.html&searchterms=Performance%7cIDS&queryid=20040803-095204

I'm also includeing my standard script to catch general peformance issues, becuase the error could be triggered by general peformance issues.

Acording to your post, it would seem you have prudently limited how much ids data you collect.

SEP

[Chetan_5]

Steven,

The IDS client is a box which currently has minimal activity. I do not see any resource contention on the system except for memory. Memory utilization is in the 90s but no evidence of swapping.

I have fine tuned the templates so that they only monitor a small set of parameters.

IS anyone from HP monitoring this forum?

THanks for posting the links. But one of them is pointing to tuning controllers??

Chetan

[Stephanie Miller]

Hello Chetan,

The message about dropping audit records is happening because some process on the system is producing a high volume of system calls of the variety that your IDS configuration is tuned to monitor. This is the product's way of informing you that a trade-off for performance is being made at the expense of loosing some of the audit data collected for the intrusion detection. When the volume of system calls exceeds the capacity of the event correlator to keep pace, this error message is produced to let you know that in order to keep things running some audit records must be dropped from the queue to allow the correlator to catch up. Once the correlator has been able to catch up, another message is displayed to let you know the audit records are not longer being dropped from the queue.

The good news is that we have redesigned our correlator (or template engine might be a better way of thinking of it) to be able to process your event load more effeciently. We are also addressing previous performance limitations in the race condition and buffer overflow templates. This new release has a redesigned template engine that dramatically improves overall product performance and scalability. We are about to release beta of v3.0 (if you'd like to be part of the beta release, please contact me directly) in a matter of weeks. Our plan is to make the final release later in this calendar year and will be strongly recommending to our customers to upgrade to this version in order to take advantage of these performance improvements. The new release will also have utilities available to ensure any custom configurations you've made in your existing installation wll be converted without loss for v3.0

Cheers,
Stephanie