questions on using IDS

[Greta Blamire]

I've installed the IDS agent and server on a test system. I read the IDS admin guide which answered most of my questions, but I'm still having some problems. I wanted to start out simple so I just have the login monitoring scheduled for 24x7. However, it doesn't send an alert when I log off and on the system. Also, everytime I bring up the system manager the agent isn't in "running" status even though it was in running status the last time I wan in sytem manager. Shouldn't it be running whether I have the system manager up or not

[Krishnan Viswanathan]

Couple of things:

a) Is your "schedule" on the agents supposed to be running all the time ? If so, to verify, pl log into your agent boxes and check this :
ps -ef |grep ids . If you see processes such as idskerndsp, idscor, idssysdsp etc.. then it means that the scheduler is active.

b) When you start up the idsgui, typically the admin console first "polls" for agents, if they are there, then they are synchronised and the status is shown as "available". If there is schedule running then the status is shown as "running". However, if you had disabled the automatic polling/synchronisation option at startup then (via the "preferences" menu) then you would have do a manual polling to make the status "available" or "running" as the case maybe

Hope this helps
Krishnan

[Greta Blamire]

Thanks for the reply, when I check for the agent, I do see idskern and idsagent in the processes. And it does the polling automatically when I bring up the ids system manager. But, even with those processes showing up, whenever I bring up the IDS system manager the status is "no agent available" after the polling is complete. So then I resync it, which takes about 10 minutes to complete, but still it comes up with no agent. But in the processes there is idskerndsp and idscor. How can I get my agent to run all the time

[Pierre Pasturel]

Which version of IDS are you running?

Which templates are running in your schedule? If you are running the preconfigured LoginMonitoringAlwaysOn, you should only see the processes idsagent, idssysdsp, and idscor. If you see idskerneldsp, then you must also be running a template which requires audit data.

Run "top" and let me the CPU usage of idscor.

Pierre

[Joanne Keegan]

Hi Greta,

I have been working with IDS on my site, and find that once I start the IDS gui, if I check its status once the polling has completed, it ususally comes back saying that the agent is available, etc.

Good luck,

Jo

[Rainer von Bongartz]

Greta,


two things to check

1) are you running 1.0 or 2.0
running on 1.0 will always produce this problems

2)
running on 2.0 (which is a must!!) check the timeout values using your gui. Getting messages 'no agent running' usually means you'll have to double this time out values.

There will be a patched version of IDS out soon I guess. I did some beta testing on this and most of this problems will be gone with 2.x.


Regards
Rainer

[Greta Blamire]

Thanks everyone,
I ended up opening a log on this and we came up with the following solutions:
1. Fully patch IDS - I was missing PHCO_16127, PHKL_24266, KL-24502 & KL_25210.
This made a huge difference in the cpu usage of IDS. After I patched then the problem with "no agent available" status was resolved. I found that when my CPU was pegged at 100% IDS often reported no agent, even though the agent was running.
2. Copying the template and running that as a schedule, not running the template. The templates are in a read only sector and so when you run a template it can't write alert log entries.
So it's working for me now, it's great product once you figure out how to use it!