questions on using IDS

[shacharg]

Hello,

I have IDS/9000 v2 on HPUX11.0 server.
I recieve many alerts "Filesystem change detected" for activities made on files :
"/etc/syslog.conf.[0-9]+" (for example /etc/syslog.conf.6757). I tried regular expression with *, <*> to exclude it but it doesn't work.

Is any way to exclude these files ?

Thanks,
Alex

[Clemens van Everdingen]

Hi,

Did you check the Administrator guide:

http://www.docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/J5083-90007/J5083-90007_top.html&con=/hpux/onlinedocs/J5083-90007/00/00/37-con.html&toc=/hpux/onlinedocs/J5083-90007/00/00/37-toc.html&searchterms=IDS&queryid=20020408-012039

C.

[Pierre Pasturel]

Use "/etc/syslog.conf." in the "Ignore these directories" in the Modifcation of files/directories template.
This string will match /etc/syslog.conf.1212 but also /etc/syslog.conf.otherstuff.

If you refer to the regular expression section in the appendix of the admin guide, /etc/syslog.conf.<#>$ is what you really want, but unfortunately this does not work.

BTW, you can only specify regular expressions for the "directory property;" the "file" properties are only used for exact string matches.

Pierre