Syntax Errors after HIDS upgrade from 2.2 to 3.1

[Andrew Pollard]

Hi,

I have just upgraded HIDS from v2.2 to v3.1. After the upgrade I ran "/opt/ids/bin/guiSchedConvert" which said it was "migrating" a number of groups. When I run the command again, it says that all of my groups are now a version 3.0 group.

Then when I try to activate a schedule on my monitored host, I get lots of "Syntax error on line...of schedule file /var/opt/ids/schedule: Unknown schedule data...".

It looks to me that a "^" must now be at the beginning of all new lines when specifying what or what not to monitor.

Is there something else I need to run so that the "^" will appear?

Any help would be great,

Thanks
Andrew

[Pierre Pasturel · Accepted solution]

Andrew -

Sorry for the long response time.

The "Unknown schedule data" error message indicates that your agent is a V2.2 agent and not a V3.x agent.

A V3.x GUI can only manage V3.x agents. We broke compatibility because we overhauled the schedule syntax you see in /var/opt/ids/schedule that is produced by the GUI and parsed by the agent.

Pierre

[Andrew Pollard]

Hi Pierre,

Thanks for the reply. You are right, during the first upgrade the agent did not install correctly. It is now working properly after a second upgrade.

Thanks again

Andrew