![](/images/new-backgrounds/1308409/308409517x1.webp)
Troubleshooting
Troubleshooting
6.Have the secure communications certificates expired?
—On the administration system, run the script
/opt/ids/bin/IDS_checkAdminCert. If the certificate has expired, rerun
/opt/ids/bin/IDS_genAdminKeys with the update parameter. See “Setting Up the
—On the agent system, run the script /opt/ids/bin/IDS_checkAgentCert. If the certificate has expired, rerun /opt/ids/bin/IDS_genAgentCerts for the agent on the administration system. Then reimport the certificates on the agent system with /opt/ids/bin/IDS_importAgentKeys. See “Setting Up the
Normal operation of an application generates heavy volume of alerts
❏To avoid becoming overwhelmed with unnecessary alert generation, you will need to customize the detection templates to meet the needs of your particular environment. If you have an application that generates a heavy volume of alerts during its normal mode of operation, you can reduce this occurrence by entering additional filtering into the necessary detection templates (most offer mechanisms by which these spurious alerts can be suppressed).
❏For example, a system with the Resource Management subsystem might trigger a heavy volume of alerts since it frequently updates some files in /etc/opt/resmon. You can go to the Schedule Manager and modify the “Modification of files/directories” template to have it ignore the /etc/opt/resmon directory. (This filtering is provided by default in
❏See “Suggested Best Practices” on page 73.
Reflection X rlogin produces multiple login and logout alerts
When logging in using rlogin within Reflection X, the login/logout template will report two login alerts followed immediately by a logout alert. This is expected behaviour and reflects how Reflection X immediately terminates a login session after bringing up a remote window.
Schedule Manager timetable screen appears to hang
❏The visual refresh of the day, time, and surveillance group matrix (which the System Manager maintains in the Schedule Manager timetable screen) is CPU intensive and hence may appear to be slow on some systems.
SSH does not perform a clean exit after idsgent is started
After starting idsagent from a ssh login, logging out of the agent system results in the ssh session hanging indefinitely. The following are some workarounds:
ssh
ssh
Appendix G | 247 |