HP Host Intrusion Detection System (HIDS) manual

Host Intrusion Detection System (HIDS) v3.1 Sizing Guidelines and Tuning Primer

September 2005

HP Company Internal

Page 1 of 20

Contents

Page Legal Notices Warranty Restricted Rights Legend Copyright Notices Contents 4.0 REFERENCE DOCUMENTS/ WEB SITES APPENDIX A – CPU CONSUMPTION CPU Consumption on PA Processors CPU Consumption on Itanium Processors 1.1Product Identification 1.2 Purpose of Document 1.2 Intended Audience 1.3 Glossary 2.0OVERVIEW 2.1Product Overview 2.2 HP-UXHIDS Deployments 2.3 Sizing and Tuning Overview 3.0Sizing and Tuning Recommendations 3.1Sizing Guidelines 3.1.1 Single vs. Multi-Processor 3.1.2 Number of CPUs 3.1.3 Memory 3.2 Tuning Considerations 3.2.1 Product Tuning 3.2.1.1.1 Background 3.2.1.1.2 Avoid duplicate copies of a template 3.2.1.1.3 Avoid duplicate groups with overlapping functionality 3.2.2 Kernel Tuning 3.2.2.1.1 System performance over security 3.2.2.1.2 Security over system performance 3.2.2.1.3 How to change from non-blockingto blocking mode detect 3.2.2.2.5executable_stack 3.2.2.2.6maxdsiz 4.0 Reference Documents/ Web sites Appendix A – CPU Consumption CPU Consumption on PA Processors 2 Way PA CPU % 4 Way PA 8 Way PA Event/sec 16 Way PA CPU Consumption on Itanium Processors 2 Way IA 4 Way IA 8 Way IA 16 Way IA Appendix B – Resident Memory Consumption Page Memory Consumption on Itanium Processors 2 Way IA