enable_idds(5)                                               enable_idds(5)
                          Tunable Kernel Parameters



 NAME    [Toc]    [Back]
      enable_idds - enable intrusion detection data source

 VALUES    [Toc]    [Back]
    Failsafe
      0 (off)

    Default    [Toc]    [Back]
      0 (off)

    Allowed values    [Toc]    [Back]
      0 (off) or 1 (on)

    Recommended values    [Toc]    [Back]
      1 (on) if HP-UX HIDS is installed,

      0 (off) otherwise.

 DESCRIPTION    [Toc]    [Back]
      If enable_idds is set to 1, then the HP-UX Host Intrusion Detection
      System (HP-UX HIDS) can enable the collection of kernel data for
      intrusion detection.  This also causes additional things to be tracked
      by the kernel, resulting in a small degradation in performance (and
      increase in kernel memory usage), even if HP-UX HIDS is not in use.

    Who Is Expected to Change This Tunable?
      Anyone using HP-UX HIDS.

    Restrictions on Changing    [Toc]    [Back]
      Changes to this tunable take effect at the next reboot.

    When Should the Tunable Be Turned On?
      This tunable should be turned on if HP-UX HIDS is installed.  The
      installation will automatically turn on enable_idds.

    What Are the Side Effects of Turning the Tunable On?
      The name of the current working directory (and root directory) of
      every process is tracked, resulting in a change in memory usage and
      performance of the system.

    When Should the Tunable Be Turned Off?
      If HP-UX HIDS is not being used enable_idds should be turned off.

    What Are the Side Effects of Turning the Tunable Off?
      When turned off, HP-UX HIDS is unable to use any detection template
      that uses idskerndsp.  (See the documentation for HP-UX HIDS for more
      information on idskerndsp.)

    What Other Tunables Should Be Changed at the Same Time?
      This tunable is independent of other tunables.




 Hewlett-Packard Company            - 1 -      HP-UX 11i Version 2: Sep 2004






 enable_idds(5)                                               enable_idds(5)
                          Tunable Kernel Parameters



 WARNINGS    [Toc]    [Back]
      All HP-UX kernel tunable parameters are release-specific.  This
      parameter may be removed or have its meaning changed in future
      releases of HP-UX.

      Installation of optional kernel software, from HP or other vendors,
      may cause changes to tunable parameter values.  After installation,
      some tunable parameters may no longer be at the default or recommended
      values.  For information about the effects of installation on tunable
      values, consult the documentation for the kernel software being
      installed. For information about optional kernel software that was
      factory installed on your system, see HP-UX Release Notes at
      http://docs.hp.com.

 AUTHOR    [Toc]    [Back]
      enable_idds was developed by HP.

 SEE ALSO    [Toc]    [Back]
      ids.cf(5),
      with: MANPATH: /opt/ids/share/man,

      HP-UX Host Intrusion Detection System Administrator's Guide.


 Hewlett-Packard Company            - 2 -      HP-UX 11i Version 2: Sep 2004