Jump to content United States-English
HP.com Home Products and Services Support and Drivers Solutions How to Buy
» Contact HP
More options
HP.com home
HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide: HP-UX 11i v1, HP-UX 11i v2 and HP-UX 11i v3 > Chapter 2 Configuring HP-UX HIDS

Enabling Multiple Agents

» 

Technical documentation

Complete book in PDF
» Feedback
Content starts here

 » Table of Contents

 » Index

If you have more than about 20 agent systems, you may have to modify a kernel parameter and a network parameter.

Enabling More than 23 Agents (Thread Limits)

You must ensure that the administration system provides enough threads per process to handle the maximum number of agent systems you will monitor at one time. The thread value is specified by the tunable kernel parameter max_thread_proc. You can compute its minimum value using the following formula:

max_thread_proc = 2 * <num_agents> + 18

Where: num_agents is the number of agent systems to be monitored.

By default, max_thread_proc is set to its minimum value, 64, which allows for 23 agents. The maximum value of max_thread_proc is governed by the configurable kernel parameter nkthread, which you can increase if you have a larger number of agents.

NOTE: The max_thread_proc is a dynamic tunable in HP-UX 11i version 1.6 and later. In earlier versions of HP-UX, a change to this parameter requires a reboot.

The max_thread_proc tunable can be modified using SAM (on HP-UX 11i v1 and HP-UX 11i v2 operating systems) or SMH (on HP-UX 11i v3 operating systems). Based on your operating system version, follow one of the procedures listed below to modify this tunable:

Procedure 2-6 To change the value of max_thread_proc on HP-UX 11i v1 and HP-UX 11i v2:

  1. Launch sam, the HP-UX System Administration Manager (SAM).

  2. Select Kernel Configuration.

  3. Select Configurable Parameters .

  4. Highlight the max_thread_proc parameter.

  5. Select Actions > Modify Configurable Parameter.

  6. Enter your new value in the Formula/Value box.

  7. Select OK.

    Your new value shows in the Pending column.

  8. Select File > Exit.

  9. If you changed the value create a new kernel and reboot. Follow the steps provided by SAM.

NOTE: In HP-UX 11i v2, the modification of kernel tunables and kernel configuration was moved from SAM to the kcweb system configuration interface. For more information, see Managing Systems and Workgroups: A Guide for HP-UX System Administrators for details.

Procedure 2-7 To change the value of max_thread_proc on HP-UX 11i v3:

  1. Launch smh, the HP-UX System Management Homepage (SMH).

  2. Select the max_thread_proc parameter.

  3. Select the Modify Tunable option located on the right hand side of your screen.

  4. Enter your new value in the New Setting [Expression/Value] box.

  5. Choose Modify. Your new value shows in the Pending column.

  6. Select OK to save the configuration. .

  7. If you changed the value, select View Pending Changes and reboot option located in the right hand side of the screen. Follow the steps provided by SMH.

Enabling More than 20 Inbound Requests

The HP-UX HIDS administration system communicates with agent systems using the TCP protocol. On some systems, the TCP parameter, tcp_conn_request_max, is set initially to allow up to 20 inbound requests to be active at one time. If you have a larger number of agent systems, this value can be inadequate.

If the tcp_conn_request_max value is too small an agent’s error log can contain messages, such as write_msg: error opening connection to remote host..., open_connection: connect error, and open_connection: Timed out waiting on select() for connect to complete.

You can view and change this parameter using the ndd command.

To view and change the value of tcp_conn_request_max, follow these steps:

  1. To view the current value, enter the following command:

    # ndd -get /dev/tcp tcp_conn_request_max

    If this value is 20, or some number smaller than the number of agent systems, then proceed to Step 2 and adjust it to the number of agents you plan to monitor, or greater.

  2. To change the value, log in as root and modify the /etc/rc.config.d/nddconf configuration file by adding the following lines:

    TRANSPORT_NAME[index]=tcp
    NDD_NAME[index]=tcp_conn_request_max
    NDD_VALUE[index]=value

    Where:

    • index is a shell array index, as described in the file,

    • value is the value to be assigned.

    For example, if this is the first entry in the file and you want to set the value of tcp_conn_request_max to 4096 enter the following:

    TRANSPORT_NAME[0]=tcp
    NDD_NAME[0]=tcp_conn_request_max
    NDD_VALUE[0]=4096

    The new value is applied on the next system boots.

  3. To apply the new value immediately, enter the following command:

    # ndd -c /etc/rc.config.d/nddconf

    To verify that the new value is active, use the ndd -get command as described in Step 1.

Printable version
Privacy statement Using this site means you accept its terms Feedback to webmaster
© Hewlett-Packard Development Company, L.P.