Halting HP-UX HIDS Agents

To halt agents remotely from the System Manager, follow these steps:

1. On the System Manager screen, in the Monitored Hosts list, select the hosts you want to halt.

2. Perform one of the following tasks to halt the agent host:

   • Choose the Actions > Halt IDS Agent menu item.

   • Press Shift+F10.

   The schedules, if any, are stopped on and removed from the selected host. The agent is halted on the selected hosts. The Status fields are set to No Agent Available and the Schedule field is set to None.

   The schedules are not available for automatic restart.

Procedure 4-9 To halt the agent locally on the agent host, follow these steps:

• On the agent host, perform one of the following steps to halt the agent locally:

  • Log in to the agent system as root and enter the following command:

    $ kill -TERM $(cat /var/opt/ids/idsagent.pid)

    	NOTE: You can also do this as user ids.

  • Log in to the agent system as superuser (root) and enter the command:

    $/sbin/init.d/idsagent stop

    This command is automatically executed when the agent system is shut down with the shutdown command.

  The agent is halted on the host. The status of the agent host on the System Manager does not update itself automatically. The next time you run a System Manager command for the agent, the Status field is set to No Agent Available and the Schedule field is set to None on the System Manager screen.

  When the agent is halted, the schedule, if any, is retained and remains available for automatic restart.

  	IMPORTANT: If an agent did not halt as above, you may need to clean up the message queues. For more information, see “Agent halts abnormally, leaving ids_* files and message queues”.