18.07.2013 Views

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Example alarm<br />

event scenario<br />

Example alarm event scenario<br />

Where x defines the number <strong>of</strong> seconds the system should cache<br />

data from previous Strikebacks. If you want the latest Strikeback<br />

information on an IP address every time, set this value to zero. For<br />

example, if you do not want information on an IP address<br />

involved in an alarm to be more than one minute old, set the value<br />

to 60. The default is set at 43200, or 12 hours. To change the<br />

option, open the file in any editor.<br />

Strikeback timeout—To configure the Strikeback timeout option, use<br />

the following command:<br />

cf audit set strikeback.timeout=x<br />

Where x defines the maximum amount <strong>of</strong> time (in seconds) that a<br />

Strikeback process should take (600 is the default).<br />

As described in the previous section, the <strong>Sidewinder</strong> <strong>G2</strong> can track a<br />

number alarm event types. Using the Admin Console, you can<br />

configure how many <strong>of</strong> these events must occur within a specific time<br />

frame before an alarm is triggered, and what should happen when an<br />

alarm is triggered.<br />

The steps below walk you through the events that take place when an<br />

alarm occurs:<br />

1. The auditbot daemon determines that an alarm event should be<br />

triggered.<br />

The system is configured with default event responses for each type <strong>of</strong><br />

alarm event, but you can also define and select your own options (see<br />

“Configuring alarm events” on page 17-2). For example, you may set up<br />

your system so that five probe attempts in 30 seconds will trigger an<br />

alarm.<br />

2. The <strong>Sidewinder</strong> <strong>G2</strong> notifies the appropriate user.<br />

At system startup, the <strong>Sidewinder</strong> <strong>G2</strong> reads the auditbotd configuration<br />

file to determine which user should be notified if an alarm is triggered.<br />

By default, the system automatically sends an e-mail message to root<br />

(although you can also configure it to send e-mail to other users, or to<br />

notify an administrator <strong>of</strong> the alarm).<br />

If you connect a modem to the <strong>Sidewinder</strong> <strong>G2</strong>, and your administrators<br />

use pagers, you can also configure the system to automatically send a<br />

numeric message to a specified user’s pager when an alarm is triggered.<br />

Alarm Events and Responses 17-13

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!