Troubleshooting The Solaris Client - McAfee HISCDE-AB-IA - Host Intrusion Prevention Product Manual

Working with Host Intrusion Prevention Clients
Overview of the Solaris client
Policy
Trusted Applications
Host Intrusion Prevention 8.0 Firewall

Troubleshooting the Solaris client

If a problem was caused while installing or uninstalling the client, there are several things to
investigate. These can include ensuring that all required files were installed in the correct
directory, uninstalling and then reinstalling the client, and checking process logs. In addition,
you might encounter problems with the operation of the client. You can check whether the
client is running, and stop and restart the client.
The Solaris client has no user interface to troubleshoot operation issues. It does offer a
command-line troubleshooting tool, hipts, located in the /
tool, you must provide a Host Intrusion Prevention client password. Use the default password
that ships with the client (abcde12345), or send a Client UI policy to the client with either an
administrator's password or a time-based password set with the policy, and use this password.
Use the troubleshooting tool to:
• Indicate the logging settings and engine status for the client.
• Turn message logging on and off.
• Turn engines on and off.
Log on as root and run the following commands to aid in troubleshooting:
To...
Obtain the current status of the client indicating which
type of logging is enabled, and which engines are running.
Turn on logging of specific messages types.
Turn off logging of all message types. Logging is off by
default.
Display the message type indicated when logging is set to
"on." Messages include:
• error
• warning
• debug
• info
• violations
Hide the message type indicated when logging is set to
"on." Message error is off by default.
Display all message types when logging is set to "on."
Hide all message types when logging is set to "on."
Turn on the engine indicated. Engine is on by default.
Engines include:
• MISC
• FILES
• GUID
• MMAP
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
Available options
Only Mark as trusted for IPS and New Process Name to
add trusted applications.
None
directory. To use this
opt/McAfee/hip
Run...
hipts status
hipts logging on
hipts logging off
hipts message <message name>:on
hipts message <message name>:off
hipts message all:on
hipts message all:off
hipts engines <engine name>:on
95