.N ITA Agent Status #Policy Name .L 2 #Policy structure .D Checks the status of all Agents registered to the Manager by raising a global flag that Agents will respond to, if alive. Also detects Agents that can't be updated as well as Agent restarts. #Policy Description .V 1019770268 #Policy revision number .Z 2468 #Policy ID .Z 2468 #Policy ID .R 1. Start Timer on Mgr's Agent #Rule Definition ..D Starts a timer on the Manager's Agent whenever the policy is modified, applied to a domain, or when the Agent service is restarted. #Rule Description ..Z 2452 #Rule ID ..K #Rule And Select logic ..V 0 #Rule Value ..S #Select Clause(s) ...S Auto Start #Status ....T *Intruder Alert agent*starting* #Regular text ....T *Policy "ITA Agent Status* activated* #Regular text ....T *Policy "ITA Agent Status* modified* #Regular text ....C 0 #Case sensitivity ....Z 2449 #ID of the clause ..S #Select Clause(s) ...S Name of Mgr's Agent #Status ....T *agent zeus* #Regular text ....C 0 #Case sensitivity ....Z 2450 #ID of the clause ..A #Action Clause(s) ...I Timer #Set timer ....S 300 d #Goes off time ....I 7200 #Timer Intervals ....Z 2451 #ID of the clause .R 2. Raise Flag on Mgr's Agent #Rule Definition ..D Raises a global flag on the Manager's Agent for 0 seconds after the timer on the Manager's Agent expires. #Rule Description ..Z 2455 #Rule ID ..K #Rule And Select logic ..V 0 #Rule Value ..S #Select Clause(s) ...I Timer #Timer ....I 2451 #ID list ....Z 2453 #ID of the clause ..A #Action Clause(s) ...B Roll Call Flag #Raise Flag ....G #Global context ....Z 2454 #ID of the clause .R Agent OK #Rule Definition ..D Detects Agents that can successfully raise a global flag, signifying that they are running OK. #Rule Description ..Z 2464 #Rule ID ..V 20 #Rule Value ..S #Select Clause(s) ...B Roll Call Flag #Flag(S) ....I 2454 #ID list ....F 2454 #Flag list ....Z 2462 #ID of the clause ..A #Action Clause(s) ...E Record to Event Viewer #Record Event ....Z 2463 #ID of the clause .R Agent Could Be Down #Rule Definition ..D Detects an Agent that cannot raise a global flag. The Agent might not be running because either the entire system is down, or the daemon/service is not running. #Rule Description ..Z 2458 #Rule ID ..V 90 #Rule Value ..S #Select Clause(s) ...R ITA Error #Error ....T *ITA*Unable to raise a global flag*on* #Regular text ....C 0 #Case sensitivity ....Z 2456 #ID of the clause ..A #Action Clause(s) ...E Record to Event Viewer #Record Event ....Z 2457 #ID of the clause .R Agent Not Updated #Rule Definition ..D Detects an Agent that cannot be updated by the ITA Manager. The Agent might not be running because either the entire system is down, or the daemon/service is not running. #Rule Description ..Z 2461 #Rule ID ..V 90 #Rule Value ..S #Select Clause(s) ...R ITA Error #Error ....T *Error updating the configuration for the ITA agent on* #Regular text ....C 0 #Case sensitivity ....Z 2459 #ID of the clause ..A #Action Clause(s) ...E Record to Event Viewer #Record Event ....Z 2460 #ID of the clause .R Agent Restarted #Rule Definition ..D Detects an Agent's service/daemon restarting. This can be caused by either a system reboot or a service/daemon restart. #Rule Description ..Z 2467 #Rule ID ..V 50 #Rule Value ..S #Select Clause(s) ...S ITA Status Message #Status ....T *Intruder Alert agent*starting* #Regular text ....C 0 #Case sensitivity ....Z 2465 #ID of the clause ..A #Action Clause(s) ...E Record to Event Viewer #Record Event ....Z 2466 #ID of the clause