4.19. How do I check if LIDS is enabled/disabled??

If you have compiled the lidsadm with 'make VIEW=1' then you can use 'lidsadm -V' to see if LIDS is enabled. If it says 'LIDS_GLOBAL 0' then LIDS is disabled. If it says 'LIDS 0' then someone is in a Lids Free Session. If you haven't compiled lidsadm with the VIEW option there are several ways to determine if LIDS is running.

  1. You can check for the line 'Linux Intrusion Detection System <lids-version> for <kernel-version> doesn't start' is in your dmesg. If it says 'Linux Intrusion Detection System <lids-version> for <kernel-version> starts' then LIDS is started of course.

  2. You can try to do something that you are sure of you can't do to see if LIDS takes action. If there's no action the LIDS is not active.