Avatar of D_wathi
D_wathiFlag for India asked on

swatch log monitor in linux

Dear Experts:

Iam having rhel5.5 installed snort , now wants to setup swatch-3.2.3 hence downloaded and installed by the following:
perl Makefile.PL
make
make test
make install
---------------------------------------
everything went well also iam able to start swatch service like the following:
/usr/bin/swatch start

*** swatch version 3.2.3 (pid:22710) started at Sun Nov 14 18:49:19 IST 2010

----------------

but the problem is cursor is not getting released after executing the below command
 /usr/bin/swatch start

should execute the ctrl c to release the cursor by doing this swatch stops.

the program does not stop /usr/bin/swatch stop instead it starts. please help me how make this service start or stop successfully.

Thanks in advance.












SecurityLinux SecurityLinux Networking

Avatar of undefined
Last Comment
arnold

8/22/2022 - Mon
arnold

use & to send it to the background
/usr/sbin/swatch start & 


You should add this entry to /etc/rc.local and have  this start when the system boots.
ASKER
D_wathi

Thanks for the reply, sir i did a mistake i,e after installing the source like make install  executed the make realclean then thought of installing the swatch rpm hence did make clean nothing happened removed source directory of swatch swatch-3.2.3,  even after removing also swatch source directory service is still running then decided again did untar of source, something has gone wrong
even after killing the swatch service if execute the /usr/bin/swatch stop with the stop command still the swatch service starts.
Sir, can you please guide me how to completely uninstall the swatch so that i will install freshly.
arnold

When you reinstall, you will overwrite the installed items.
you could try: make uninstall
Your help has saved me hundreds of hours of internet surfing.
fblack61
ASKER
D_wathi

Sir, thanks for the reply ,  i tried but uninstall is not happening
cd /opt/snort/swatch-3.2.3
[root@authserver swatch-3.2.3]# make uninstall
make: *** No rule to make target `uninstall'.  Stop.
[root@authserver swatch-3.2.3]# make clean
make: *** No rule to make target `clean'.  Stop.

Please help how to completely uninstall or remove the swatch
arnold

You have to look at the make install rule and then go manually and remove each entry.

Another option is
make DEST=/var/tmp install

This will create the same file in /var/tmp i.e. ls /var/tmp will have the structure of the items, you would then go though those as a reference to those unfer /usr.

Since you are planing on installing swatch anyway.  It might be starting following a rule you added.
is you look at ps -ef | grep swatch what is reflected as the PPID (parent process ID)?  Find the parent process and see why it is starting swatch.
ASKER
D_wathi

Sir, thanks for the reply, i tried to kill all the swatch process and then removed the source dir of swatch-3.2.3 and the did untar the souce file while became swatch-3.2.3 after this did the following:
cd swatch-3.2.3
perl Makefile.PL
Checking if your kit is complete...
Looks good
Writing Makefile for swatch
[root@authserver swatch-3.2.3]# make
cp lib/Swatch/Threshold.pm blib/lib/Swatch/Threshold.pm
cp lib/Swatch/Throttle.pm blib/lib/Swatch/Throttle.pm
cp lib/Swatch/Actions.pm blib/lib/Swatch/Actions.pm
AutoSplitting blib/lib/Swatch/Actions.pm (blib/lib/auto/Swatch/Actions)
cp swatch blib/script/swatch
/usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/swatch
Manifying blib/man1/swatch.1
Manifying blib/man3/Swatch::Threshold.3pm
Manifying blib/man3/Swatch::Throttle.3pm
Manifying blib/man3/Swatch::Actions.3pm
[root@authserver swatch-3.2.3]# make test
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/01cpan_modules....ok
All tests successful.
Files=1, Tests=1,  0 wallclock secs ( 0.08 cusr +  0.00 csys =  0.08 CPU)
[root@authserver swatch-3.2.3]# make install
Appending installation info to /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/perllocal.pod
[root@authserver swatch-3.2.3]# make realclean
rm -f \
          blib/script/swatch
rm -f \
          *.a core \
          core.[0-9] blib/arch/auto/swatch/extralibs.all \
          core.[0-9][0-9] swatch.bso \
          pm_to_blib.ts core.[0-9][0-9][0-9][0-9] \
          swatch.x  \
          perl tmon.out \
          *.o pm_to_blib \
          blib/arch/auto/swatch/extralibs.ld blibdirs.ts \
          core.[0-9][0-9][0-9][0-9][0-9] *perl.core \
          core.*perl.*.? Makefile.aperl \
          perl swatch.def \
          core.[0-9][0-9][0-9] mon.out \
          libswatch.def perlmain.c \
          perl.exe so_locations \
          swatch.exp
rm -rf \
          blib
mv Makefile Makefile.old > /dev/null 2>&1
rm -f \
          Makefile.old Makefile
rm -rf \
          swatch-3.2.3

----------------------------------------------------
Sir my doubt is after executing the command
# make install  what is the use of  executing make realclean
please suggest is it required to execute make realclean, thanks in advance.


Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
arnold

realclean removes all that you've done returning the source directory to what it was.  usually one runs realclean,distclean before starting to compile to make sure that the source does not contain unexpected compiled object that inadvertently were included in the source.
The realclean removes everything except the compiled program but it can not be reinstalled.
Perhaps this is being done so you have the compiled item as a reference, do not see the point.

make DESTDIR=location install will get the item installed in the same way it would
location\usr\bin...
In case you want to build a distributable package.  such that you can then use the package manager to remove the application as well as to maintain a list of what applications you have installed.

ASKER
D_wathi

Thank you very very much,   as i have executed the "real clean" after the "make install" as you say it removes everthing expept the compiled program by any chance does "real clean" uninstall or removes the installed application. please let me know should i again execute the make install.
Thanks in advance.
ASKER CERTIFIED SOLUTION
arnold

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question