swatch log monitor in linux

use & to send it to the background
/usr/sbin/swatch start & 


You should add this entry to /etc/rc.local and have  this start when the system boots.

Thanks for the reply, sir i did a mistake i,e after installing the source like make install  executed the make realclean then thought of installing the swatch rpm hence did make clean nothing happened removed source directory of swatch swatch-3.2.3,  even after removing also swatch source directory service is still running then decided again did untar of source, something has gone wrong
even after killing the swatch service if execute the /usr/bin/swatch stop with the stop command still the swatch service starts.
Sir, can you please guide me how to completely uninstall the swatch so that i will install freshly.

When you reinstall, you will overwrite the installed items.
you could try: make uninstall

Sir, thanks for the reply ,  i tried but uninstall is not happening
cd /opt/snort/swatch-3.2.3
[root@authserver swatch-3.2.3]# make uninstall
make: *** No rule to make target `uninstall'.  Stop.
[root@authserver swatch-3.2.3]# make clean
make: *** No rule to make target `clean'.  Stop.

Please help how to completely uninstall or remove the swatch

You have to look at the make install rule and then go manually and remove each entry.

Another option is
make DEST=/var/tmp install

This will create the same file in /var/tmp i.e. ls /var/tmp will have the structure of the items, you would then go though those as a reference to those unfer /usr.

Since you are planing on installing swatch anyway.  It might be starting following a rule you added.
is you look at ps -ef | grep swatch what is reflected as the PPID (parent process ID)?  Find the parent process and see why it is starting swatch.

Sir, thanks for the reply, i tried to kill all the swatch process and then removed the source dir of swatch-3.2.3 and the did untar the souce file while became swatch-3.2.3 after this did the following:
cd swatch-3.2.3
perl Makefile.PL
Checking if your kit is complete...
Looks good
Writing Makefile for swatch
[root@authserver swatch-3.2.3]# make
cp lib/Swatch/Threshold.pm blib/lib/Swatch/Threshold.pm
cp lib/Swatch/Throttle.pm blib/lib/Swatch/Throttle.pm
cp lib/Swatch/Actions.pm blib/lib/Swatch/Actions.pm
AutoSplitting blib/lib/Swatch/Actions.pm (blib/lib/auto/Swatch/Actions)
cp swatch blib/script/swatch
/usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/swatch
Manifying blib/man1/swatch.1
Manifying blib/man3/Swatch::Threshold.3pm
Manifying blib/man3/Swatch::Throttle.3pm
Manifying blib/man3/Swatch::Actions.3pm
[root@authserver swatch-3.2.3]# make test
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/01cpan_modules....ok
All tests successful.
Files=1, Tests=1,  0 wallclock secs ( 0.08 cusr +  0.00 csys =  0.08 CPU)
[root@authserver swatch-3.2.3]# make install
Appending installation info to /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/perllocal.pod
[root@authserver swatch-3.2.3]# make realclean
rm -f \
          blib/script/swatch
rm -f \
          *.a core \
          core.[0-9] blib/arch/auto/swatch/extralibs.all \
          core.[0-9][0-9] swatch.bso \
          pm_to_blib.ts core.[0-9][0-9][0-9][0-9] \
          swatch.x  \
          perl tmon.out \
          *.o pm_to_blib \
          blib/arch/auto/swatch/extralibs.ld blibdirs.ts \
          core.[0-9][0-9][0-9][0-9][0-9] *perl.core \
          core.*perl.*.? Makefile.aperl \
          perl swatch.def \
          core.[0-9][0-9][0-9] mon.out \
          libswatch.def perlmain.c \
          perl.exe so_locations \
          swatch.exp
rm -rf \
          blib
mv Makefile Makefile.old > /dev/null 2>&1
rm -f \
          Makefile.old Makefile
rm -rf \
          swatch-3.2.3

----------------------------------------------------
Sir my doubt is after executing the command
# make install  what is the use of  executing make realclean
please suggest is it required to execute make realclean, thanks in advance.

realclean removes all that you've done returning the source directory to what it was.  usually one runs realclean,distclean before starting to compile to make sure that the source does not contain unexpected compiled object that inadvertently were included in the source.
The realclean removes everything except the compiled program but it can not be reinstalled.
Perhaps this is being done so you have the compiled item as a reference, do not see the point.

make DESTDIR=location install will get the item installed in the same way it would
location\usr\bin...
In case you want to build a distributable package.  such that you can then use the package manager to remove the application as well as to maintain a list of what applications you have installed.

Thank you very very much,   as i have executed the "real clean" after the "make install" as you say it removes everthing expept the compiled program by any chance does "real clean" uninstall or removes the installed application. please let me know should i again execute the make install.
Thanks in advance.