Solved

swatch log monitor in linux

Posted on 2010-11-14
9
1,001 Views
Last Modified: 2013-11-29
Dear Experts:

Iam having rhel5.5 installed snort , now wants to setup swatch-3.2.3 hence downloaded and installed by the following:
perl Makefile.PL
make
make test
make install
---------------------------------------
everything went well also iam able to start swatch service like the following:
/usr/bin/swatch start

*** swatch version 3.2.3 (pid:22710) started at Sun Nov 14 18:49:19 IST 2010

----------------

but the problem is cursor is not getting released after executing the below command
 /usr/bin/swatch start

should execute the ctrl c to release the cursor by doing this swatch stops.

the program does not stop /usr/bin/swatch stop instead it starts. please help me how make this service start or stop successfully.

Thanks in advance.












0
Comment
Question by:D_wathi
  • 5
  • 4
9 Comments
 
LVL 76

Expert Comment

by:arnold
ID: 34131106
use & to send it to the background
/usr/sbin/swatch start &


You should add this entry to /etc/rc.local and have  this start when the system boots.
0
 

Author Comment

by:D_wathi
ID: 34133985
Thanks for the reply, sir i did a mistake i,e after installing the source like make install  executed the make realclean then thought of installing the swatch rpm hence did make clean nothing happened removed source directory of swatch swatch-3.2.3,  even after removing also swatch source directory service is still running then decided again did untar of source, something has gone wrong
even after killing the swatch service if execute the /usr/bin/swatch stop with the stop command still the swatch service starts.
Sir, can you please guide me how to completely uninstall the swatch so that i will install freshly.
0
 
LVL 76

Expert Comment

by:arnold
ID: 34136749
When you reinstall, you will overwrite the installed items.
you could try: make uninstall
0
 

Author Comment

by:D_wathi
ID: 34136863
Sir, thanks for the reply ,  i tried but uninstall is not happening
cd /opt/snort/swatch-3.2.3
[root@authserver swatch-3.2.3]# make uninstall
make: *** No rule to make target `uninstall'.  Stop.
[root@authserver swatch-3.2.3]# make clean
make: *** No rule to make target `clean'.  Stop.

Please help how to completely uninstall or remove the swatch
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 76

Expert Comment

by:arnold
ID: 34137163
You have to look at the make install rule and then go manually and remove each entry.

Another option is
make DEST=/var/tmp install

This will create the same file in /var/tmp i.e. ls /var/tmp will have the structure of the items, you would then go though those as a reference to those unfer /usr.

Since you are planing on installing swatch anyway.  It might be starting following a rule you added.
is you look at ps -ef | grep swatch what is reflected as the PPID (parent process ID)?  Find the parent process and see why it is starting swatch.
0
 

Author Comment

by:D_wathi
ID: 34137523
Sir, thanks for the reply, i tried to kill all the swatch process and then removed the source dir of swatch-3.2.3 and the did untar the souce file while became swatch-3.2.3 after this did the following:
cd swatch-3.2.3
perl Makefile.PL
Checking if your kit is complete...
Looks good
Writing Makefile for swatch
[root@authserver swatch-3.2.3]# make
cp lib/Swatch/Threshold.pm blib/lib/Swatch/Threshold.pm
cp lib/Swatch/Throttle.pm blib/lib/Swatch/Throttle.pm
cp lib/Swatch/Actions.pm blib/lib/Swatch/Actions.pm
AutoSplitting blib/lib/Swatch/Actions.pm (blib/lib/auto/Swatch/Actions)
cp swatch blib/script/swatch
/usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/swatch
Manifying blib/man1/swatch.1
Manifying blib/man3/Swatch::Threshold.3pm
Manifying blib/man3/Swatch::Throttle.3pm
Manifying blib/man3/Swatch::Actions.3pm
[root@authserver swatch-3.2.3]# make test
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/01cpan_modules....ok
All tests successful.
Files=1, Tests=1,  0 wallclock secs ( 0.08 cusr +  0.00 csys =  0.08 CPU)
[root@authserver swatch-3.2.3]# make install
Appending installation info to /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/perllocal.pod
[root@authserver swatch-3.2.3]# make realclean
rm -f \
          blib/script/swatch
rm -f \
          *.a core \
          core.[0-9] blib/arch/auto/swatch/extralibs.all \
          core.[0-9][0-9] swatch.bso \
          pm_to_blib.ts core.[0-9][0-9][0-9][0-9] \
          swatch.x  \
          perl tmon.out \
          *.o pm_to_blib \
          blib/arch/auto/swatch/extralibs.ld blibdirs.ts \
          core.[0-9][0-9][0-9][0-9][0-9] *perl.core \
          core.*perl.*.? Makefile.aperl \
          perl swatch.def \
          core.[0-9][0-9][0-9] mon.out \
          libswatch.def perlmain.c \
          perl.exe so_locations \
          swatch.exp
rm -rf \
          blib
mv Makefile Makefile.old > /dev/null 2>&1
rm -f \
          Makefile.old Makefile
rm -rf \
          swatch-3.2.3

----------------------------------------------------
Sir my doubt is after executing the command
# make install  what is the use of  executing make realclean
please suggest is it required to execute make realclean, thanks in advance.


0
 
LVL 76

Expert Comment

by:arnold
ID: 34137878
realclean removes all that you've done returning the source directory to what it was.  usually one runs realclean,distclean before starting to compile to make sure that the source does not contain unexpected compiled object that inadvertently were included in the source.
The realclean removes everything except the compiled program but it can not be reinstalled.
Perhaps this is being done so you have the compiled item as a reference, do not see the point.

make DESTDIR=location install will get the item installed in the same way it would
location\usr\bin...
In case you want to build a distributable package.  such that you can then use the package manager to remove the application as well as to maintain a list of what applications you have installed.

0
 

Author Comment

by:D_wathi
ID: 34142576
Thank you very very much,   as i have executed the "real clean" after the "make install" as you say it removes everthing expept the compiled program by any chance does "real clean" uninstall or removes the installed application. please let me know should i again execute the make install.
Thanks in advance.
0
 
LVL 76

Accepted Solution

by:
arnold earned 500 total points
ID: 34145693
No, real clean only deals with objects/files within the source directory.
At times, some source distribution include the option to uninstall which is effectively the reverse of the install. I.e. it has a list of the files and their location which it then uses to remove. These option are often only included where there are very few files that get installed. one or two  commands, and one or two manual pages.

You could after running the make DESTDIR=/tmp/swatch install
cd /tmp/swatch
find . > /tmp/swatch_file_list
cat /tmp/swatch_file_list |sed -e 's/^\.//' | while read a; do
rm "$a"
done

This will remove  all the files that were installed. when you ran make install.

The other option if you only installed one thing is to use the find /usr -mtime -0 to find any file that was created within the last 24 hours.
But be very careful with this method if there are other people who can install on the system or just use that to generate a list of possible files.
Also note that if this application stores configuration files (/etc/) or startup script /etc/init.d the above find will not see/detect them.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

By this time the large percentage of day-to-day transactions have shifted to mobile banking; here are some overriding areas QAs must investigate while testing mobile banking apps.  
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now