Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

swatch log monitor in linux

Posted on 2010-11-14
9
Medium Priority
?
1,048 Views
Last Modified: 2013-11-29
Dear Experts:

Iam having rhel5.5 installed snort , now wants to setup swatch-3.2.3 hence downloaded and installed by the following:
perl Makefile.PL
make
make test
make install
---------------------------------------
everything went well also iam able to start swatch service like the following:
/usr/bin/swatch start

*** swatch version 3.2.3 (pid:22710) started at Sun Nov 14 18:49:19 IST 2010

----------------

but the problem is cursor is not getting released after executing the below command
 /usr/bin/swatch start

should execute the ctrl c to release the cursor by doing this swatch stops.

the program does not stop /usr/bin/swatch stop instead it starts. please help me how make this service start or stop successfully.

Thanks in advance.












0
Comment
Question by:D_wathi
  • 5
  • 4
9 Comments
 
LVL 81

Expert Comment

by:arnold
ID: 34131106
use & to send it to the background
/usr/sbin/swatch start & 


You should add this entry to /etc/rc.local and have  this start when the system boots.
0
 

Author Comment

by:D_wathi
ID: 34133985
Thanks for the reply, sir i did a mistake i,e after installing the source like make install  executed the make realclean then thought of installing the swatch rpm hence did make clean nothing happened removed source directory of swatch swatch-3.2.3,  even after removing also swatch source directory service is still running then decided again did untar of source, something has gone wrong
even after killing the swatch service if execute the /usr/bin/swatch stop with the stop command still the swatch service starts.
Sir, can you please guide me how to completely uninstall the swatch so that i will install freshly.
0
 
LVL 81

Expert Comment

by:arnold
ID: 34136749
When you reinstall, you will overwrite the installed items.
you could try: make uninstall
0
Transaction-level recovery for Oracle database

Veeam Explore for Oracle delivers low RTOs and RPOs with agentless transaction log backup and transaction-level recovery of Oracle databases. You can restore the database to a precise point in time, even to a specific transaction.

 

Author Comment

by:D_wathi
ID: 34136863
Sir, thanks for the reply ,  i tried but uninstall is not happening
cd /opt/snort/swatch-3.2.3
[root@authserver swatch-3.2.3]# make uninstall
make: *** No rule to make target `uninstall'.  Stop.
[root@authserver swatch-3.2.3]# make clean
make: *** No rule to make target `clean'.  Stop.

Please help how to completely uninstall or remove the swatch
0
 
LVL 81

Expert Comment

by:arnold
ID: 34137163
You have to look at the make install rule and then go manually and remove each entry.

Another option is
make DEST=/var/tmp install

This will create the same file in /var/tmp i.e. ls /var/tmp will have the structure of the items, you would then go though those as a reference to those unfer /usr.

Since you are planing on installing swatch anyway.  It might be starting following a rule you added.
is you look at ps -ef | grep swatch what is reflected as the PPID (parent process ID)?  Find the parent process and see why it is starting swatch.
0
 

Author Comment

by:D_wathi
ID: 34137523
Sir, thanks for the reply, i tried to kill all the swatch process and then removed the source dir of swatch-3.2.3 and the did untar the souce file while became swatch-3.2.3 after this did the following:
cd swatch-3.2.3
perl Makefile.PL
Checking if your kit is complete...
Looks good
Writing Makefile for swatch
[root@authserver swatch-3.2.3]# make
cp lib/Swatch/Threshold.pm blib/lib/Swatch/Threshold.pm
cp lib/Swatch/Throttle.pm blib/lib/Swatch/Throttle.pm
cp lib/Swatch/Actions.pm blib/lib/Swatch/Actions.pm
AutoSplitting blib/lib/Swatch/Actions.pm (blib/lib/auto/Swatch/Actions)
cp swatch blib/script/swatch
/usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/swatch
Manifying blib/man1/swatch.1
Manifying blib/man3/Swatch::Threshold.3pm
Manifying blib/man3/Swatch::Throttle.3pm
Manifying blib/man3/Swatch::Actions.3pm
[root@authserver swatch-3.2.3]# make test
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/01cpan_modules....ok
All tests successful.
Files=1, Tests=1,  0 wallclock secs ( 0.08 cusr +  0.00 csys =  0.08 CPU)
[root@authserver swatch-3.2.3]# make install
Appending installation info to /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/perllocal.pod
[root@authserver swatch-3.2.3]# make realclean
rm -f \
          blib/script/swatch
rm -f \
          *.a core \
          core.[0-9] blib/arch/auto/swatch/extralibs.all \
          core.[0-9][0-9] swatch.bso \
          pm_to_blib.ts core.[0-9][0-9][0-9][0-9] \
          swatch.x  \
          perl tmon.out \
          *.o pm_to_blib \
          blib/arch/auto/swatch/extralibs.ld blibdirs.ts \
          core.[0-9][0-9][0-9][0-9][0-9] *perl.core \
          core.*perl.*.? Makefile.aperl \
          perl swatch.def \
          core.[0-9][0-9][0-9] mon.out \
          libswatch.def perlmain.c \
          perl.exe so_locations \
          swatch.exp
rm -rf \
          blib
mv Makefile Makefile.old > /dev/null 2>&1
rm -f \
          Makefile.old Makefile
rm -rf \
          swatch-3.2.3

----------------------------------------------------
Sir my doubt is after executing the command
# make install  what is the use of  executing make realclean
please suggest is it required to execute make realclean, thanks in advance.


0
 
LVL 81

Expert Comment

by:arnold
ID: 34137878
realclean removes all that you've done returning the source directory to what it was.  usually one runs realclean,distclean before starting to compile to make sure that the source does not contain unexpected compiled object that inadvertently were included in the source.
The realclean removes everything except the compiled program but it can not be reinstalled.
Perhaps this is being done so you have the compiled item as a reference, do not see the point.

make DESTDIR=location install will get the item installed in the same way it would
location\usr\bin...
In case you want to build a distributable package.  such that you can then use the package manager to remove the application as well as to maintain a list of what applications you have installed.

0
 

Author Comment

by:D_wathi
ID: 34142576
Thank you very very much,   as i have executed the "real clean" after the "make install" as you say it removes everthing expept the compiled program by any chance does "real clean" uninstall or removes the installed application. please let me know should i again execute the make install.
Thanks in advance.
0
 
LVL 81

Accepted Solution

by:
arnold earned 2000 total points
ID: 34145693
No, real clean only deals with objects/files within the source directory.
At times, some source distribution include the option to uninstall which is effectively the reverse of the install. I.e. it has a list of the files and their location which it then uses to remove. These option are often only included where there are very few files that get installed. one or two  commands, and one or two manual pages.

You could after running the make DESTDIR=/tmp/swatch install
cd /tmp/swatch
find . > /tmp/swatch_file_list
cat /tmp/swatch_file_list |sed -e 's/^\.//' | while read a; do
rm "$a"
done

This will remove  all the files that were installed. when you ran make install.

The other option if you only installed one thing is to use the find /usr -mtime -0 to find any file that was created within the last 24 hours.
But be very careful with this method if there are other people who can install on the system or just use that to generate a list of possible files.
Also note that if this application stores configuration files (/etc/) or startup script /etc/init.d the above find will not see/detect them.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is about my experience upgrading my consulting machine to Windows 10 Version 1709 (The Fall 2017 Creator Update)
Securing your business data in current era should be your biggest priority. Numerous people are unaware of the fact that insiders commit more than 60 percent of security breaches. You need to figure out the underlying cause and invoke your potential…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question