swatch log monitor in linux

Dear Experts:

Iam having rhel5.5 installed snort , now wants to setup swatch-3.2.3 hence downloaded and installed by the following:
perl Makefile.PL
make
make test
make install
---------------------------------------
everything went well also iam able to start swatch service like the following:
/usr/bin/swatch start

*** swatch version 3.2.3 (pid:22710) started at Sun Nov 14 18:49:19 IST 2010

----------------

but the problem is cursor is not getting released after executing the below command
 /usr/bin/swatch start

should execute the ctrl c to release the cursor by doing this swatch stops.

the program does not stop /usr/bin/swatch stop instead it starts. please help me how make this service start or stop successfully.

Thanks in advance.












D_wathiAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

arnoldCommented:
use & to send it to the background
/usr/sbin/swatch start & 


You should add this entry to /etc/rc.local and have  this start when the system boots.
0
D_wathiAuthor Commented:
Thanks for the reply, sir i did a mistake i,e after installing the source like make install  executed the make realclean then thought of installing the swatch rpm hence did make clean nothing happened removed source directory of swatch swatch-3.2.3,  even after removing also swatch source directory service is still running then decided again did untar of source, something has gone wrong
even after killing the swatch service if execute the /usr/bin/swatch stop with the stop command still the swatch service starts.
Sir, can you please guide me how to completely uninstall the swatch so that i will install freshly.
0
arnoldCommented:
When you reinstall, you will overwrite the installed items.
you could try: make uninstall
0
What were the top attacks of Q1 2018?

The Threat Lab team analyzes data from WatchGuard’s Firebox Feed, internal and partner threat intelligence, and a research honeynet, to provide insightful analysis about the top threats on the Internet. Check out our Q1 2018 report for smart, practical security advice today!

D_wathiAuthor Commented:
Sir, thanks for the reply ,  i tried but uninstall is not happening
cd /opt/snort/swatch-3.2.3
[root@authserver swatch-3.2.3]# make uninstall
make: *** No rule to make target `uninstall'.  Stop.
[root@authserver swatch-3.2.3]# make clean
make: *** No rule to make target `clean'.  Stop.

Please help how to completely uninstall or remove the swatch
0
arnoldCommented:
You have to look at the make install rule and then go manually and remove each entry.

Another option is
make DEST=/var/tmp install

This will create the same file in /var/tmp i.e. ls /var/tmp will have the structure of the items, you would then go though those as a reference to those unfer /usr.

Since you are planing on installing swatch anyway.  It might be starting following a rule you added.
is you look at ps -ef | grep swatch what is reflected as the PPID (parent process ID)?  Find the parent process and see why it is starting swatch.
0
D_wathiAuthor Commented:
Sir, thanks for the reply, i tried to kill all the swatch process and then removed the source dir of swatch-3.2.3 and the did untar the souce file while became swatch-3.2.3 after this did the following:
cd swatch-3.2.3
perl Makefile.PL
Checking if your kit is complete...
Looks good
Writing Makefile for swatch
[root@authserver swatch-3.2.3]# make
cp lib/Swatch/Threshold.pm blib/lib/Swatch/Threshold.pm
cp lib/Swatch/Throttle.pm blib/lib/Swatch/Throttle.pm
cp lib/Swatch/Actions.pm blib/lib/Swatch/Actions.pm
AutoSplitting blib/lib/Swatch/Actions.pm (blib/lib/auto/Swatch/Actions)
cp swatch blib/script/swatch
/usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/swatch
Manifying blib/man1/swatch.1
Manifying blib/man3/Swatch::Threshold.3pm
Manifying blib/man3/Swatch::Throttle.3pm
Manifying blib/man3/Swatch::Actions.3pm
[root@authserver swatch-3.2.3]# make test
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/01cpan_modules....ok
All tests successful.
Files=1, Tests=1,  0 wallclock secs ( 0.08 cusr +  0.00 csys =  0.08 CPU)
[root@authserver swatch-3.2.3]# make install
Appending installation info to /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/perllocal.pod
[root@authserver swatch-3.2.3]# make realclean
rm -f \
          blib/script/swatch
rm -f \
          *.a core \
          core.[0-9] blib/arch/auto/swatch/extralibs.all \
          core.[0-9][0-9] swatch.bso \
          pm_to_blib.ts core.[0-9][0-9][0-9][0-9] \
          swatch.x  \
          perl tmon.out \
          *.o pm_to_blib \
          blib/arch/auto/swatch/extralibs.ld blibdirs.ts \
          core.[0-9][0-9][0-9][0-9][0-9] *perl.core \
          core.*perl.*.? Makefile.aperl \
          perl swatch.def \
          core.[0-9][0-9][0-9] mon.out \
          libswatch.def perlmain.c \
          perl.exe so_locations \
          swatch.exp
rm -rf \
          blib
mv Makefile Makefile.old > /dev/null 2>&1
rm -f \
          Makefile.old Makefile
rm -rf \
          swatch-3.2.3

----------------------------------------------------
Sir my doubt is after executing the command
# make install  what is the use of  executing make realclean
please suggest is it required to execute make realclean, thanks in advance.


0
arnoldCommented:
realclean removes all that you've done returning the source directory to what it was.  usually one runs realclean,distclean before starting to compile to make sure that the source does not contain unexpected compiled object that inadvertently were included in the source.
The realclean removes everything except the compiled program but it can not be reinstalled.
Perhaps this is being done so you have the compiled item as a reference, do not see the point.

make DESTDIR=location install will get the item installed in the same way it would
location\usr\bin...
In case you want to build a distributable package.  such that you can then use the package manager to remove the application as well as to maintain a list of what applications you have installed.

0
D_wathiAuthor Commented:
Thank you very very much,   as i have executed the "real clean" after the "make install" as you say it removes everthing expept the compiled program by any chance does "real clean" uninstall or removes the installed application. please let me know should i again execute the make install.
Thanks in advance.
0
arnoldCommented:
No, real clean only deals with objects/files within the source directory.
At times, some source distribution include the option to uninstall which is effectively the reverse of the install. I.e. it has a list of the files and their location which it then uses to remove. These option are often only included where there are very few files that get installed. one or two  commands, and one or two manual pages.

You could after running the make DESTDIR=/tmp/swatch install
cd /tmp/swatch
find . > /tmp/swatch_file_list
cat /tmp/swatch_file_list |sed -e 's/^\.//' | while read a; do
rm "$a"
done

This will remove  all the files that were installed. when you ran make install.

The other option if you only installed one thing is to use the find /usr -mtime -0 to find any file that was created within the last 24 hours.
But be very careful with this method if there are other people who can install on the system or just use that to generate a list of possible files.
Also note that if this application stores configuration files (/etc/) or startup script /etc/init.d the above find will not see/detect them.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Security

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.