Arpwatch pkg not starting….
-
Just upgraded to 2.1. Installed arpwatch, but it won't start? Goto to Status->Services, I see a big red X. I hit the start, it says started, still see big RED X. Via cmdline:
[2.1-RELEASE][root@pfsense]/var/log(145): ps -aux | egrep arpwatch
root 67578 0.0 0.5 3468 1196 0 R+ 2:28PM 0:00.01 egrep arpwatch[2.1-RELEASE][root@pfsense]/var/log(146): /usr/local/etc/rc.d/arpwatch start
meuh
prcmd
Starting arpwatch.[2.1-RELEASE][root@pfsense]/var/log(147): ps -aux | egrep arpwatch
root 69328 1.0 1.3 4472 3084 0 S 2:29PM 0:00.21 /usr/pbi/arpwatch-i386/sbin/arpwatch
root 69923 0.0 1.0 4696 2440 0 RV 2:29PM 0:00.00 egrep arpwatch (tcsh)I see it in the Status->Services window & it;s nice & green now. Also, Services->arpwatch->Reports shows nothing???
[2.1-RELEASE][root@pfsense]/var/log(148): clog arpwatch.reports
Version 2.1a15
usage: arpwatch [-dN] [-f datafile] [-i interface] [-m email] [-n net[/width]] [-r file]
clog: ERROR: could not write output (Bad address)Has this ever worked?
-
This is because the latest commit to fix a email format introduced a bug. The fix is in my open merge request which also adds support for multiple interfaces.
Revert the following change in arpwatch.xml: https://github.com/pfsense/pfsense-packages/pull/608/files
$start .= "/usr/local/sbin/arpwatch {$debug} -f {$log_file} \"{$mail}\" -i {$int} > /var/log/arpwatch.reports 2>&1 &";Change back to the below code
$start .= "/usr/local/sbin/arpwatch {$debug} -f {$log_file} {$mail} -i {$int} > /var/log/arpwatch.reports 2>&1 &"; -
Hi!
Why would arpwatch add /usr/sbin/sendmail (link to /usr/sbin/sm.php)? This causes ALL cron jobs to send email to configured email address and there might be many jobs configured.
How this can be fixed?
-
Hi!
Why would arpwatch add /usr/sbin/sendmail (link to /usr/sbin/sm.php)? This causes ALL cron jobs to send email to configured email address and there might be many jobs configured.
How this can be fixed?
Can you give more information and example email or what not?
-
Hi!
You can see plenty of email samples in this thread.
As for more info - sure. If you read crontab(5) and other cron docs carefully, you will see, that cron will collect an output from all jobs (if any) and will email them - if it finds /usr/lib/sendmail.
By default, there is no /usr/lib/sendmail in pfSense 2.1 install. When package arpwatch is installed, it will create one (by linking it to /usr/sbin/sm.php) - see here.
Once arpwatch is installed, cron is able to find sendmail and send reports.There are several bad things with this:
-
This is configured during package install, but is NOT removed on uninstall
-
Change is done to the product (sendmail) which does not belong to arpwatch package
I would consider arpwatch package broken right now (and it is, indeed - service will not start because of another bug).
It is really sad, that packages, published for pfSense are not properly tested.If sendmail is needed for arpwatch, it has to be at least configurable.
To fix - I am going to try and add empty MAILTO to crontab and see if mails stop.
Thanks!
-
-
Just a quick update. Adding
MAILTO=""to /etc/crontab resolved the issue.
-
You may want to address this in that thread you referenced instead of here in this silo that has something to do with arpwatch not starting.
-
You are most probably right. I commented here because this is also related to recent changes to the package.
I will post to that other thread with the reference to my post here. -
You are most probably right. I commented here because this is also related to recent changes to the package.
I will post to that other thread with the reference to my post here.That would be great. I would say the recent changes are about 6 months old. Though the bugfix I posted above is a lot more recent.
https://github.com/pfsense/pfsense-packages/commits/master/config/arpwatch.xml
-
OK. Made this change, but it;s not starting via GUI. It does start however via cmdline:
[2.1-RELEASE][root@pfsense]/(15): /usr/local/etc/rc.d/arpwatch start
meuh
prcmd
Starting arpwatch.
[2.1-RELEASE][root@pfsense]/(16): ps -aux | egrep arpwatch
root 62626 1.0 1.2 4472 2980 0 S 3:16PM 0:00.20 /usr/pbi/arpwatch-i386/sbin/arpwatchThis is because the latest commit to fix a email format introduced a bug. The fix is in my open merge request which also adds support for multiple interfaces.
Revert the following change in arpwatch.xml: https://github.com/pfsense/pfsense-packages/pull/608/files
$start .= "/usr/local/sbin/arpwatch {$debug} -f {$log_file} \"{$mail}\" -i {$int} > /var/log/arpwatch.reports 2>&1 &";Change back to the below code
$start .= "/usr/local/sbin/arpwatch {$debug} -f {$log_file} {$mail} -i {$int} > /var/log/arpwatch.reports 2>&1 &"; -
OK. Made this change, but it;s not starting via GUI. It does start however via cmdline:
[2.1-RELEASE][root@pfsense]/(15): /usr/local/etc/rc.d/arpwatch start
meuh
prcmd
Starting arpwatch.
[2.1-RELEASE][root@pfsense]/(16): ps -aux | egrep arpwatch
root 62626 1.0 1.2 4472 2980 0 S 3:16PM 0:00.20 /usr/pbi/arpwatch-i386/sbin/arpwatchThis is because the latest commit to fix a email format introduced a bug. The fix is in my open merge request which also adds support for multiple interfaces.
Revert the following change in arpwatch.xml: https://github.com/pfsense/pfsense-packages/pull/608/files
$start .= "/usr/local/sbin/arpwatch {$debug} -f {$log_file} \"{$mail}\" -i {$int} > /var/log/arpwatch.reports 2>&1 &";Change back to the below code
$start .= "/usr/local/sbin/arpwatch {$debug} -f {$log_file} {$mail} -i {$int} > /var/log/arpwatch.reports 2>&1 &";what does the arpwatch.sh have in it?
-
Same problem here, arpwatch service won't start.
If I look inside <tt>/usr/local/etc/rc.d/arpwatch.sh</tt> I find
/usr/local/sbin/arpwatch -d -f /var/log/arp.dat -i bce2 > /var/log/arpwatch.reports 2>&1 &But executing this on the command line only gives "<tt>Ambiguous output redirect.</tt>" (although this may just be a shell problem).
Anyway, arpwatch (2.1.a15_8 pkg v1.1.2) not working on pfSense 2.2-RELEASE (amd64) :(