Arpwatch Not Starting

Today I upgraded to CU197 and saw that arpwatch is included in this update. However, I cannot get it to run, either from CLI or starting it from the Status | Services menu in the GUI. I have the following error messages in, /var/log/messages:

Sep 19 11:35:24 buford arpwatch: chdir(/usr/arpwatch): No such file or directory
Sep 19 11:35:24 buford arpwatch: (using current working directory)
Sep 19 11:35:24 buford arpwatch: listening on green0
Sep 19 11:35:24 buford arpwatch: fopen(arp.dat): No such file or directory

Process used:

  • Updated to CU197, reboot
  • Installed arpwatch via Pakfire GUI
  • Created /etc/sysconfig/arpwatch config file (uncommented applicable lines)
  • Created empty dat file touch /var/lib/arpwatch/arp.dat per manpage
  • Started arpwatch via GUI (page refreshes, doesn’t start)
  • Started arpwatch via CLI, receive above error messages

It would seem there is something in the binary sending arpwatch to look in the wrong directory. Anyone else tried arpwatch yet and been successful?

1 Like

Hi, it seems like there is the need to create the configuration file by your own. The initscript looks at /etc/sysconfig/arpwatch to gather the needed configuration data –> git.ipfire.org Git - ipfire-2.x.git/blob - src/initscripts/packages/arpwatch . Since individual configuration parameters like interface(s) are (email(s) are optional) needed and there is currently no Web User Interface, i think your intervention in here are expected.

A possible config can looks like this

# Interfaces to monitor (space separated)
INTERFACES="green0 blue0"                # Network interfaces to monitor by arpwatch

# Email address to receive alert emails
WATCHER=hostmaster@somewhere.example.com  # Recipient of arpwatch alert emails

# Optional: From address for alert emails
WATCHEE=hostmaster@somewhere.example.com  # Sender address for alert emails

or a short one for testing

echo 'INTERFACES="green0 blue0"' | tee /etc/sysconfig/arpwatch

If this has been done, you could start the service via

/etc/init.d/arpwatch start

the whole initscript usage is

$ /etc/init.d/arpwatch
Usage: /etc/init.d/arpwatch {start|stop|restart}

Hope this helps.

Best,

Erik

P.S.: Have seen that the wiki has been updated www.ipfire.org - arpwatch .

3 Likes

Thanks, Eric. The wiki page has more info on it now but I still can’t seem to get it to work. Not a huge issue; it’s a small home office network which I can manage manually. Just thought it’d be nice to utilize arpwatch as an additional tool.

Please see thread https://community.ipfire.org/t/arpwatch-installation-failed/15070 to avoid duplication.