Hi,
thanks for your report.
On Tue, 06 Aug 2019 01:58:43 +1100
Dev wrote:
> Arpwatch not working properly (bug) on Debian 10.0 (Buster)
> (...)
There has been an intentional change on how arpwatch is started in
buster. From the NEWS file (you should have seen the content of this
during the upgrade):
Starting with version 2.1a15-3, arpwatch ships with systemd unit
files. The change requires manual steps after the upgrade.
The `/etc/arpwatch.conf` file, which can be used to specify different
configuration options for multiple interface, is replaced by
individual configuration files for each interface. If you have
configured arpwatch using `/etc/arpwatch.conf` file, you need to
convert this to the new format. See `/etc/arpwatch/README` for
details.
After the upgrade, arpwatch will not be started by default. You need
to specify the interface(s) to run on, see `/etc/default/arpwatch` for
instructions. If your database file in `/var/lib/arpwatch/` is called
`arp.dat` you need to rename it to `IFACE.dat` (where IFACE is the
name of the interface you configured arpwatch to run on) if you want
to keep your current arp database. Also, make sure to drop the `-i`
option from ARGS if you were using that to specify the interface.
The instructions from /etc/default/arpwatch that have already been
quoted in this bug are:
# when using systemd you have to enable arpwatch explicitly for each
# interface you want to run it on by running:
# systemctl enable arpwatch@IFACE
# systemctl start arpwatch@IFACE
> 1) File " /VAR/LIB/ARPWATCH/ARP.DAT " is not created
> (...)
> 2) /etc/init.d/arpwatch status display "service is running" but it's
> not running
> (...)
Reverting the changes you made to the systemd unit file and following
the instructions above to enable arpwatch on the interface(s) you want
should solve both your issues.
Regards
Lukas
