jokob-sk / NetAlertX

🖧🔍 WIFI / LAN intruder detector. Scans for devices connected to your network and alerts you if new and unknown devices are found.
GNU General Public License v3.0
2.84k stars 163 forks source link

MQTT configuration causes Pi.Alert to stop working #144

Closed nOerkH closed 1 year ago

nOerkH commented 1 year ago

I'm running Pi.Alert on Unraid, which is working ok so far - on-/offline detection is not working properly, but a huge issue for now is, that as soon as I enable MQTT reporting (wheter from UI or directly in the .yml file, it will stop working soon after. Until disabled, the container does not start again

Paste last few lines from pialert.log


[2023-01-20 11:48:24] Scan: Pholus for 20s (0.3min)
        Pholus scan on [interface] eth0 [mask] 192.168.88.0/24
[2023-01-20 11:48:45] Scan: Pholus SUCCESS
[2023-01-20 11:48:46] Scan: Pholus for 20s (0.3min)
        Pholus scan on [interface] eth0 [mask] 192.168.0.0/24
[2023-01-20 11:49:07] Scan: Pholus SUCCESS
        Trying to resolve devices without name
          Pholus entries from prev scans: 100
        Names Found (DiG/Pholus): 0 (0/0)
        Names Not Found         : 2
    Voiding false (ghost) disconnections
    Pairing session events (connection / disconnection) 
    Creating sessions snapshot
    Inserting scan results into Online_History
    Skipping repeated notifications
[2023-01-20 11:49:09] Scan: Nmap for max 120s (2.0min) per device
        Estimated max delay: 240s (4.0min)
[2023-01-20 11:49:09] Scan: Nmap SUCCESS for 192.168.88.2 (1/2)
[2023-01-20 11:49:16] Scan: Nmap SUCCESS for 192.168.88.85 (2/2)
  Check if something to report
    Changes detected, sending reports
      Skip email
      Skip Apprise
      Skip webhook
      Skip NTFY
      Skip PUSHSAFER
      Establishing MQTT thread

** Press ANY KEY to close this window ** 

Paste your pialert.conf (remove personal info)


#-----------------AUTOGENERATED FILE-----------------#
#                                                    #
#         Generated:  2023-01-20_11-23-37            #
#                                                    #
#   Config file for the LAN intruder detection app:  #
#      https://github.com/jokob-sk/Pi.Alert          #
#                                                    #
#-----------------AUTOGENERATED FILE-----------------#

# General
#---------------------------
ENABLE_ARPSCAN=True
SCAN_SUBNETS=['192.168.88.0/24 --interface=eth0','192.168.0.0/24 --interface=eth0']
PRINT_LOG=False
TIMEZONE='Europe/$$$$$$$'
PIALERT_WEB_PROTECTION=False
PIALERT_WEB_PASSWORD='$$$$$$'
INCLUDED_SECTIONS=['internet','new_devices','down_devices','events']
SCAN_CYCLE_MINUTES=5
DAYS_TO_KEEP_EVENTS=14
REPORT_DASHBOARD_URL='http://pi.alert/'
DIG_GET_IP_ARG='-4 myip.opendns.com @resolver1.opendns.com'

# Email
#---------------------------
REPORT_MAIL=False
SMTP_SERVER='smtp.gmail.com'
SMTP_PORT=587
REPORT_TO='user@gmail.com'
REPORT_FROM='Pi.Alert <user@gmail.com>'
SMTP_SKIP_LOGIN=False
SMTP_USER='user@gmail.com'
SMTP_PASS='password'
SMTP_SKIP_TLS=False

# Webhooks
#---------------------------
REPORT_WEBHOOK=False
WEBHOOK_URL='http://n8n.local:5555/webhook-test/aaaaaaaa-aaaa-aaaa-aaaaa-aaaaaaaaaaaa'
WEBHOOK_PAYLOAD='json'
WEBHOOK_REQUEST_METHOD='GET'

# Apprise
#---------------------------
REPORT_APPRISE=False
APPRISE_HOST='http://localhost:8000/notify'
APPRISE_URL='mailto://smtp-relay.sendinblue.com:587?from=user@gmail.com&name=apprise&user=user@gmail.com&pass=password&to=user@gmail.com'

# NTFY
#---------------------------
REPORT_NTFY=False
NTFY_HOST='https://ntfy.sh'
NTFY_TOPIC='replace_my_secure_topicname_91h889f28'
NTFY_USER='user'
NTFY_PASSWORD='passw0rd'

# PUSHSAFER
#---------------------------
REPORT_PUSHSAFER=False
PUSHSAFER_TOKEN='ApiKey'

# MQTT
#---------------------------
REPORT_MQTT=False
MQTT_BROKER='192.168.88.245'
MQTT_PORT=1883
MQTT_USER='mqttuser'
MQTT_PASSWORD='$$$$$$'
MQTT_QOS=0
MQTT_DELAY_SEC=2

# DynDNS
#---------------------------
DDNS_ACTIVE=False
DDNS_DOMAIN='your_domain.freeddns.org'
DDNS_USER='dynu_user'
DDNS_PASSWORD='A0000000B0000000C0000000D0000000'
DDNS_UPDATE_URL='https://api.dynu.com/nic/update?'

# PiHole
#---------------------------
PIHOLE_ACTIVE=True
DHCP_ACTIVE=False

# Pholus
#---------------------------
PHOLUS_ACTIVE=True
PHOLUS_TIMEOUT=20
PHOLUS_FORCE=False
PHOLUS_RUN='schedule'
PHOLUS_RUN_TIMEOUT=300
PHOLUS_RUN_SCHD='0 4 * * *'
PHOLUS_DAYS_DATA=7

# Nmap
#---------------------------
NMAP_ACTIVE=True
NMAP_TIMEOUT=120
NMAP_RUN='schedule'
NMAP_RUN_SCHD='0 2 * * *'
NMAP_ARGS='-p -10000'

#-------------------IMPORTANT INFO-------------------#
#   This file is ingested by a python script, so if  #
#        modified it needs to use python syntax      #
#-------------------IMPORTANT INFO-------------------#

Paste your docker-compose.yml and .env (remove personal info)

docker-compose.yml


Running on Unraid, not sure which data I could supply for your needs?

.env


Running on Unraid, not sure which data I could supply for your needs?

Screenshots If applicable, add screenshots to help explain your problem.

jokob-sk commented 1 year ago

Hey!

Thanks for using this fork.

I see you use both, arp-scan and pihole. Usually only one method is enabled, not sure why you have enabled both.

# General
#---------------------------
ENABLE_ARPSCAN=True

...
# PiHole
#---------------------------
PIHOLE_ACTIVE=True

Can you share your docker compose or run command (whichever you are using to create the container) as you nee to map the pihole DB and I want to make sure you are mapping the /etc/pihole/pihole-FTL.db DB file correctly?

I'm not familiar with Unraid but since you are using my docker container I assume there has to be docker running.

Also ideally try to run the container in foreground until it crashes so we get a more specific error message (e.g. don't use the -d parameter when setting up the container). E.g. adjust the following and run it with your paths:

docker run --rm --network=host \
  -v local/path/pialert/config:/home/pi/pialert/config \
  -v local/path/pialert/db:/home/pi/pialert/db \
  -e TZ=Europe/Berlin \
  -e PORT=20211 \
  jokobsk/pi.alert:latest

Then wait until it crashes to potentially get a more detailed error message.

Cheers in advance! j

nOerkH commented 1 year ago

Hi,

sorry it takes me a while - busy times, but the topic is still on my mind. Will reply back with the necessary information ASAP