search

jokob-sk / NetAlertX

🖧🔍 WIFI / LAN intruder detector. Scans for devices connected to your network and alerts you if new and unknown devices are found.
GNU General Public License v3.0
2.97k stars 178 forks source link

some down devices periodically? #840

Closed stanelie closed 3 days ago

stanelie commented 6 days ago

Is there an existing issue for this?

Current Behavior

About every 30 minutes, but not quite as regularly, I have a bunch of devices (20 ish out of 300) that indicate they are down. However, this is not true.

Expected Behavior

I expect my up devices to indicate that they are up, when they are.

Steps To Reproduce

This issue has appeared only since I've enabled the Mikrotik plugin, so, I guess the devices are being scanned by both the Mikrotik plugin, and some other scanning engine. Maybe there is a conflict between the two?

app.conf

default app.conf, not modified in any way

docker-compose.yml

`version: "3"
services:
  netalertx:
    container_name: netalertx
    image: "jokobsk/netalertx-dev:latest"
    restart: unless-stopped
    logging:
      driver: "json-file"
      options:
        max-size: "48m"
    volumes:
      -  /home/netalertx/config:/app/config
      -  /home/netalertx/db:/app/db
      -  /home/netalertx/log:/app/front/log
      -  /home/netalertx/config/resolv.conf:/etc/resolv.conf
    environment:
      - TZ=America/Montreal
      - PORT=8080
    network_mode: host
    dns:
      - 10.8.0.1
      - 10.8.0.17`

What branch are you running?

Dev

app.log

`15:50:38 [MTSCAN] Script finished 15:50:38 [MTSCAN] Scan finished, found 168 devices 15:51:01 [Config] reading config file 15:51:01 [Config] Plugins: Number of all plugins (including not loaded): 37 15:51:01 [Plugin utils] --------------------------------------------- 15:51:01 [Plugin utils] display_name: OMADA SDN import 15:51:01 [Plugin utils] description: Plugin to import data from OMADA SDN. 15:51:02 [Plugin utils] --------------------------------------------- 15:51:02 [Plugin utils] display_name: SNMP discovery 15:51:02 [Plugin utils] description: This plugin is used to discover devices via the arp table(s) of a RFC1213 compliant router or switch. 15:51:02 [Plugin utils] --------------------------------------------- 15:51:02 [Plugin utils] display_name: UniFi import 15:51:02 [Plugin utils] description: This plugin is used to import devices from an UNIFI controller. 15:51:02 [Plugin utils] --------------------------------------------- 15:51:02 [Plugin utils] display_name: Arp-Scan (Network scan) 15:51:02 [Plugin utils] description: This plugin is to execute an arp-scan on the local network 15:51:02 [Plugin utils] --------------------------------------------- 15:51:02 [Plugin utils] display_name: PiHole (Device sync) 15:51:02 [Plugin utils] description: This plugin syncs devices from the PiHole database 15:51:02 [Plugin utils] --------------------------------------------- 15:51:02 [Plugin utils] display_name: AVAHISCAN (Name discovery) 15:51:02 [Plugin utils] description: A plugin to discover device names via mDNS. 15:51:03 [Plugin utils] --------------------------------------------- 15:51:03 [Plugin utils] display_name: DHCP Leases (Device import) 15:51:03 [Plugin utils] description: This plugin is to import devices from dhcp.leases files. 15:51:03 [Plugin utils] --------------------------------------------- 15:51:03 [Plugin utils] display_name: Rogue DHCP 15:51:03 [Plugin utils] description: This plugin is to use NMAP to monitor for rogue DHCP servers. 15:51:03 [Plugin utils] --------------------------------------------- 15:51:03 [Plugin utils] display_name: Internet-Check 15:51:03 [Plugin utils] description: A plugin to check your internet connectivity and IP. 15:51:03 [Plugin utils] --------------------------------------------- 15:51:03 [Plugin utils] display_name: NBTSCAN (Name discovery) 15:51:03 [Plugin utils] description: A plugin to discover device names via NetBIOS. 15:51:03 [Plugin utils] --------------------------------------------- 15:51:03 [Plugin utils] display_name: NMAP Device discovery 15:51:03 [Plugin utils] description: This plugin is to execute an NMAP scan for device discovery on the local network 15:51:03 [Plugin utils] --------------------------------------------- 15:51:03 [Plugin utils] display_name: Mikrotik (Device discovery) 15:51:03 [Plugin utils] description: A plugin to discover devices via Mikrotik. 15:51:03 [Plugin utils] --------------------------------------------- 15:51:03 [Plugin utils] display_name: Services & Ports (NMAP) 15:51:03 [Plugin utils] description: This plugin shows all services discovered by NMAP scans. 15:51:03 [Plugin utils] --------------------------------------------- 15:51:03 [Plugin utils] display_name: NSLOOKUP (Name discovery) 15:51:03 [Plugin utils] description: A plugin to discover device names. 15:51:05 [Plugin utils] --------------------------------------------- 15:51:05 [Plugin utils] display_name: Apprise publisher 15:51:05 [Plugin utils] description: A plugin to publish a notification via the Apprise gateway. 15:51:05 [Plugin utils] --------------------------------------------- 15:51:05 [Plugin utils] display_name: Email publisher (SMTP) 15:51:05 [Plugin utils] description: A plugin to publish a notification via Email (SMTP) gateway. 15:51:06 [Plugin utils] --------------------------------------------- 15:51:06 [Plugin utils] display_name: MQTT publisher 15:51:06 [Plugin utils] description: A plugin to publish a notification via MQTT to Home Assistant. 15:51:06 [Plugin utils] --------------------------------------------- 15:51:06 [Plugin utils] display_name: NTFY publisher 15:51:06 [Plugin utils] description: A plugin to publish a notification via the NTFY gateway. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: Pushover publisher 15:51:07 [Plugin utils] description: A plugin to publish a notification via the pushover.net 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: Pushsafer publisher 15:51:07 [Plugin utils] description: A plugin to publish a notification via the Pushsafer gateway. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: Telegram publisher 15:51:07 [Plugin utils] description: A plugin to publish a notification via Telegram. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: Webhook publisher 15:51:07 [Plugin utils] description: A plugin to publish a notification via Webhooks. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: CSV backup 15:51:07 [Plugin utils] description: A plugin to auto-generate devices.csv backups. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: DB cleanup 15:51:07 [Plugin utils] description: A plugin to schedule database cleanup & upkeep tasks. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: DDNS update 15:51:07 [Plugin utils] description: A plugin update the DDNS record. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: Internet speedtest 15:51:07 [Plugin utils] description: A plugin to perform a scheduled internet speedtest. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: Maintenance 15:51:07 [Plugin utils] description: A plugin for maintenance tasks. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: New Devices 15:51:07 [Plugin utils] description: The template used for new devices. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: Notification Processing 15:51:07 [Plugin utils] description: A plugin to for advanced notification processing. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: Pholus (Name discovery) 15:51:07 [Plugin utils] description: This plugin is to execute a Pholus (name discovery) on the local network 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: Set password 15:51:07 [Plugin utils] description: A simple plugin to set the web ui password on app start. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: Sync Hub 15:51:07 [Plugin utils] description: Plugin to synchronize multiple NetAlertX instances. 15:51:07 [Plugin utils] --------------------------------------------- 15:51:07 [Plugin utils] display_name: UI settings 15:51:07 [Plugin utils] description: Plugin to adjust UI settings. 15:51:08 [Plugin utils] --------------------------------------------- 15:51:08 [Plugin utils] display_name: Un-Discoverable Devices 15:51:08 [Plugin utils] description: This plugin is to import undiscoverable devices from a file. Only ASCII characters are supported. 15:51:08 [Plugin utils] --------------------------------------------- 15:51:08 [Plugin utils] display_name: Vendor update 15:51:08 [Plugin utils] description: A plugin to schedule vendor database updates for mac based vendor resolution. 15:51:09 [Plugin utils] --------------------------------------------- 15:51:09 [Plugin utils] display_name: Website monitor 15:51:09 [Plugin utils] description: This plugin is to monitor status changes of services or websites. 15:51:09 [Plugin utils] --------------------------------------------- 15:51:09 [Plugin utils] display_name: Workflows 15:51:09 [Plugin utils] description: A plugin to adjust behavior of workflows. 15:51:09 [Config] ⛔ Unloading WEBMON 15:51:09 [Config] ⛔ Unloading UNDIS 15:51:09 [Config] ⛔ Unloading INTRSPD 15:51:09 [Config] ⛔ Unloading DDNS 15:51:09 [Config] ⛔ Unloading WEBHOOK 15:51:09 [Config] ⛔ Unloading TELEGRAM 15:51:09 [Config] ⛔ Unloading PUSHSAFER 15:51:09 [Config] ⛔ Unloading PUSHOVER 15:51:09 [Config] ⛔ Unloading MQTT 15:51:09 [Config] ⛔ Unloading APPRISE 15:51:09 [Config] ⛔ Unloading NMAP 15:51:09 [Config] ⛔ Unloading INTRNT 15:51:09 [Config] ⛔ Unloading DHCPLSS 15:51:09 [Config] ⛔ Unloading PIHOLE 15:51:09 [Config] ⛔ Unloading UNFIMP 15:51:09 [Config] ⛔ Unloading SNMPDSC 15:51:09 [Config] ⛔ Unloading OMDSDN 15:51:09 [Config] Number of Plugins to load: 20 15:51:09 [Config] Plugins to load: ['ARPSCAN', 'AVAHISCAN', 'DHCPSRVS', 'NBTSCAN', 'NMAPDEV', 'MTSCAN', 'NSLOOKUP', 'SMTP', 'NTFY', 'CSVBCKP', 'DBCLNP', 'MAINT', 'NEWDEV', 'NTFPRCS', 'PHOLUS', 'SETPWD', 'SYNC', 'UI', 'VNDRPDT', 'WORKFLOWS'] 15:51:09 [Config] File /app/config/app_conf_override.json does not exist. 15:51:09 [Config] buildTimestamp: '1728821839' 15:51:09 [Config] conf.VERSION : '1728821839' 15:51:09 [API] Update API starting 15:51:10 [API] Updating table_settings.json file in /front/api 15:51:10 [Plugins] Check if any plugins need to be executed on run type: before_config_save 15:51:10 [Config] Imported new config 15:51:10 [Plugins] Check if any plugins need to be executed on run type: once 15:51:10 [API] Update API starting 15:51:13 [API] Updating table_plugins_language_strings.json file in /front/api 15:51:13 [API] Updating table_online_history.json file in /front/api 15:51:16 [Plugins] Check if any plugins need to be executed on run type: schedule 15:51:16 [Scheduler] - Scheduler run for ARPSCAN: NO 15:51:16 [Scheduler] - Scheduler run for NBTSCAN: NO 15:51:16 [Scheduler] - Scheduler run for NMAPDEV: NO 15:51:16 [Scheduler] - Scheduler run for CSVBCKP: NO 15:51:16 [Scheduler] - Scheduler run for DBCLNP: NO 15:51:16 [Scheduler] - Scheduler run for MAINT: NO 15:51:16 [Scheduler] - Scheduler run for VNDRPDT: NO 15:51:16 [Plugins] Check if any plugins need to be executed on run type: always_after_scan 15:51:17 [Plugin utils] --------------------------------------------- 15:51:17 [Plugin utils] display_name: Pholus (Name discovery) 15:51:17 [Plugins] CMD: python3 /app/front/plugins/pholus_scan/script.py userSubnets={subnets} timeoutSec={timeout} 15:51:17 [Plugins] Resolving param: {'name': 'subnets', 'type': 'setting', 'value': 'SCAN_SUBNETS', 'base64': True} 15:51:17 [Plugins] setTyp: {"dataType": "array","elements": [{"elementType": "input","elementOptions": [{"placeholder": "192.168.1.0/24 --interface=eth1"},{"suffix": "_in"},{"cssClasses": "col-sm-10"},{"prefillValue": "null"}],"transformers": []},{"elementType": "button","elementOptions": [{"sourceSuffixes": ["_in"]},{"separator": ""},{"cssClasses": "col-xs-12"},{"onClick": "addList(this, false)"},{"getStringKey": "Gen_Add"}],"transformers": []},{"elementType": "select","elementHasInputValue": 1,"elementOptions": [{"multiple": "true"},{"readonly": "true"},{"editable": "true"}],"transformers": []},{"elementType": "button","elementOptions": [{"sourceSuffixes": []},{"separator": ""},{"cssClasses": "col-xs-6"},{"onClick": "removeAllOptions(this)"},{"getStringKey": "Gen_Remove_All"}],"transformers": []},{"elementType": "button","elementOptions": [{"sourceSuffixes": []},{"separator": ""},{"cssClasses": "col-xs-6"},{"onClick": "removeFromList(this)"},{"getStringKey": "Gen_Remove_Last"}],"transformers": []}]} 15:51:17 [Plugins] setTypJSN: {'dataType': 'array', 'elements': [{'elementType': 'input', 'elementOptions': [{'placeholder': '192.168.1.0/24 --interface=eth1'}, {'suffix': '_in'}, {'cssClasses': 'col-sm-10'}, {'prefillValue': 'null'}], 'transformers': []}, {'elementType': 'button', 'elementOptions': [{'sourceSuffixes': ['_in']}, {'separator': ''}, {'cssClasses': 'col-xs-12'}, {'onClick': 'addList(this, false)'}, {'getStringKey': 'Gen_Add'}], 'transformers': []}, {'elementType': 'select', 'elementHasInputValue': 1, 'elementOptions': [{'multiple': 'true'}, {'readonly': 'true'}, {'editable': 'true'}], 'transformers': []}, {'elementType': 'button', 'elementOptions': [{'sourceSuffixes': []}, {'separator': ''}, {'cssClasses': 'col-xs-6'}, {'onClick': 'removeAllOptions(this)'}, {'getStringKey': 'Gen_Remove_All'}], 'transformers': []}, {'elementType': 'button', 'elementOptions': [{'sourceSuffixes': []}, {'separator': ''}, {'cssClasses': 'col-xs-6'}, {'onClick': 'removeFromList(this)'}, {'getStringKey': 'Gen_Remove_Last'}], 'transformers': []}]} 15:51:17 [Plugins] dType: array 15:51:17 [Plugin utils] Flattening the below array 15:51:17 ['10.8.0.0/23 --interface=eth0'] 15:51:17 [Plugin utils] isinstance(arr, list) : False | isinstance(arr, str) : True 15:51:17 [Plugins] Resolved value: 10.8.0.0/23 --interface=eth0 15:51:17 [Plugins] Convert to Base64: True 15:51:17 [Plugins] base64 value: b'MTAuOC4wLjAvMjMgLS1pbnRlcmZhY2U9ZXRoMA==' 15:51:17 [Plugins] Resolving param: {'name': 'timeout', 'type': 'setting', 'value': 'PHOLUS_RUN_TIMEOUT'} 15:51:17 [Plugins] setTyp: {'dataType': 'integer', 'elements': [{'elementType': 'input', 'elementOptions': [{'type': 'number'}], 'transformers': []}]} 15:51:17 [Plugins] setTypJSN: {'dataType': 'integer', 'elements': [{'elementType': 'input', 'elementOptions': [{'type': 'number'}], 'transformers': []}]} 15:51:17 [Plugins] dType: integer 15:51:17 [Plugins] Resolved value: 300 15:51:17 [Plugins] Convert to Base64: False 15:51:17 [Plugins] Timeout: 300 15:51:17 [Plugin utils] Pre-Resolved CMD: python3/app/front/plugins/pholus_scan/script.pyuserSubnets={subnets}timeoutSec={timeout} 15:51:17 [Plugins] Executing: python3 /app/front/plugins/pholus_scan/script.py userSubnets={subnets} timeoutSec={timeout} 15:51:17 [Plugins] Resolved : ['python3', '/app/front/plugins/pholus_scan/script.py', "userSubnets=b'MTAuOC4wLjAvMjMgLS1pbnRlcmZhY2U9ZXRoMA=='", 'timeoutSec=300'] 15:51:18 [PHOLUS] In script 15:51:18 [PHOLUS] Subnets: ["userSubnets=b'MTAuOC4wLjAvMjMgLS1pbnRlcmZhY2U9ZXRoMA=='"] 15:51:18 [PHOLUS] len Subnets: 1 15:51:18 [PHOLUS] 'MTAuOC4wLjAvMjMgLS1pbnRlcmZhY2U9ZXRoMA==' 15:51:18 [PHOLUS] 300 15:51:18 [PHOLUS] userSubnetsParam 10.8.0.0/23 --interface=eth0 15:51:18 [PHOLUS] 300.0 15:51:18 [PHOLUS] Scan: Pholus for 300.0s (5.0min) 15:51:18 [PHOLUS] Pholus scan on [interface] eth0 [mask] 10.8.0.0/23 15:52:06 [PHOLUS] Scan: Pholus SUCCESS 15:52:06 [PHOLUS] [] 15:52:06 [PHOLUS] Pholus output number of entries:0 15:52:06 [PHOLUS] List:[] 15:52:06 [Plugins] Processing file "/app/front/plugins/pholus_scan/last_result.log" 15:52:06 [Plugins] No output received from the plugin "PHOLUS" 15:52:06 [MAIN] processScan: True 15:52:06 [MAIN] start processig scan results 15:52:06 [Process Scan] Exclude ignored devices 15:52:06 [New Devices] Excluding Ignored Devices Query: DELETE FROM CurrentScan WHERE 1=1 AND ( (cur_IP LIKE '10.10.%' OR cur_IP LIKE '10.7.%') )

15:52:06 [Process Scan] Processing scan results 15:52:06 [Save Devices] Saving this IP into the CurrentScan table:10.8.1.202 15:52:06 [Process Scan] Print Stats 15:52:06 [Scan Stats] Devices Detected.......: 155 15:52:06 [Scan Stats] New Devices............: 0 15:52:06 [Scan Stats] Down Alerts............: 27 15:52:06 [Scan Stats] New Down Alerts........: 27 15:52:06 [Scan Stats] New Connections........: 123 15:52:06 [Scan Stats] Disconnections.........: 29 15:52:06 [Scan Stats] IP Changes.............: 0 15:52:06 [Scan Stats] Scan Method Statistics: 15:52:06 MTSCAN: 155 15:52:06 [Process Scan] Stats end 15:52:06 [Process Scan] Sessions Events (connect / disconnect) 15:52:06 [Events] - 1 - Devices down 15:52:09 [Events] - 2 - New Connections 15:52:10 [Events] - 3 - Disconnections 15:52:10 [Events] - 4 - IP Changes 15:52:10 [Events] - Events end 15:52:10 [Process Scan] Creating new devices 15:52:10 [New Devices] New devices - 1 Events 15:52:10 [New Devices] Log Events Query: INSERT INTO Events (eve_MAC, eve_IP, eve_DateTime, eve_EventType, eve_AdditionalInfo, eve_PendingAlertEmail) SELECT cur_MAC, cur_IP, '2024-10-13 15:52:10-04:00', 'New Device', cur_Vendor, 1 FROM CurrentScan WHERE NOT EXISTS (SELECT 1 FROM Devices WHERE dev_MAC = cur_MAC)

15:52:10 [New Devices] Insert Connection into session table 15:52:10 [New Devices] 2 Create devices 15:52:10 [New Devices] Collecting New Devices Query: SELECT cur_MAC, cur_Name, cur_Vendor, cur_IP, cur_SyncHubNodeName, cur_NetworkNodeMAC, cur_PORT, cur_NetworkSite, cur_SSID, cur_Type FROM CurrentScan 15:52:17 [New Devices] New Devices end 15:52:17 [Process Scan] Updating Devices Info 15:52:17 [Update Devices] 1 Last Connection 15:52:17 [Update Devices] 2 Clean no active devices 15:52:18 [Update Devices] - cur_IP -> dev_LastIP (always updated) 15:52:18 [Update Devices] - cur_Vendor -> (if empty) dev_Vendor 15:52:18 [Update Devices] - (if not empty) cur_Port -> dev_Network_Node_port 15:52:18 [Update Devices] - (if not empty) cur_NetworkNodeMAC -> dev_Network_Node_MAC_ADDR 15:52:18 [Update Devices] - (if not empty) cur_NetworkSite -> (if empty) dev_NetworkSite 15:52:18 [Update Devices] - (if not empty) cur_SSID -> (if empty) dev_SSID 15:52:18 [Update Devices] - (if not empty) cur_Type -> (if empty) dev_DeviceType 15:52:18 [Update Devices] - (if not empty) cur_Name -> (if empty) dev_NAME 15:52:18 [Vendor Check] ⚠ ERROR: Match found, but line could not be processed: "744d28 routerboard.com " 15:52:18 [Vendor Check] ⚠ ERROR: Match found, but line could not be processed: "2cc81b routerboard.com " 15:52:19 [Vendor Check] ⚠ ERROR: Match found, but line could not be processed: "54e140 ingenico " 15:52:22 [Update Devices] Update devices end 15:52:22 [Process Scan] Voiding false (ghost) disconnections 15:52:22 [Void Ghost Con] - 1 Connect ghost events 15:52:22 [Void Ghost Con] - 2 Paired events 15:52:22 [Void Ghost Con] - 3 Disconnect ghost events 15:52:22 [Void Ghost Con] Void Ghost Connections end 15:52:22 [Process Scan] Pairing session events (connection / disconnection) 15:52:22 [Pair Session] - 1 Connections / New Devices 15:52:22 [Pair Session] - 2 Disconnections 15:52:22 [Pair Session] Pair session end 15:52:22 [Process Scan] Creating sessions snapshot 15:52:22 [Sessions Snapshot] - 1 Clean 15:52:28 [Sessions Snapshot] - 2 Insert 15:52:30 [Sessions Snapshot] Sessions end 15:52:30 [Process Scan] Inserting scan results into Online_History 15:52:30 [Presence graph] Sql query: INSERT INTO Online_History (Scan_Date, Online_Devices, Down_Devices, All_Devices, Archived_Devices, Offline_Devices) VALUES (?, ?, ?, ?, ?, ?) with values: 2024-10-13 15:52:30-04:00, 155, 27, 307, 0, 152 15:52:30 [Process Scan] Skipping repeated notifications 15:52:30 [Skip Repeated Notifications] Skip Repeated 15:52:30 [Plugins] Check if any plugins need to be executed on run type: before_name_updates 15:52:30 [Plugin utils] --------------------------------------------- 15:52:30 [Plugin utils] display_name: AVAHISCAN (Name discovery) 15:52:30 [Plugins] CMD: python3 /app/front/plugins/avahi_scan/avahi_scan.py 15:52:30 [Plugins] Resolving param: {'name': 'ips', 'type': 'sql', 'value': 'SELECT dev_LastIP from DEVICES order by dev_MAC', 'timeoutMultiplier': True} 15:52:30 [Plugin utils] Flattening the below array 15:52:30 ['10.4.0.3']['10.8.1.86']['10.8.0.25']['10.8.0.252']['10.8.0.60']['10.8.1.31']['10.8.0.70']['10.7.0.62']['10.8.0.2']['10.8.1.246']['10.8.0.17']['10.8.0.27']['10.8.0.28']['10.8.0.19']['10.8.0.67']['10.8.0.11']['10.8.1.237']['10.8.1.111']['10.8.0.244']['10.8.0.6']['10.8.1.173']['10.6.0.95']['10.6.0.98']['10.6.0.97']['10.6.0.96']['10.6.0.99']['10.8.1.180']['10.8.0.29']['10.8.0.23']['10.8.0.26']['10.4.0.105']['10.7.0.238']['10.8.1.5']['10.8.1.47']['10.8.1.4']['10.8.1.227']['10.8.0.40']['10.8.0.223']['10.7.0.181']['10.7.0.232']['10.8.1.80']['10.8.1.218']['10.8.0.249']['10.8.1.30']['10.8.1.127']['10.7.0.240']['10.8.1.22']['10.8.0.213']['10.8.0.227']['10.8.1.19']['10.8.0.81']['10.8.0.83']['10.8.0.82']['10.8.0.84']['10.8.1.97']['10.8.1.171']['10.8.1.172']['10.8.1.166']['10.8.1.101']['10.8.1.87']['10.8.0.99']['10.8.1.126']['10.8.1.49']['10.8.0.238']['10.8.1.113']['10.8.1.18']['10.8.0.20']['10.8.0.12']['10.8.1.121']['10.8.1.83']['10.8.1.11']['10.4.0.254']['10.8.1.106']['10.8.1.77']['10.7.0.48']['10.7.0.236']['10.7.0.44']['10.8.0.236']['10.8.1.75']['10.8.1.6']['10.8.1.59']['10.8.1.169']['10.8.1.42']['10.7.0.162']['10.8.1.118']['10.8.0.218']['10.8.0.253']['10.8.1.105']['10.8.1.206']['10.8.1.69']['10.8.1.93']['10.8.1.99']['10.5.0.196']['10.5.0.114']['10.5.0.155']['10.5.0.116']['10.5.0.118']['10.5.0.115']['10.5.0.138']['10.5.0.145']['10.5.0.156']['10.5.0.142']['10.5.0.147']['10.5.0.158']['10.5.0.110']['10.5.0.180']['10.5.0.136']['10.5.0.151']['10.5.0.193']['10.5.0.120']['10.5.0.161']['10.5.0.121']['10.5.0.153']['10.5.0.149']['10.5.0.139']['10.5.0.148']['10.5.0.144']['10.5.0.150']['10.5.0.108']['10.5.0.140']['10.5.0.109']['10.5.0.143']['10.5.0.111']['10.5.0.160']['10.5.0.159']['10.5.0.127']['10.5.0.125']['10.5.0.129']['10.5.0.163']['10.5.0.124']['10.8.1.25']['10.4.0.253']['10.7.0.209']['10.8.1.124']['10.8.1.103']['10.8.1.135']['10.8.1.252']['10.8.1.151']['10.7.0.65']['10.8.0.223']['10.8.1.71']['10.8.1.76']['10.7.0.163']['10.8.0.32']['10.8.1.54']['10.8.0.76']['10.7.0.235']['10.8.1.239']['10.8.1.70']['10.8.0.1']['10.8.0.116']['10.8.0.117']['10.8.0.105']['10.8.0.107']['10.8.0.102']['10.8.0.108']['10.8.0.104']['10.8.0.110']['10.8.0.115']['10.8.0.56']['10.8.1.13']['10.8.0.210']['10.8.1.72']['10.7.0.131']['10.8.0.241']['10.8.1.74']['10.8.0.136']['10.8.1.9']['10.8.1.95']['10.8.1.21']['10.8.0.77']['10.7.0.234']['10.8.1.24']['10.8.1.29']['10.8.1.200']['10.8.1.108']['10.8.1.8']['10.8.1.96']['10.8.1.32']['10.8.1.196']['10.8.1.161']['10.6.0.4']['10.8.1.57']['10.8.1.48']['10.8.1.43']['10.8.1.134']['10.8.1.129']['10.8.1.60']['10.8.1.66']['10.8.1.78']['10.8.1.62']['10.8.1.132']['10.8.1.16']['10.7.0.221']['10.8.1.114']['10.8.0.31']['10.8.1.115']['10.8.0.235']['10.7.0.216']['10.8.1.119']['10.8.1.41']['10.8.0.135']['10.8.0.133']['10.8.0.131']['10.8.0.132']['10.8.1.44']['10.8.1.35']['10.8.1.39']['10.8.1.46']['10.8.1.40']['10.8.1.58']['10.8.1.232']['10.8.1.20']['10.8.1.123']['10.8.1.55']['10.8.1.56']['10.8.1.92']['10.8.1.217']['10.8.1.64']['10.8.1.110']['10.8.1.120']['10.7.0.237']['10.8.0.220']['10.8.1.83']['10.8.0.234']['10.8.1.33']['10.8.1.208']['10.7.0.239']['10.8.1.202']['10.8.0.200']['10.8.0.47']['10.8.0.41']['10.8.0.45']['10.8.0.43']['10.8.0.46']['10.8.0.55']['10.8.0.53']['10.8.0.54']['10.8.0.42']['10.8.0.52']['10.8.0.51']['10.8.0.44']['10.5.0.157']['10.5.0.105']['10.5.0.103']['10.5.0.146']['10.5.0.141']['10.5.0.152']['10.5.0.102']['10.5.0.100']['10.5.0.132']['10.5.0.130']['10.5.0.128']['10.5.0.101']['10.5.0.164']['10.5.0.126']['10.5.0.131']['10.5.0.106']['10.5.0.166']['10.5.0.117']['10.5.0.112']['10.8.1.108']['10.8.1.148']['10.8.1.15']['10.8.0.209']['10.8.0.211']['10.8.1.82']['10.8.0.35']['10.8.1.28']['10.8.1.85']['10.8.1.94']['10.8.1.37']['10.8.1.175']['10.8.0.24']['10.8.0.74']['10.8.0.59']['10.8.1.2']['10.8.0.62']['10.8.0.237']['10.8.1.107']['10.8.1.65']['10.8.1.53']['10.8.1.203']['10.8.1.45']['10.8.1.73']['10.8.1.236']['10.8.1.122']['10.8.1.222']['10.8.1.23']['10.8.1.145']['10.8.1.112']['10.8.1.7']['10.8.1.192']['10.8.1.109']['10.8.1.51']['10.7.0.233']['10.7.0.87']['10.8.1.235']['10.8.1.133']['10.8.1.199']['10.8.1.88']['10.8.1.26']['10.8.1.14']['10.8.1.79']['10.8.0.216']['10.8.1.68']['10.8.1.98'] 15:52:30 [Plugin utils] isinstance(arr, list) : True | isinstance(arr, str) : False 15:52:30 [Plugin utils] Flattened array: 10.4.0.3,10.8.1.86,10.8.0.25,10.8.0.252,10.8.0.60,10.8.1.31,10.8.0.70,10.7.0.62,10.8.0.2,10.8.1.246,10.8.0.17,10.8.0.27,10.8.0.28,10.8.0.19,10.8.0.67,10.8.0.11,10.8.1.237,10.8.1.111,10.8.0.244,10.8.0.6,10.8.1.173,10.6.0.95,10.6.0.98,10.6.0.97,10.6.0.96,10.6.0.99,10.8.1.180,10.8.0.29,10.8.0.23,10.8.0.26,10.4.0.105,10.7.0.238,10.8.1.5,10.8.1.47,10.8.1.4,10.8.1.227,10.8.0.40,10.8.0.223,10.7.0.181,10.7.0.232,10.8.1.80,10.8.1.218,10.8.0.249,10.8.1.30,10.8.1.127,10.7.0.240,10.8.1.22,10.8.0.213,10.8.0.227,10.8.1.19,10.8.0.81,10.8.0.83,10.8.0.82,10.8.0.84,10.8.1.97,10.8.1.171,10.8.1.172,10.8.1.166,10.8.1.101,10.8.1.87,10.8.0.99,10.8.1.126,10.8.1.49,10.8.0.238,10.8.1.113,10.8.1.18,10.8.0.20,10.8.0.12,10.8.1.121,10.8.1.83,10.8.1.11,10.4.0.254,10.8.1.106,10.8.1.77,10.7.0.48,10.7.0.236,10.7.0.44,10.8.0.236,10.8.1.75,10.8.1.6,10.8.1.59,10.8.1.169,10.8.1.42,10.7.0.162,10.8.1.118,10.8.0.218,10.8.0.253,10.8.1.105,10.8.1.206,10.8.1.69,10.8.1.93,10.8.1.99,10.5.0.196,10.5.0.114,10.5.0.155,10.5.0.116,10.5.0.118,10.5.0.115,10.5.0.138,10.5.0.145,10.5.0.156,10.5.0.142,10.5.0.147,10.5.0.158,10.5.0.110,10.5.0.180,10.5.0.136,10.5.0.151,10.5.0.193,10.5.0.120,10.5.0.161,10.5.0.121,10.5.0.153,10.5.0.149,10.5.0.139,10.5.0.148,10.5.0.144,10.5.0.150,10.5.0.108,10.5.0.140,10.5.0.109,10.5.0.143,10.5.0.111,10.5.0.160,10.5.0.159,10.5.0.127,10.5.0.125,10.5.0.129,10.5.0.163,10.5.0.124,10.8.1.25,10.4.0.253,10.7.0.209,10.8.1.124,10.8.1.103,10.8.1.135,10.8.1.252,10.8.1.151,10.7.0.65,10.8.0.223,10.8.1.71,10.8.1.76,10.7.0.163,10.8.0.32,10.8.1.54,10.8.0.76,10.7.0.235,10.8.1.239,10.8.1.70,10.8.0.1,10.8.0.116,10.8.0.117,10.8.0.105,10.8.0.107,10.8.0.102,10.8.0.108,10.8.0.104,10.8.0.110,10.8.0.115,10.8.0.56,10.8.1.13,10.8.0.210,10.8.1.72,10.7.0.131,10.8.0.241,10.8.1.74,10.8.0.136,10.8.1.9,10.8.1.95,10.8.1.21,10.8.0.77,10.7.0.234,10.8.1.24,10.8.1.29,10.8.1.200,10.8.1.108,10.8.1.8,10.8.1.96,10.8.1.32,10.8.1.196,10.8.1.161,10.6.0.4,10.8.1.57,10.8.1.48,10.8.1.43,10.8.1.134,10.8.1.129,10.8.1.60,10.8.1.66,10.8.1.78,10.8.1.62,10.8.1.132,10.8.1.16,10.7.0.221,10.8.1.114,10.8.0.31,10.8.1.115,10.8.0.235,10.7.0.216,10.8.1.119,10.8.1.41,10.8.0.135,10.8.0.133,10.8.0.131,10.8.0.132,10.8.1.44,10.8.1.35,10.8.1.39,10.8.1.46,10.8.1.40,10.8.1.58,10.8.1.232,10.8.1.20,10.8.1.123,10.8.1.55,10.8.1.56,10.8.1.92,10.8.1.217,10.8.1.64,10.8.1.110,10.8.1.120,10.7.0.237,10.8.0.220,10.8.1.83,10.8.0.234,10.8.1.33,10.8.1.208,10.7.0.239,10.8.1.202,10.8.0.200,10.8.0.47,10.8.0.41,10.8.0.45,10.8.0.43,10.8.0.46,10.8.0.55,10.8.0.53,10.8.0.54,10.8.0.42,10.8.0.52,10.8.0.51,10.8.0.44,10.5.0.157,10.5.0.105,10.5.0.103,10.5.0.146,10.5.0.141,10.5.0.152,10.5.0.102,10.5.0.100,10.5.0.132,10.5.0.130,10.5.0.128,10.5.0.101,10.5.0.164,10.5.0.126,10.5.0.131,10.5.0.106,10.5.0.166,10.5.0.117,10.5.0.112,10.8.1.108,10.8.1.148,10.8.1.15,10.8.0.209,10.8.0.211,10.8.1.82,10.8.0.35,10.8.1.28,10.8.1.85,10.8.1.94,10.8.1.37,10.8.1.175,10.8.0.24,10.8.0.74,10.8.0.59,10.8.1.2,10.8.0.62,10.8.0.237,10.8.1.107,10.8.1.65,10.8.1.53,10.8.1.203,10.8.1.45,10.8.1.73,10.8.1.236,10.8.1.122,10.8.1.222,10.8.1.23,10.8.1.145,10.8.1.112,10.8.1.7,10.8.1.192,10.8.1.109,10.8.1.51,10.7.0.233,10.7.0.87,10.8.1.235,10.8.1.133,10.8.1.199,10.8.1.88,10.8.1.26,10.8.1.14,10.8.1.79,10.8.0.216,10.8.1.68,10.8.1.98 15:52:30 [Plugins] Resolved value: 10.4.0.3,10.8.1.86,10.8.0.25,10.8.0.252,10.8.0.60,10.8.1.31,10.8.0.70,10.7.0.62,10.8.0.2,10.8.1.246,10.8.0.17,10.8.0.27,10.8.0.28,10.8.0.19,10.8.0.67,10.8.0.11,10.8.1.237,10.8.1.111,10.8.0.244,10.8.0.6,10.8.1.173,10.6.0.95,10.6.0.98,10.6.0.97,10.6.0.96,10.6.0.99,10.8.1.180,10.8.0.29,10.8.0.23,10.8.0.26,10.4.0.105,10.7.0.238,10.8.1.5,10.8.1.47,10.8.1.4,10.8.1.227,10.8.0.40,10.8.0.223,10.7.0.181,10.7.0.232,10.8.1.80,10.8.1.218,10.8.0.249,10.8.1.30,10.8.1.127,10.7.0.240,10.8.1.22,10.8.0.213,10.8.0.227,10.8.1.19,10.8.0.81,10.8.0.83,10.8.0.82,10.8.0.84,10.8.1.97,10.8.1.171,10.8.1.172,10.8.1.166,10.8.1.101,10.8.1.87,10.8.0.99,10.8.1.126,10.8.1.49,10.8.0.238,10.8.1.113,10.8.1.18,10.8.0.20,10.8.0.12,10.8.1.121,10.8.1.83,10.8.1.11,10.4.0.254,10.8.1.106,10.8.1.77,10.7.0.48,10.7.0.236,10.7.0.44,10.8.0.236,10.8.1.75,10.8.1.6,10.8.1.59,10.8.1.169,10.8.1.42,10.7.0.162,10.8.1.118,10.8.0.218,10.8.0.253,10.8.1.105,10.8.1.206,10.8.1.69,10.8.1.93,10.8.1.99,10.5.0.196,10.5.0.114,10.5.0.155,10.5.0.116,10.5.0.118,10.5.0.115,10.5.0.138,10.5.0.145,10.5.0.156,10.5.0.142,10.5.0.147,10.5.0.158,10.5.0.110,10.5.0.180,10.5.0.136,10.5.0.151,10.5.0.193,10.5.0.120,10.5.0.161,10.5.0.121,10.5.0.153,10.5.0.149,10.5.0.139,10.5.0.148,10.5.0.144,10.5.0.150,10.5.0.108,10.5.0.140,10.5.0.109,10.5.0.143,10.5.0.111,10.5.0.160,10.5.0.159,10.5.0.127,10.5.0.125,10.5.0.129,10.5.0.163,10.5.0.124,10.8.1.25,10.4.0.253,10.7.0.209,10.8.1.124,10.8.1.103,10.8.1.135,10.8.1.252,10.8.1.151,10.7.0.65,10.8.0.223,10.8.1.71,10.8.1.76,10.7.0.163,10.8.0.32,10.8.1.54,10.8.0.76,10.7.0.235,10.8.1.239,10.8.1.70,10.8.0.1,10.8.0.116,10.8.0.117,10.8.0.105,10.8.0.107,10.8.0.102,10.8.0.108,10.8.0.104,10.8.0.110,10.8.0.115,10.8.0.56,10.8.1.13,10.8.0.210,10.8.1.72,10.7.0.131,10.8.0.241,10.8.1.74,10.8.0.136,10.8.1.9,10.8.1.95,10.8.1.21,10.8.0.77,10.7.0.234,10.8.1.24,10.8.1.29,10.8.1.200,10.8.1.108,10.8.1.8,10.8.1.96,10.8.1.32,10.8.1.196,10.8.1.161,10.6.0.4,10.8.1.57,10.8.1.48,10.8.1.43,10.8.1.134,10.8.1.129,10.8.1.60,10.8.1.66,10.8.1.78,10.8.1.62,10.8.1.132,10.8.1.16,10.7.0.221,10.8.1.114,10.8.0.31,10.8.1.115,10.8.0.235,10.7.0.216,10.8.1.119,10.8.1.41,10.8.0.135,10.8.0.133,10.8.0.131,10.8.0.132,10.8.1.44,10.8.1.35,10.8.1.39,10.8.1.46,10.8.1.40,10.8.1.58,10.8.1.232,10.8.1.20,10.8.1.123,10.8.1.55,10.8.1.56,10.8.1.92,10.8.1.217,10.8.1.64,10.8.1.110,10.8.1.120,10.7.0.237,10.8.0.220,10.8.1.83,10.8.0.234,10.8.1.33,10.8.1.208,10.7.0.239,10.8.1.202,10.8.0.200,10.8.0.47,10.8.0.41,10.8.0.45,10.8.0.43,10.8.0.46,10.8.0.55,10.8.0.53,10.8.0.54,10.8.0.42,10.8.0.52,10.8.0.51,10.8.0.44,10.5.0.157,10.5.0.105,10.5.0.103,10.5.0.146,10.5.0.141,10.5.0.152,10.5.0.102,10.5.0.100,10.5.0.132,10.5.0.130,10.5.0.128,10.5.0.101,10.5.0.164,10.5.0.126,10.5.0.131,10.5.0.106,10.5.0.166,10.5.0.117,10.5.0.112,10.8.1.108,10.8.1.148,10.8.1.15,10.8.0.209,10.8.0.211,10.8.1.82,10.8.0.35,10.8.1.28,10.8.1.85,10.8.1.94,10.8.1.37,10.8.1.175,10.8.0.24,10.8.0.74,10.8.0.59,10.8.1.2,10.8.0.62,10.8.0.237,10.8.1.107,10.8.1.65,10.8.1.53,10.8.1.203,10.8.1.45,10.8.1.73,10.8.1.236,10.8.1.122,10.8.1.222,10.8.1.23,10.8.1.145,10.8.1.112,10.8.1.7,10.8.1.192,10.8.1.109,10.8.1.51,10.7.0.233,10.7.0.87,10.8.1.235,10.8.1.133,10.8.1.199,10.8.1.88,10.8.1.26,10.8.1.14,10.8.1.79,10.8.0.216,10.8.1.68,10.8.1.98 15:52:30 [Plugins] Convert to Base64: False 15:52:30 [Plugins] The parameter "name":"ips" will multiply the timeout 307 times. Total timeout: 6140s 15:52:30 [Plugins] Timeout: 6140 15:52:30 [Plugin utils] Pre-Resolved CMD: python3/app/front/plugins/avahi_scan/avahi_scan.py 15:52:30 [Plugins] Executing: python3 /app/front/plugins/avahi_scan/avahi_scan.py 15:52:30 [Plugins] Resolved : ['python3', '/app/front/plugins/avahi_scan/avahi_scan.py'] 15:52:32 [AVAHISCAN] In script 15:52:32 [Database] Opening DB 15:52:32 [AVAHISCAN] Unknown devices count: 15 15:52:32 [AVAHISCAN] Attempt 1 - Ensuring D-Bus and Avahi daemon are running... 15:52:32 [AVAHISCAN] Avahi Daemon is already running. 15:52:32 [AVAHISCAN] DEBUG CMD :['avahi-resolve', '-a', '10.8.1.5'] 15:52:37 [AVAHISCAN] DEBUG OUTPUT : Failed to resolve address '10.8.1.5': Timeout reached

15:52:37 [AVAHISCAN] Domain Name: to 15:52:37 [AVAHISCAN] DEBUG CMD :['avahi-resolve', '-a', '10.8.1.57'] 15:52:42 [AVAHISCAN] DEBUG OUTPUT : Failed to resolve address '10.8.1.57': Timeout reached

15:52:42 [AVAHISCAN] Domain Name: to 15:52:42 [AVAHISCAN] DEBUG CMD :['avahi-resolve', '-a', '10.8.1.30'] 15:52:47 [AVAHISCAN] DEBUG OUTPUT : Failed to resolve address '10.8.1.30': Timeout reached

15:52:47 [AVAHISCAN] Domain Name: to 15:52:47 [AVAHISCAN] DEBUG CMD :['avahi-resolve', '-a', '10.8.1.14'] 15:52:52 [AVAHISCAN] DEBUG OUTPUT : Failed to resolve address '10.8.1.14': Timeout reached

15:52:52 [AVAHISCAN] Domain Name: to 15:52:52 [AVAHISCAN] DEBUG CMD :['avahi-resolve', '-a', '10.8.1.6'] `

Debug enabled

stanelie commented 6 days ago

Here is a visual of the bug while it is happening. All the devices seen marked down are actually up : Screen Shot 2024-10-13 at 3 13 13 PM

jokob-sk commented 5 days ago

Hi @stanelie,

Can you please provide docker logs as something might be restarting the backend server process and those exceptions are not captured in the app.log.

Please check e.g. Portainer to get a better debug output.

Alternatively you can try to call individual plugins (just copy the command (CMD) from settings for the given plugin and run it in the container. This might show an error that is otherwise hidden.

I also assume this is a backend issue and not only a front end / display issue.

Thanks, J

stanelie commented 5 days ago

I think I know what's going on :

Those devices that are marked offline when they are not are all devices that have static IP's assigned manually, but they also have been assigned a static lease on the Mikrotik router DHCP server (in case they lose their static config, to prevent them from wandering). Since they are manually static addresses, they do not pull their IP from the Mikrotik DHCP server, so, the DHCP server thinks theese adresses are not bound.

Am I mistaken in thinking that NetAlertX only marks hosts as Online if their Mikrotik DHCP server addresses are in a "bound" state?

So, whenever the Mikrotik plugin runs, it thinks these devices are offline, and they are marked as such in NetAlertX. Then, when regular scanning cycles a few minutes later, they are marked as Online again.

I think they should be marked offline only if both regular scans AND plugin scans mark the device as offline.. This would fix the issue I am seeing now.

jokob-sk commented 4 days ago

Do you have different scan cycles set for these scans? The documentation suggests to use same scan intervals for all enabled scanners (see first screenshot here):

https://github.com/jokob-sk/NetAlertX/blob/main/docs/NOTIFICATIONS.md

All scanners are treated as plugins, be it import based ones or on-network scanners. If multiple scanners run at the same interval (same cycle) and the device is detected in any scanner, it will be marked as online.

stanelie commented 4 days ago

Hum... I just looked and all the scanners are on the same schedule (/5 *)

Side note : if there is a possibility that setting the scan time differently on the scanners can mess things up, would it be a good idea to have a global timer for all the scanners?

stanelie commented 4 days ago

Update : After making sure all the scanners were on the same schedule, I've adjusted all of the "other scanners" (avahiscan, nbtscan, nslookup, pholuls) to be "on_new_device", and I do not experience the "dropouts" I was experiencing anymore. So, you are correct, it appears to be a timing issue between some plugins.

Edit : I spoke too fast. After 2 hours without issue, I have a dropout right now.

jokob-sk commented 4 days ago

would it be a good idea to have a global timer for all the scanners

That's too difficult to implement right now and would remove the flexibility. So I won't do that for now.

It really sounds like a plugin is failing. Can you please provide the debug log from Docker or Portainer the time when the drop out happens. App.log is insufficient as it cannot capture exceptions.

stanelie commented 4 days ago

I will try to figure out how to do that. Thanks.

stanelie commented 3 days ago

Well, After some messing around with the timings and enabled plugins (or disabled plugins), and even creating a new instance if NetAlertX to test things, I am unable to reproduce the issue.

I think it would be best to close this issue for now. I will reopen it if it happens again, or if I find out how to make the issue reappear.

Thanks!

jokob-sk commented 3 days ago

Hi @stanelie,

Great to hear that.

Thanks for the ongoing help!