Need help on pooling devices

[kris969]

Hi jokob-sk,

As you know, I have several NetAlertX instances to manage several VLANs on several sites. I'm actually using the latest production version:

Everything is working fine, except for one instance on witch I have a status flapping, as represent on this screen copy:

On this node I have 9 devices and only 2 of them are always up.
In fact all devices are present and should be UP.

The configuration must be the same than for the other instances, in fact no because something going wrong, but I made several check and I haven't located the reason why!
The plugins are configured this way:

• ARPSCAN: schedule
• AVAHISCAN: before_names_update
• NSLOOKUP: before_names_update
• ICMP: just focusing on an IP address, is set to After_Scanning, I tried schedule with same timing as ARPSCAN but result was the same.

What's, for you, the first things to check and/or more often default?
Do I need to start with a fresh BD configuration, or something similar?

Thanks a lot for your help ;)

[jokob-sk]

Hi @kris969,

Try to use the same schedule with an increased delay, e.g once every 5 min on all scanners.

Can you please send me a screenshot of the settings of every enabled scanner and ICMP if this doesn't work.

Thanks,
J

[kris969]

Hi jokob-sk,

I'm already using such parameters, and these are, a priori, the same on each instance, only one give troubles ;(
I have to spent time to check every configuration and to try to understand where the problem is coming from.
I will continue on tomorrow, as we say here: "la nuit porte conseil" ;)

[jokob-sk]

:)

…

On Fri, 10 Jan 2025, 08:19 kris969, ***@***.***> wrote: Hi jokob-sk <https://github.com/jokob-sk>, I'm already using such parameters, and these are, *a priori*, the same on each instance, only one give troubles ;( I have to spent time to check every configuration and to try to understand where the problem is coming from. I will continue on tomorrow, as we say here: "la nuit porte conseil" ;) — Reply to this email directly, view it on GitHub <#948 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AW5URDBY4DHIV3SFZ4PJAST2J3RVFAVCNFSM6AAAAABU4TGRZGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCNZZGEZTGMI> . You are receiving this because you commented.Message ID: ***@***.***>

[kris969]

Hi jokob-sk,

When I'm looking one of devices in trouble, let's say the OpenWrt router I notice the following log for each plugin used:

Here the status seems to be OK

What's the meaning of the status "?" here

What's the meaning of the status "?" here

Here the status seems to be OK

I was thinking log must be filtered to the current device only, it seems not to be the case.

To conclude this post, it's not easy to understand witch plugin is used to value the device status.

Thanks

[jokob-sk]

Hi,

You can find the meaning of the question mark by hovering on it - it says missing-in-last-scan which is hopefully clear. More documentation can be found here: https://github.com/jokob-sk/NetAlertX/blob/main/docs/PLUGINS_DEV.md#supported-settings-function-values

Not all logs are filtered by current device, only those where it makes sense. The plugin has to contain the mac in the Object_PrimaryID field and have the filter turned on: https://github.com/jokob-sk/NetAlertX/blob/main/docs/PLUGINS_DEV.md#-filters

Hope this helps,
j

[kris969]

Hi jokob-sk,

I said the setting was the same, I was wrong.
For testing purpose I have deactivated the Internet Check plugin.
Activating it back seems to give immediately a better behavior:

But it was not stable later.
So something is still bizarre, I continue on my side to locate what's the problem coming from.

Thanks

[jokob-sk]

Hi,

Please share a screenshot of your settings of all enabled scanners when the issue occurs so I can help.

Thanks,
j

[kris969]

jokob-sk,

For sure I will.

On my testing instance, I'm currently coming back to a normal situation.
I let the system running, to be sure it is stable.

I will tweak it again as before around Internet Check and will see if I drop down in the same case.
if so, I will produce the requested screenshots.
I will return back to you in a couple of hours.

[kris969]

Hi jokob-sk,

I made test with:

I started with a fresh install with the following parameter in my docker-compose:
ALWAYS_FRESH_INSTALL: true

I only modify the setting to define network to scan: 10.2.5.0/24 --interface=eth0 and then let it run a while.

10 devices were discovered and relative status were stable up during one hour.

I disable the Internet Check plugin, then stay waiting…
The virtual device Internet becomes red Down, that’s confirm the Internet Check is disabled:

9 other devices are still UP at each pooling.
I notice a problem relative to chart status:

I was expected One down and none offline, because:

• if down, of course it is offline
• with such a display, it lets say there is one more count device than reality.

I remove the Internet device and unload the Internet Check plugin.
At this step trying to display network chart was impossible, that’s seems normal as no root device is now present.

I create device lp-freebox-505 with a dummy MAC and the real IP and network node to none.
Doing this I witness for the first time the DUMMY source plugin :)
All devices are still UP except the last device created in offline state (grey color)

For the lp-freebox-505 device, I change setting to activate : Alert Event + Alert Down
I notice a problem : For a total of 10 devices, with 9 UP the chart represent one DOWN + one OFFLINE, I was expecting only one wih status down (orange color) and none with grey color.

I loaded the ICMP plugin and set it in schedule mode looking for the lp-freebox-505 IP address
It was impossible to have the plugin running displayed on screen:

but checking in log debug it was running:

14:05:13 [Scheduler] run for ICMP: YES
14:05:13 [Plugin utils] display_name: ICMP (Status check)
14:05:13 [Plugins] Executing: python3 /app/front/plugins/icmp_scan/icmp.py
14:05:14 [ICMP] In script
14:05:14 [ICMP] Devices to PING: 1
14:05:14 [ICMP] In script
14:05:14 [ICMP] Devices to PING: 1
14:05:15 [ICMP] DEBUG OUTPUT : PING 192.168.2.1 (192.168.2.1): 56 data bytes
14:05:15 [ICMP] ip: "192.168.2.1" is_online: "True"
14:05:15 [ICMP] Script finished
14:05:15 [Plugins] Processed and deleted file: /app/log/plugins/last_result.ICMP.log 
14:05:15     ICMP: 1

lp-freebox-505 status becomes UP:

Except a status drop at 14:04, it seems to be working as expected:

ICMP is still not diplayed as loaded:

Conclusion :
I witness two problems (are they issues??) on status pooling, but the software seems to be running as expected.
On my production instance, I install it again from a fresh configuration, no problem are remaining up to now.

I can on demand produce setting screenshots, but I’m with all parameters as default, consequence of having started with ALWAYS_FRESH_INSTALL parameter

Enjoy :)

[jokob-sk]

Hi @kris969 ,

Thanks a lot for the details.

Seems like the app is working as expected except of this blip:

Unfortunately the above log info is insufficient to determine the cause of the issue.

If this keeps happening try switching to LOG_LEVEL debug ( or trace) and capture everything what's happening during that period. I would need then the output of the app.log file. See what kind of debug output I would require: https://github.com/jokob-sk/NetAlertX/blob/main/docs/DEBUG_PLUGINS.md#sharing-application-state

Careful, the log files can get very big with the trace setting, so maybe use the debug setting first.

ICMP is still not diplayed as loaded:

This is probably caching related, refreshing the page/cache should fix this.

[kris969]

Hi jokob-sk,

Thanks for your reply 👍

The blip (as you said) appear only once, until this period of time everything is nominal:

I was looking in the log only to check if ICMP plugin was running, nor to understand anything else.

I spent one week, with your help, to understand how NetAlertX and how I can use it over my complex system deployed other several sites and using VLANs. Thanks again for your support :)
It tried to give you my feedback. Base on this, you have fixed some issues and added some new features that could be useful for other users.

The result is: it works fine right now!
You have done a really good job 🥇
I like very much this approach. Of course it needs to take time to understand the software "philosophy" before being able to use it in the best manner. I don't pretend having understood all the stuff, but I am aware of the essential I need.

My networks are designed to be as secure as possible. But in this domain, of course, nothing is neither a certitude, that's the baseline. NetAlertX is an add-on that gives me the possible to check if an unknown device appears.

What will be for me the next steps?:

• NetAlertX is deployed on my production system.
• I still keep a set of instances for test purpose, I'll be able to activate it on demand.
• I will have a look on new features, not done up to now.
• I will continue to request for your help to understand some details.
• I will update the software when new versions will be available and give you my feed back if I see something to talk about.

have a good day
many Thanks :)

[jokob-sk]

Hi @kris969 ,

Glad to hear things are stable now :)

Feel free to support me by sharing the app on socials :)

Have a great day,
j