Project

General

Profile

Bug #11366

Arpwatch Cron Notification every 15 minutes

Added by Abdul Khaliq 3 months ago. Updated about 2 months ago.

Status:
Pull Request Review
Priority:
Normal
Assignee:
-
Category:
arpwatch
Target version:
-
Start date:
02/03/2021
Due date:
% Done:

0%

Estimated time:
Affected Version:
2.4.5-p1
Affected Architecture:
amd64

Description

Every 15 mins or so I receive an email containing :

Subject Arpwatch Notification : Cron <root@firewall> /etc/rc.filter_configure_sync

X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>

0 addresses deleted.

In arpwatch settings everything is ticked

arpwatch 0.2.0_4

Once I remove the package I stop receiving the emails.

History

#1 Updated by Viktor Gurov 3 months ago

  • Status changed from New to Rejected

You need to check "Disable Cron emails" option
see #10771

#2 Updated by Abdul Khaliq 3 months ago

Viktor Gurov wrote:

You need to check "Disable Cron emails" option
see #10771

Option is already checked, I've also tried unchecking it but still same problem.

#3 Updated by Adam French 3 months ago

Abdul Khaliq wrote:

Viktor Gurov wrote:

You need to check "Disable Cron emails" option
see #10771

Option is already checked, I've also tried unchecking it but still same problem.

I also have this same issue. Started happening a few days ago after I changed some firewall rules and hit apply.
I'm also on the same version too.
I have 2 pfSense machines in a HA cluster and I also started getting the emails from the secondary pfSense machine at hte same time too.
So this clearly had something to do with adding the extra firewall rules.

I ended up removing arpwatch off the secondary firewall and that stopped the emails I was getting.
The only thing I haven't done is try rebooting to see if that clears this issue.
I did try disabling arpwatch and re-enabling it again. That didn;t solve the problem.
And i've also tried reinstalling arpwatch too, and that also didn;t make a difference.

#4 Updated by Abdul Khaliq 3 months ago

Adam French wrote:

Abdul Khaliq wrote:

Viktor Gurov wrote:

You need to check "Disable Cron emails" option
see #10771

Option is already checked, I've also tried unchecking it but still same problem.

I also have this same issue. Started happening a few days ago after I changed some firewall rules and hit apply.
I'm also on the same version too.
I have 2 pfSense machines in a HA cluster and I also started getting the emails from the secondary pfSense machine at hte same time too.
So this clearly had something to do with adding the extra firewall rules.

I ended up removing arpwatch off the secondary firewall and that stopped the emails I was getting.
The only thing I haven't done is try rebooting to see if that clears this issue.

I rebooted my system, then installed and rebooted again but that didn't help. I also have 2.5.0RC installed and it does it on that as well.

#5 Updated by Edward Thomas about 2 months ago

I found the bug in arpwatch.

The bug is in the file: /usr/local/arpwatch/sendmail_proxy.php

In the statement:
...
if ((false !== $message) && ((false === strpos($message, ': Cron ')) ||
($config['installedpackages']['arpwatch']['config'][0]['cron_disable'] != 'on'))) {
...

The key at 'cron_disable' is incorrect. The correct value should be, 'disable_cron'

The global_config shows 'disable_cron' as the correct key name.

I've tested it and I no longer get a useless email every time my Suricata cron script runs daily.

#6 Updated by Abdul Khaliq about 2 months ago

Thanks, your fix seems to have done the job, I haven't received any useless emails so far.

Edward Thomas wrote:

I found the bug in arpwatch.

The bug is in the file: /usr/local/arpwatch/sendmail_proxy.php

In the statement:
...
if ((false !== $message) && ((false === strpos($message, ': Cron ')) ||
($config['installedpackages']['arpwatch']['config'][0]['cron_disable'] != 'on'))) {
...

The key at 'cron_disable' is incorrect. The correct value should be, 'disable_cron'

The global_config shows 'disable_cron' as the correct key name.

I've tested it and I no longer get a useless email every time my Suricata cron script runs daily.

#7 Updated by Jim Pingle about 2 months ago

  • Status changed from Rejected to New

#9 Updated by Jim Pingle about 2 months ago

  • Status changed from New to Pull Request Review

Also available in: Atom PDF