Bug #11366
closed
Arpwatch Cron Notification every 15 minutes
Added by Abdul Khaliq over 3 years ago.
Updated over 2 years ago.
Affected Version:
2.4.5-p1
Affected Architecture:
amd64
Description
Every 15 mins or so I receive an email containing :
Subject Arpwatch Notification : Cron <root@firewall> /etc/rc.filter_configure_sync
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>
0 addresses deleted.
In arpwatch settings everything is ticked
arpwatch 0.2.0_4
Once I remove the package I stop receiving the emails.
- Status changed from New to Rejected
You need to check "Disable Cron emails" option
see #10771
Viktor Gurov wrote:
You need to check "Disable Cron emails" option
see #10771
Option is already checked, I've also tried unchecking it but still same problem.
Abdul Khaliq wrote:
Viktor Gurov wrote:
You need to check "Disable Cron emails" option
see #10771
Option is already checked, I've also tried unchecking it but still same problem.
I also have this same issue. Started happening a few days ago after I changed some firewall rules and hit apply.
I'm also on the same version too.
I have 2 pfSense machines in a HA cluster and I also started getting the emails from the secondary pfSense machine at hte same time too.
So this clearly had something to do with adding the extra firewall rules.
I ended up removing arpwatch off the secondary firewall and that stopped the emails I was getting.
The only thing I haven't done is try rebooting to see if that clears this issue.
I did try disabling arpwatch and re-enabling it again. That didn;t solve the problem.
And i've also tried reinstalling arpwatch too, and that also didn;t make a difference.
Adam French wrote:
Abdul Khaliq wrote:
Viktor Gurov wrote:
You need to check "Disable Cron emails" option
see #10771
Option is already checked, I've also tried unchecking it but still same problem.
I also have this same issue. Started happening a few days ago after I changed some firewall rules and hit apply.
I'm also on the same version too.
I have 2 pfSense machines in a HA cluster and I also started getting the emails from the secondary pfSense machine at hte same time too.
So this clearly had something to do with adding the extra firewall rules.
I ended up removing arpwatch off the secondary firewall and that stopped the emails I was getting.
The only thing I haven't done is try rebooting to see if that clears this issue.
I rebooted my system, then installed and rebooted again but that didn't help. I also have 2.5.0RC installed and it does it on that as well.
I found the bug in arpwatch.
The bug is in the file: /usr/local/arpwatch/sendmail_proxy.php
In the statement:
...
if ((false !== $message) && ((false === strpos($message, ': Cron ')) ||
($config['installedpackages']['arpwatch']['config'][0]['cron_disable'] != 'on'))) {
...
The key at 'cron_disable' is incorrect. The correct value should be, 'disable_cron'
The global_config shows 'disable_cron' as the correct key name.
I've tested it and I no longer get a useless email every time my Suricata cron script runs daily.
Thanks, your fix seems to have done the job, I haven't received any useless emails so far.
Edward Thomas wrote:
I found the bug in arpwatch.
The bug is in the file: /usr/local/arpwatch/sendmail_proxy.php
In the statement:
...
if ((false !== $message) && ((false === strpos($message, ': Cron ')) ||
($config['installedpackages']['arpwatch']['config'][0]['cron_disable'] != 'on'))) {
...
The key at 'cron_disable' is incorrect. The correct value should be, 'disable_cron'
The global_config shows 'disable_cron' as the correct key name.
I've tested it and I no longer get a useless email every time my Suricata cron script runs daily.
- Status changed from Rejected to New
- Status changed from New to Pull Request Review
Just checking on the status of this. I updated to the latest version of pfSense, 2.5.1-RELEASE (amd64), and it reverted to the incorrect 'sendmail_proxy.php' file. I had to re-apply the fix.
Will this fix eventually make it to production?
Thank you.
- Status changed from Pull Request Review to Feedback
- Assignee set to Viktor Gurov
PR has been merged. Thanks!
I've checked on 2.5.2 and I see correct value 'disable cron' in /usr/local/arpwatch/sendmail_proxy.php
if ((false !== $message) && ((false === strpos($message, ': Cron ')) ||
($config['installedpackages']['arpwatch']['config'][0]['disable_cron'] != 'on')))
- Status changed from Feedback to Resolved
Also available in: Atom
PDF