pfSense

We have a CP setup running at a customer's site which uses a central pfSense VM as CP Voucher Sync target for central management/sync of voucher rolls and 3 physical HW machines. Those 3 HW run captive portal for Guest Laptops and WiFi devices. Vouchers are working as they should but after expiration or manual diusconnect of a voucher, there are always 2 UI Alerts that pop up:

Examples:

CP Log:
Jan 22 11:05:10     logportalauth     8654     Zone: cpzone - DISCONNECT: <USER ID>, , <Client IP>

Sys Log:
Jan 22 11:05:10     php-fpm     8654     /status_captiveportal.php: New alert found: Exception calling XMLRPC method exec_php # String could not be parsed as XML
Jan 22 11:05:10     php-fpm     8654     /status_captiveportal.php: Exception calling XMLRPC method exec_php # String could not be parsed as XML
Jan 22 11:05:10     php-fpm     8654     /status_captiveportal.php: Beginning XMLRPC sync data to http://<MGMT VM IP>:8080/xmlrpc.php.
Jan 22 11:05:10     php-fpm     8654     /status_captiveportal.php: New alert found: Exception calling XMLRPC method exec_php # String could not be parsed as XML
Jan 22 11:05:10     php-fpm     8654     /status_captiveportal.php: Exception calling XMLRPC method exec_php # String could not be parsed as XML
Jan 22 11:05:10     php-fpm     8654     /status_captiveportal.php: Beginning XMLRPC sync data to http://<MGMT VM IP>:8080/xmlrpc.php. 

That's from a manual disconnect via UI. Normal Timeouts and housekeeping of the CP also triggers that alerts:

CP Log:
Jan 22 11:07:15     logportalauth     71126     Zone: cpzone - TIMEOUT: ThAQ8T7BQD4, , <Client IP>
Jan 22 11:06:15     logportalauth     40786     Zone: cpzone - TIMEOUT: 6eLAMJTNqBr, , <Client IP>

SysLog:
Jan 22 11:07:15     php-cgi         rc.prunecaptiveportal: New alert found: Exception calling XMLRPC method exec_php # String could not be parsed as XML
Jan 22 11:07:15     php-cgi         rc.prunecaptiveportal: Exception calling XMLRPC method exec_php # String could not be parsed as XML
Jan 22 11:07:15     php-cgi         rc.prunecaptiveportal: Beginning XMLRPC sync data to http://<MGMT VM IP>:8080/xmlrpc.php.
Jan 22 11:07:15     php-cgi         rc.prunecaptiveportal: New alert found: Exception calling XMLRPC method exec_php # String could not be parsed as XML
Jan 22 11:07:15     php-cgi         rc.prunecaptiveportal: Exception calling XMLRPC method exec_php # String could not be parsed as XML
Jan 22 11:07:15     php-cgi         rc.prunecaptiveportal: Beginning XMLRPC sync data to http://<MGMT VM IP>:8080/xmlrpc.php.
Jan 22 11:06:15     php-cgi         rc.prunecaptiveportal: New alert found: Exception calling XMLRPC method exec_php # String could not be parsed as XML
Jan 22 11:06:15     php-cgi         rc.prunecaptiveportal: Exception calling XMLRPC method exec_php # String could not be parsed as XML
Jan 22 11:06:15     php-cgi         rc.prunecaptiveportal: Beginning XMLRPC sync data to http://<MGMT VM IP>:8080/xmlrpc.php.
Jan 22 11:06:15     php-cgi         rc.prunecaptiveportal: New alert found: Exception calling XMLRPC method exec_php # String could not be parsed as XML
Jan 22 11:06:15     php-cgi         rc.prunecaptiveportal: Exception calling XMLRPC method exec_php # String could not be parsed as XML
Jan 22 11:06:15     php-cgi         rc.prunecaptiveportal: Beginning XMLRPC sync data to http://<MGMT VM IP>:8080/xmlrpc.php.

No more information are visible besides the Syslog PHP processes throwing those XMLRPC errors (2 of them) for every Timeout or Disconnect of the CP. As those CP instances are quite busy, the customer setup shows thousands of alerts in the UI on those CP hosts. The mgmt VM shows no errors that we are aware of.

Any hint to why that only happens on those two occasions and what the triggers may be?

Greets