netalertx does not recognize device offline

[SH2609]

What installation are you running? v26.2.4

Production (netalertx) 📦

Is there an existing issue for this?

• I have searched the existing open and closed issues and I checked the docs https://docs.netalertx.com/

The issue occurs in the following browsers. Select at least 2.

• Firefox
• Chrome
• Edge
• Safari (unsupported) - PRs welcome
• N/A - This is an issue with the backend

Current Behavior

devices not shown as offline when the offline from internet devices shown always as online

Expected Behavior

devices should show offline when they offline from internet

Steps To Reproduce

No response

Relevant app.conf settings

docker-compose.yml

network_mode: host

mem_limit: 4g
cpu_shares: 768

restart: on-failure:5

healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:17811/"]
interval: 30s
timeout: 10s
retries: 3

security_opt:

• no-new-privileges:true

cap_drop:

• ALL

cap_add:

• NET_RAW
• NET_ADMIN
• NET_BIND_SERVICE
• CHOWN
• SETUID
• SETGID

volumes:

• /volume1/docker/netalertx/data:/data:rw
• /etc/localtime:/etc/localtime:ro

tmpfs:

• /tmp:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime

environment:
PORT: 17811
PUID: 0
PGID: 100

### Debug or Trace enabled

- [x] I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.

### Relevant `app.log` section

PASTE LOG HERE. Using the triple backticks preserves format.

### Docker Logs
ℹ️  Running as root (PUID=0). Paths will be owned by root.
ℹ️  NetAlertX startup: Running privilege check and path priming as ROOT.
    (On modern systems, privileges will be dropped to PUID after setup)
ℹ️  Running as root (PUID=0). Paths will be owned by root.
 _   _      _    ___  _           _  __   __
| \ | |    | |  / _ \| |         | | \ \ / /
|  \| | ___| |_/ /_\ \ | ___ _ __| |_ \ V /
| .   |/ _ \ __|  _  | |/ _ \  __| __|/   \
| |\  |  __/ |_| | | | |  __/ |  | |_/ /^\ \
\_| \_/\___|\__\_| |_/_|\___|_|   \__\/   \/
   Network intruder and presence detector.
   https://netalertx.com
Startup pre-checks
--> data migration.sh 
--> capabilities audit.sh 
--> mounts.py 
 Path                     | R | W | Mount | RAMDisk | Performance | DataLoss 
--------------------------+---+---+-------+---------+-------------+----------
--> first run config.sh 
--> first run db.sh 
--> mandatory folders.sh 
    * Creating DB locked log.
    * Creating Execution queue log.
--> apply conf override.sh 
--> writable config.sh 
--> nginx config.sh 
--> expected user id match.sh 
--> host mode network.sh 
 /data                    | ✅| ✅|   ✅  |    ➖   |      ➖     |    ✅     
 /data/db                 | ✅| ✅|   ✅  |    ➖   |      ➖     |    ✅     
 /data/config             | ✅| ✅|   ✅  |    ➖   |      ➖     |    ✅     
 /tmp/run/tmp             | ✅| ✅|   ✅  |    ✅   |      ✅     |    ✅     
 /tmp/api                 | ✅| ✅|   ✅  |    ✅   |      ✅     |    ✅     
 /tmp/log                 | ✅| ✅|   ✅  |    ✅   |      ✅     |    ✅     
 /tmp/run                 | ✅| ✅|   ✅  |    ✅   |      ✅     |    ✅     
 /tmp/nginx/active-config | ✅| ✅|   ✅  |    ✅   |      ✅     |    ✅     
--> excessive capabilities.sh 
--> appliance integrity.sh 
--> ports available.sh 
Starting /usr/sbin/php-fpm83 -y "/services/config/php/php-fpm.conf" -F (tee stderr to app.php_errors.log)
Starting supercronic --quiet "/services/config/cron/crontab" >>"/tmp/log/cron.log" 2>&1 &
Starting python3  -m server > /tmp/log/stdout.log 2> >(tee /tmp/log/stderr.log >&2)
Starting /usr/sbin/nginx -p "/tmp/run/" -c "/tmp/nginx/active-config/nginx.conf" -g "error_log stderr; error_log /tmp/log/nginx-error.log; daemon off;" &
Successfully updated IEEE OUI database (112941 entries)
ℹ️  Running as root (PUID=0). Paths will be owned by root.
ℹ️  NetAlertX startup: Running privilege check and path priming as ROOT.
    (On modern systems, privileges will be dropped to PUID after setup)
ℹ️  Running as root (PUID=0). Paths will be owned by root.
 _   _      _    ___  _           _  __   __
| \ | |    | |  / _ \| |         | | \ \ / /
|  \| | ___| |_/ /_\ \ | ___ _ __| |_ \ V /
| .   |/ _ \ __|  _  | |/ _ \  __| __|/   \
| |\  |  __/ |_| | | | |  __/ |  | |_/ /^\ \
\_| \_/\___|\__\_| |_/_|\___|_|   \__\/   \/
   Network intruder and presence detector.
   https://netalertx.com
Startup pre-checks
--> data migration.sh 
--> capabilities audit.sh 
--> mounts.py 
 Path                     | R | W | Mount | RAMDisk | Performance | DataLoss 
--------------------------+---+---+-------+---------+-------------+----------
 /data                    | ✅| ✅|   ✅  |    ➖   |      ➖     |    ✅     
 /data/db                 | ✅| ✅|   ✅  |    ➖   |      ➖     |    ✅     
 /data/config             | ✅| ✅|   ✅  |    ➖   |      ➖     |    ✅     
 /tmp/run/tmp             | ✅| ✅|   ✅  |    ✅   |      ✅     |    ✅     
 /tmp/api                 | ✅| ✅|   ✅  |    ✅   |      ✅     |    ✅     
 /tmp/log                 | ✅| ✅|   ✅  |    ✅   |      ✅     |    ✅     
 /tmp/run                 | ✅| ✅|   ✅  |    ✅   |      ✅     |    ✅     
 /tmp/nginx/active-config | ✅| ✅|   ✅  |    ✅   |      ✅     |    ✅     
--> first run config.sh 
--> first run db.sh 
--> mandatory folders.sh 
    * Creating DB locked log.
    * Creating Execution queue log.
--> apply conf override.sh 
--> writable config.sh 
--> nginx config.sh 
--> expected user id match.sh 
--> host mode network.sh 
--> excessive capabilities.sh 
--> appliance integrity.sh 
--> ports available.sh 
Starting supercronic --quiet "/services/config/cron/crontab" >>"/tmp/log/cron.log" 2>&1 &
Starting /usr/sbin/php-fpm83 -y "/services/config/php/php-fpm.conf" -F (tee stderr to app.php_errors.log)
Starting python3  -m server > /tmp/log/stdout.log 2> >(tee /tmp/log/stderr.log >&2)
Starting /usr/sbin/nginx -p "/tmp/run/" -c "/tmp/nginx/active-config/nginx.conf" -g "error_log stderr; error_log /tmp/log/nginx-error.log; daemon off;" &
Successfully updated IEEE OUI database (112941 entries)
2026/02/05 15:45:24 [error] 246#246: *2074 open() "/app/front/favicon.ico" failed (2: No such file or directory), client: 192.168.178.10, server: , request: "GET /favicon.ico HTTP/1.1", host: "192.168.178.6:17811", referrer: "http://192.168.178.6:17811/php/server/query_logs.php?file=app.log"

PASTE DOCKER LOG HERE. Using the triple backticks preserves format.

[SH2609]

all values and settings seems ok, this is since installing of version v26.2.4

[SH2609]

[jokob-sk]

HI,

Please supply:

1. Mac of device which should be marked offline
2. Necessary backend logs with the logs showing the above device is offline
3. The logs for the plugin which should have detected the device online (e.g. ARPSCAN): https://docs.netalertx.com/DEBUG_PLUGINS/?h=plugin+debug
4. The screenshot of the enabled plugins settings

Thanks,
j

[SH2609]

The necessary backend logs, including those showing the device mentioned above, are offline -> where can I find these logs?

[jokob-sk]

Question - did you read this? https://docs.netalertx.com/DEBUG_PLUGINS/?h=plugin+debug

[SH2609]

Yes i read this....try to follow that, but now i have go to work
Guess that issue concern not only that two smartphone guess it concern all devices......but i can´t make all offline
I not understand why online got recognized but offline not

[SH2609]

I will add in subnet Scan wlan0, Maybe that will help
I will Not Go too Deep into Programming area of netalertx then Maybe it will destroy all

[jokob-sk]

I think I've found the issue.

This should be available in the next release. It would be great if you could test this. Can you please switch to the netalertx-dev docker image (backup everything at first or, ideally, spin up a separate container with a separate db and config as DB modifications can happen), in about 15 minutes (or after the latest action finishes) from now?

Make sure you refresh your browser cache - and click the 🔄 refresh button in the top right corner.

Disclaimer:
Running on the dev container long term might lead to data loss as upgrade path is not guaranteed.

Thanks in advance,
j

[SH2609]

Im Sorry can‘t do that now or in the next 15 minutes because I work nightshift at Moment. Where I can find that netalert-dev docker Image? Will do that at afternoon. I live in germany

[jokob-sk]

https://github.com/orgs/netalertx/packages?repo_name=NetAlertX