Reopening #1218 Hung "Refreshing" whilst spamming query_logs.php

[arnonm]

What installation are you running?

Production (netalertx) 📦

Is there an existing issue for this?

• I have searched the existing open and closed issues and I checked the docs https://docs.netalertx.com/

The issue occurs in the following browsers. Select at least 2.

• Firefox
• Chrome
• Edge
• Safari (unsupported) - PRs welcome
• N/A - This is an issue with the backend

Current Behavior

I also see the same with every refresh:
browser traffic on a loop on http://xxxxx:20211/php/server/query_logs.php?file=execution_queue.log&nocache=1774355643083
Can reproduce this equally on Chrome/Edge or Fox

Latest version
Linux on docker
app.log:

14:35:51 [HTTP] GET /messaging/in-app/unread from 127.0.0.1
14:35:51 [HTTP] Headers: {'Host': 'xxxx', 'X-Real-Ip': '192.168.1.109', 'X-Forwarded-For': '192.168.1.109', 'X-Forwarded-Proto': 'http', 'X-Requested-With': 'XMLHttpRequest', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0', 'Accept': '*/*', 'Dnt': '1', 'Referer': 'http://xxxx:20211/devices.php', 'Accept-Encoding': 'gzip, deflate', 'Accept-Language': 'en-US,en;q=0.9,he;q=0.8,en-GB;q=0.7'}
127.0.0.1 - - [24/Mar/2026 14:35:51] "GET /messaging/in-app/unread HTTP/1.1" 200 -
14:36:01 [HTTP] GET /messaging/in-app/unread from 127.0.0.1
14:36:01 [HTTP] Headers: {'Host': 'xxx', 'X-Real-Ip': '192.168.1.109', 'X-Forwarded-For': '192.168.1.109', 'X-Forwarded-Proto': 'http', 'X-Requested-With': 'XMLHttpRequest', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0', 'Accept': '*/*', 'Dnt': '1', 'Referer': 'http://xxx:20211/devices.php', 'Accept-Encoding': 'gzip, deflate', 'Accept-Language': 'en-US,en;q=0.9,he;q=0.8,en-GB;q=0.7'}
127.0.0.1 - - [24/Mar/2026 14:36:01] "GET /messaging/in-app/unread HTTP/1.1" 200 -
14:36:11 [HTTP] GET /messaging/in-app/unread from 127.0.0.1
14:36:11 [HTTP] Headers: {'Host': 'xxxx', 'X-Real-Ip': '192.168.1.109', 'X-Forwarded-For': '192.168.1.109', 'X-Forwarded-Proto': 'http', 'X-Requested-With': 'XMLHttpRequest', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0', 'Accept': '*/*', 'Dnt': '1', 'Referer': 'http://xxxx:20211/devices.php', 'Accept-Encoding': 'gzip, deflate', 'Accept-Language': 'en-US,en;q=0.9,he;q=0.8,en-GB;q=0.7'}
127.0.0.1 - - [24/Mar/2026 14:36:11] "GET /messaging/in-app/unread HTTP/1.1" 200 -

I do have a few subnets:

SCAN_SUBNETS=['192.168.1.0/24 --interface=bond0','--interface=br-9b9885c8ea82 172.20.0.0/16','--interface=br-3f357237cf47 172.21.0.0/16','--interface=br-64d833e447f0  172.33.10.0/24','172.22.0.0/16 --interface=br-68805bd734bf','172.23.0.0/16 --interface=br-6ca3abcee400','172.26.0.0/16 --interface=br-decb9fa74e08','192.168.16.0/20 --interface=br-c3f7fcff681c','192.168.32.0/20 --interface=br-7a63b6b34720']

Docker compose:

services:
  netalertx:
  #use an environmental variable to set host networking mode if needed
    container_name: netalertx                       # The name when you docker contiainer ls
    image: ghcr.io/jokob-sk/netalertx:latest
    network_mode: ${NETALERTX_NETWORK_MODE:-host}   # Use host networking for ARP scanning and other services

    read_only: true                                 # Make the container filesystem read-only
    cap_add:                                        # Add only the necessary capabilities
      - NET_ADMIN                                   # Required for ARP scanning
      - NET_RAW                                     # Required for raw socket operations
      - NET_BIND_SERVICE                            # Required to bind to privileged ports (nbtscan)

    volumes:
      - ${DOCKER_DIR}/data/config:/data/config:rw # containsdb and config
      - ${DOCKER_DIR}/data/db:/data/db:rw # containsdb and config
      - /etc/localtime:/etc/localtime:ro
tmpfs:
      # Comment out to retain logs between container restarts - this has a server performance impact.
      # - "/tmp:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"
      - "/tmp:uid=1000,gid=1000,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"
      # Retain logs - comment out tmpfs /tmp if you want to retain logs between container restarts
      # Please note if you remove the /tmp mount, you must create and maintain sub-folder mounts.
      #- /opt/local/network_docs/netalertx/log:/tmp/log
      # - "/tmp/api:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"
      # - "/tmp/nginx:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"
      # - "/tmp/run:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"


    environment:
      LISTEN_ADDR: ${LISTEN_ADDR:-0.0.0.0}                   # Listen for connections on all interfaces
      PORT: ${PORT:-20211}                                   # Application port
      TZ: ${TZ}
      PUID: 1000
      GUID: 1000
       #    GRAPHQL_PORT: ${GRAPHQL_PORT:-20212}                   # GraphQL API port (passed into APP_CONF_OVERRIDE at runtime)
       #    NETALERTX_DEBUG: ${NETALERTX_DEBUG:-0}                 # 0=kill all services and restart if any dies. 1 keeps running dead services.

    # Resource limits to prevent resource exhaustion
    mem_limit: 4096m            # Maximum memory usage
    mem_reservation: 1024m      # Soft memory limit
    #cpu_shares: 512             # Relative CPU weight for CPU contention scenarios
    pids_limit: 512             # Limit the number of processes/threads to prevent fork bombs
    logging:
      driver: "json-file"       # Use JSON file logging driver
      options:
        max-size: "10m"         # Rotate log files after they reach 10MB
        max-file: "3"           # Keep a maximum of 3 log files

Expected Behavior

Not to happen

Steps To Reproduce

No response

Relevant app.conf settings

docker-compose.yml

Debug or Trace enabled

• I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.

Relevant app.log section

  PASTE LOG HERE. Using the triple backticks preserves format.

Docker Logs

  PASTE DOCKER LOG HERE. Using the triple backticks preserves format.

[jokob-sk]

Hi,

Thanks for the report.

1. Can you please post screenshots of your browser console?
2. Are you using a reverse proxy? If so, can you try to access the app without it?
3. Can you post the NGINX log (found in /tmp/log/nginx-error.log or under Maintenance -> Logs) ?
4. Can you post any php errors (found in /tmp/log/app.php_errors.log or under Maintenance -> Logs)?
5. What version are you using (found under Maintenance or in the footer)?
6. Can you try to adjust this compose section from:

    cap_add:                                        # Add only the necessary capabilities
      - NET_ADMIN                                   # Required for ARP scanning
      - NET_RAW                                     # Required for raw socket operations
      - NET_BIND_SERVICE                            # Required to bind to privileged ports (nbtscan)

to

    cap_add:                                        # Add only the necessary capabilities
      - NET_ADMIN                                   # Required for ARP scanning
      - NET_RAW                                     # Required for raw socket operations
      - NET_BIND_SERVICE                            # Required to bind to privileged ports (nbtscan)
      - CHOWN                                       # Required for root-entrypoint to chown /data + /tmp before dropping privileges
      - SETUID                                      # Required for root-entrypoint to switch to non-root user
      - SETGID                                      # Required for root-entrypoint to switch to non-root group