Error regarding ubus
-
Suddenly appearing in the log, flooded with this message. Pfsense version 2.6.0-RELEASE, community edition.
nginx
2023/03/03 11:49:16 [error] 87732#100196: *49892 open() "/usr/local/www/ubus" failed (2: No such file or directory), client: 192.168.100.100, server: , request: "GET /ubus HTTP/1.1", host: "192.168.100.2"
Why is this suddenly appearing, and what does it mean? How can it be fixed?
-
I have the same problem. Fresh install of 2.7.0 CE. I get one of these log entries every 2-12 seconds in the System log. Very annoying bunch of noise. I would love to either correct the issue or tune out this annoyance. I am using Microsoft Edge for the browser in case that is a relevant data point.
-
Those are from a client on your local network requesting that file from the GUI web server on pfSense -- not an error on the firewall itself.
You have some local client/software hitting the gateway looking for that.
So you need to look at whatever the system is making the request (e.g.
192.168.100.100in that log line) and see what it is and what it's doing. It could be benign, it could be some bit of malicious software probing your firewall, hard to say with so little info. -
@jimp -Thanks for responding.
The IP address of the client requesting that URL is my laptop, which I use to manage the firewall. I don't know why any client, including my laptop, would hit the default gateway address unless it was accessing the webui of the firewall. I have tried both Edge and Firefox to access the WebUI and the log errors appear happen with either browser.
-
@Zeldar said in Error regarding ubus:
@jimp -Thanks for responding.
The IP address of the client requesting that URL is my laptop, which I use to manage the firewall. I don't know why any client, including my laptop, would hit the default gateway address unless it was accessing the webui of the firewall. I have tried both Edge and Firefox to access the WebUI and the log errors appear happen with either browser.
It could be a browser plugin, or some kind of virus scanner or similar on your system.
Googling suggests
ubusmight be something from OpenWRT. -
I think I figured it out. I ran TCPView and noticed a process called Killer Intelligence Center that was connecting to my LAN (gateway) IP address. It's a gaming app that tries to optimize WiFi and network performance for gaming. I killed that process and the errors in my System log stopped.
I am trying to find out (on the Intel Support community) if I can change setting(s) in the Killer Intelligence Center to stop it from sending the bogus get requests. I tried turning off various settings / features but nothing stopped the bogus get requests.
In the meantime, I added a custom block rule in the Windows firewall which prevents the app from making outbound get requests. That has stopped the System log filling up with the errors.
-
@Zeldar We believe one of our users is also experiencing the same behavior with their laptop reaching out to the FW and I just verified that the "Killer Performance Driver Suite UWD (3.1222.7103)" and "RivetNetworks.KillerControlCenter (3.1624.1026.0)" applications are installed. In your case, did you keep the driver and remove the intelligence center? or was there only the single app.
