400 Bad Request when connecting to Webui

[Moineau54]

Successfully raise an issue

Before you post your issue make sure it has not been answered yet and provide ⚠️ BASIC SUPPORT INFORMATION (as requested below) if you come to the conclusion it is a new issue.

• 🔍 Use the search function first
• 🧐 Check our Config Examples & Tutorials and the discussions in general.
• 📚 Consult the documentation of 💻 your Linux OS, 🐳 Docker, the 🦌 Elastic stack and the 🍯 T-Pot Readme.
• ⚙️ The Troubleshoot Section of the T-Pot Readme is a good starting point to collect a good set of information for the issue and / or to fix things on your own.
• ⚠️ Provide BASIC SUPPORT INFORMATION or similar detailed information with regard to your issue or we will close the issue or convert it into a discussion without further interaction from the maintainers.
  

⚠️ Basic support information (commands are expected to run as root)

We happily take the time to improve T-Pot and take care of things, but we need you to take the time to create an issue that provides us with all the information we need.

• What OS are you T-Pot running on?
  Debian
• What is the version of the OS lsb_release -a and uname -a?

$ lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 13 (trixie)
Release:        13
Codename:       trixie

$ uname -a
Linux me-standardpc 6.12.100+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.100-1 (2026-07-30) x86_64 GNU/Linux

• What T-Pot version are you currently using (only T-Pot 24.04.x is currently supported)?
  The latest
• What architecture are you running on (i.e. hardware, cloud, VM, etc.)?
  VM (Proxmox server)
• Review the ~/install_tpot.log, attach the log and highlight the errors.

cat install_tpot.log 
2026-08-04 00:33:44,305 p=19445 u=me n=ansible INFO| PLAY [T-Pot - Bootstrapping Python] *******************************************************************************
2026-08-04 00:33:44,314 p=19445 u=me n=ansible INFO| TASK [Get distribution name (All)] ********************************************************************************
2026-08-04 00:33:44,401 p=19445 u=me n=ansible INFO| changed: [127.0.0.1]
2026-08-04 00:33:44,403 p=19445 u=me n=ansible INFO| TASK [Check if python3 is installed (All)] ************************************************************************
2026-08-04 00:33:44,483 p=19445 u=me n=ansible INFO| changed: [127.0.0.1]
2026-08-04 00:33:44,484 p=19445 u=me n=ansible INFO| TASK [Add python package (Debian, Raspbian, Ubuntu)] **************************************************************
2026-08-04 00:33:44,534 p=19445 u=me n=ansible INFO| skipping: [127.0.0.1]
2026-08-04 00:33:44,537 p=19445 u=me n=ansible INFO| PLAY [T-Pot - Abort if run as tpot, root or on unsupported distribution] ******************************************
2026-08-04 00:33:44,542 p=19445 u=me n=ansible INFO| TASK [Gathering Facts] ********************************************************************************************
2026-08-04 00:33:45,549 p=19445 u=me n=ansible WARNING| [WARNING]: Host '127.0.0.1' is using the discovered Python interpreter at '/usr/bin/python3.13', but future installation of another Python interpreter could cause a different interpreter to be discovered. See https://docs.ansible.com/ansible-core/2.19/reference_appendices/interpreter_discovery.html for more information.

2026-08-04 00:33:45,549 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:33:45,552 p=19445 u=me n=ansible INFO| TASK [Check if running as root (All)] *****************************************************************************
2026-08-04 00:33:45,567 p=19445 u=me n=ansible INFO| ok: [127.0.0.1] => {
    "changed": false,
    "msg": "Running as user: me."
}
2026-08-04 00:33:45,570 p=19445 u=me n=ansible INFO| TASK [Check if running as tpot (All)] *****************************************************************************
2026-08-04 00:33:45,585 p=19445 u=me n=ansible INFO| ok: [127.0.0.1] => {
    "changed": false,
    "msg": "Running as user: me."
}
2026-08-04 00:33:45,587 p=19445 u=me n=ansible INFO| TASK [Check if supported distribution (All)] **********************************************************************
2026-08-04 00:33:45,603 p=19445 u=me n=ansible INFO| ok: [127.0.0.1] => {
    "changed": false,
    "msg": "T-Pot will now install on Debian."
}
2026-08-04 00:33:45,606 p=19445 u=me n=ansible INFO| PLAY [T-Pot - Install recommended, remove conflicting packages] ***************************************************
2026-08-04 00:33:45,609 p=19445 u=me n=ansible INFO| TASK [Gathering Facts] ********************************************************************************************
2026-08-04 00:33:46,388 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:33:46,391 p=19445 u=me n=ansible INFO| TASK [Syncing clocks (All)] ***************************************************************************************
2026-08-04 00:33:46,885 p=19445 u=me n=ansible ERROR| [ERROR]: Task failed: Module failed: non-zero return code
Origin: /home/me/tpot.yml:114:7

112
113   tasks:
114     - name: Syncing clocks (All)
          ^ column 7


2026-08-04 00:33:46,886 p=19445 u=me n=ansible INFO| fatal: [127.0.0.1]: FAILED! => {"changed": true, "cmd": "hwclock --hctosys", "delta": "0:00:00.003341", "end": "2026-08-04 00:33:46.853616", "msg": "non-zero return code", "rc": 127, "start": "2026-08-04 00:33:46.850275", "stderr": "/bin/sh: 1: hwclock: not found", "stderr_lines": ["/bin/sh: 1: hwclock: not found"], "stdout": "", "stdout_lines": []}
2026-08-04 00:33:46,886 p=19445 u=me n=ansible INFO| ...ignoring
2026-08-04 00:33:46,906 p=19445 u=me n=ansible INFO| TASK [Install recommended packages (Debian, Raspbian, Ubuntu)] ****************************************************
2026-08-04 00:33:50,588 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:33:50,590 p=19445 u=me n=ansible INFO| PLAY [T-Pot - Prepare for and install Docker Engine] **************************************************************
2026-08-04 00:33:50,594 p=19445 u=me n=ansible INFO| TASK [Gathering Facts] ********************************************************************************************
2026-08-04 00:33:51,391 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:33:51,394 p=19445 u=me n=ansible INFO| TASK [Remove distribution based Docker packages and podman-docker (AlmaLinux, Debian, Fedora, Raspbian, RHEL, Rocky, Ubuntu)] ***
2026-08-04 00:33:54,645 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:33:54,648 p=19445 u=me n=ansible INFO| TASK [Add folder for Docker Engine GPG key (Debian, Raspbian, Ubuntu)] ********************************************
2026-08-04 00:33:55,200 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:33:55,204 p=19445 u=me n=ansible INFO| TASK [Download Docker Engine GPG key (Debian, Raspbian, Ubuntu)] **************************************************
2026-08-04 00:33:55,972 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:33:55,976 p=19445 u=me n=ansible INFO| TASK [Decrypt Docker Engine GPG key (Debian, Raspbian, Ubuntu)] ***************************************************
2026-08-04 00:33:56,307 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:33:56,310 p=19445 u=me n=ansible INFO| TASK [Add Docker Engine repository (Debian, Raspbian, Ubuntu)] ****************************************************
2026-08-04 00:33:56,976 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:33:56,979 p=19445 u=me n=ansible INFO| PLAY [T-Pot - Install Docker Engine] ******************************************************************************
2026-08-04 00:33:56,982 p=19445 u=me n=ansible INFO| TASK [Gathering Facts] ********************************************************************************************
2026-08-04 00:33:57,763 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:33:57,766 p=19445 u=me n=ansible INFO| TASK [Install Docker Engine packages (AlmaLinux, Debian, Fedora, Raspbian, RHEL, Rocky, Ubuntu)] ******************
2026-08-04 00:34:01,359 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:01,363 p=19445 u=me n=ansible INFO| TASK [Stop Docker (All)] ******************************************************************************************
2026-08-04 00:34:02,864 p=19445 u=me n=ansible INFO| changed: [127.0.0.1]
2026-08-04 00:34:02,866 p=19445 u=me n=ansible INFO| PLAY [T-Pot - Adjust configs, add users and groups, etc.] *********************************************************
2026-08-04 00:34:02,871 p=19445 u=me n=ansible INFO| TASK [Gathering Facts] ********************************************************************************************
2026-08-04 00:34:03,650 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:03,653 p=19445 u=me n=ansible INFO| TASK [Create T-Pot group (All)] ***********************************************************************************
2026-08-04 00:34:04,162 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:04,165 p=19445 u=me n=ansible INFO| TASK [Create T-Pot user (All)] ************************************************************************************
2026-08-04 00:34:04,776 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:04,779 p=19445 u=me n=ansible INFO| TASK [Ensure vm.max_map_count is set (All)] ***********************************************************************
2026-08-04 00:34:05,282 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:05,285 p=19445 u=me n=ansible INFO| TASK [Comment out Port(s) in sshd_config, can cause port conflicts on deploy (AlmaLinux, Debian, Fedora, openSUSE Tumbleweed, Raspbian, RHEL, Rocky, Ubuntu)] ***
2026-08-04 00:34:05,776 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:05,779 p=19445 u=me n=ansible INFO| TASK [Change SSH Port to 64295 (AlmaLinux, Debian, Fedora, Raspbian, RHEL, Rocky, Ubuntu)] ************************
2026-08-04 00:34:06,118 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:06,120 p=19445 u=me n=ansible INFO| PLAY [T-Pot - Restart services] ***********************************************************************************
2026-08-04 00:34:06,124 p=19445 u=me n=ansible INFO| TASK [Gathering Facts] ********************************************************************************************
2026-08-04 00:34:06,906 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:06,909 p=19445 u=me n=ansible INFO| TASK [Enable Docker Engine upon boot (All)] ***********************************************************************
2026-08-04 00:34:09,506 p=19445 u=me n=ansible INFO| changed: [127.0.0.1]
2026-08-04 00:34:09,509 p=19445 u=me n=ansible INFO| TASK [Restart SSH (All)] ******************************************************************************************
2026-08-04 00:34:10,095 p=19445 u=me n=ansible INFO| changed: [127.0.0.1]
2026-08-04 00:34:10,097 p=19445 u=me n=ansible INFO| PLAY [T-Pot - Adjust group users, bashrc, clone / update T-Pot repository] ****************************************
2026-08-04 00:34:10,101 p=19445 u=me n=ansible INFO| TASK [Gathering Facts] ********************************************************************************************
2026-08-04 00:34:10,817 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:10,821 p=19445 u=me n=ansible INFO| TASK [Check for non-root user id (All)] ***************************************************************************
2026-08-04 00:34:10,838 p=19445 u=me n=ansible INFO| ok: [127.0.0.1] => {
    "msg": "Detected user: 'me'"
}
2026-08-04 00:34:10,841 p=19445 u=me n=ansible INFO| TASK [Add aliases] ************************************************************************************************
2026-08-04 00:34:11,273 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:11,277 p=19445 u=me n=ansible INFO| TASK [Clone / Update T-Pot repository (All)] **********************************************************************
2026-08-04 00:34:11,749 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:11,752 p=19445 u=me n=ansible INFO| TASK [Add current user to Docker, T-Pot group (All)] **************************************************************
2026-08-04 00:34:12,135 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:12,138 p=19445 u=me n=ansible INFO| PLAY [T-Pot - Install service] ************************************************************************************
2026-08-04 00:34:12,142 p=19445 u=me n=ansible INFO| TASK [Gathering Facts] ********************************************************************************************
2026-08-04 00:34:12,857 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:12,860 p=19445 u=me n=ansible INFO| TASK [Install systemd service (All)] ******************************************************************************
2026-08-04 00:34:13,633 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:13,636 p=19445 u=me n=ansible INFO| PLAY [T-Pot - Setup a randomized daily reboot] ********************************************************************
2026-08-04 00:34:13,641 p=19445 u=me n=ansible INFO| TASK [Gathering Facts] ********************************************************************************************
2026-08-04 00:34:14,419 p=19445 u=me n=ansible INFO| ok: [127.0.0.1]
2026-08-04 00:34:14,421 p=19445 u=me n=ansible INFO| TASK [Setup a randomized daily reboot (All)] **********************************************************************
2026-08-04 00:34:14,977 p=19445 u=me n=ansible INFO| changed: [127.0.0.1]
2026-08-04 00:34:14,978 p=19445 u=me n=ansible INFO| PLAY RECAP ********************************************************************************************************
2026-08-04 00:34:14,979 p=19445 u=me n=ansible INFO| 127.0.0.1                  : ok=36   changed=7    unreachable=0    failed=0    skipped=1    rescued=0    ignored=1   

• How long has your installation been running?
  Its a new install
  • If it is a fresh install consult the documentation first.
    Can't seem to find something in the Documentation
  • Most likely it is a port conflict or a remote dependency was unavailable.
  • Retry a fresh installation and only open the issue if the error keeps coming up and is not resolved using the documentation as described here.
• Did you install upgrades, packages or use the update script?
  no its a fresh install
• Did you modify any scripts or configs? If yes, please attach the changes.
• Please provide a screenshot of htop and docker stats.

• How much free disk space is available (df -h)?

$ df -h
Filesystem      Size  Used Avail Use% Mounted on
udev            7,6G     0  7,6G   0% /dev
tmpfs           1,6G  4,1M  1,6G   1% /run
/dev/sda1       229G   22G  196G  11% /
tmpfs           7,7G     0  7,7G   0% /dev/shm
tmpfs           5,0M     0  5,0M   0% /run/lock
tmpfs           1,0M     0  1,0M   0% /run/credentials/systemd-journald.service
tmpfs           7,7G  4,0K  7,7G   1% /tmp
tmpfs           1,6G   76K  1,6G   1% /run/user/108
tmpfs           1,6G   76K  1,6G   1% /run/user/1000

• What is the current container status (dps)?

$ dps
NAMES                 STATUS                                 PORTS
adbhoney              Up About a minute                      0.0.0.0:5555->5555/tcp, [::]:5555->5555/tcp
ciscoasa              Up About a minute                      0.0.0.0:5000->5000/udp, [::]:5000->5000/udp, 0.0.0.0:8443->8443/tcp, [::]:8443->8443/tcp
conpot_guardian_ast   Up About a minute (health: starting)   0.0.0.0:10001->10001/tcp, [::]:10001->10001/tcp
conpot_iec104         Up About a minute (health: starting)   0.0.0.0:161->161/udp, [::]:161->161/udp, 0.0.0.0:2404->2404/tcp, [::]:2404->2404/tcp
conpot_ipmi           Up About a minute (health: starting)   0.0.0.0:623->623/udp, [::]:623->623/udp
conpot_kamstrup_382   Up About a minute (health: starting)   0.0.0.0:1025->1025/tcp, [::]:1025->1025/tcp, 0.0.0.0:50100->50100/tcp, [::]:50100->50100/tcp
cowrie                Up About a minute                      0.0.0.0:22-23->22-23/tcp, [::]:22-23->22-23/tcp
dicompot              Up About a minute                      0.0.0.0:11112->11112/tcp, [::]:11112->11112/tcp, 0.0.0.0:104->11112/tcp, [::]:104->11112/tcp
dionaea               Up About a minute (health: starting)   0.0.0.0:20-21->20-21/tcp, [::]:20-21->20-21/tcp, 0.0.0.0:42->42/tcp, [::]:42->42/tcp, 0.0.0.0:81->81/tcp, [::]:81->81/tcp, 0.0.0.0:135->135/tcp, [::]:135->135/tcp, 0.0.0.0:445->445/tcp, [::]:445->445/tcp, 0.0.0.0:1433->1433/tcp, [::]:1433->1433/tcp, 0.0.0.0:1723->1723/tcp, [::]:1723->1723/tcp, 0.0.0.0:1883->1883/tcp, [::]:1883->1883/tcp, 0.0.0.0:3306->3306/tcp, [::]:3306->3306/tcp, 0.0.0.0:27017->27017/tcp, [::]:27017->27017/tcp, 0.0.0.0:69->69/udp, [::]:69->69/udp
elasticpot            Up About a minute                      0.0.0.0:9200->9200/tcp, [::]:9200->9200/tcp
elasticsearch         Up About a minute (healthy)            127.0.0.1:64298->9200/tcp
ewsposter             Up About a minute                      
fatt                  Up About a minute                      
h0neytr4p             Up About a minute                      0.0.0.0:443->443/tcp, [::]:443->443/tcp, 0.0.0.0:2087->443/tcp, [::]:2087->443/tcp
heralding             Up About a minute                      0.0.0.0:110->110/tcp, [::]:110->110/tcp, 0.0.0.0:143->143/tcp, [::]:143->143/tcp, 0.0.0.0:465->465/tcp, [::]:465->465/tcp, 0.0.0.0:993->993/tcp, [::]:993->993/tcp, 0.0.0.0:995->995/tcp, [::]:995->995/tcp, 0.0.0.0:1080->1080/tcp, [::]:1080->1080/tcp, 0.0.0.0:5432->5432/tcp, [::]:5432->5432/tcp, 0.0.0.0:5900->5900/tcp, [::]:5900->5900/tcp
honeyaml              Up About a minute                      0.0.0.0:3000->8080/tcp, [::]:3000->8080/tcp
honeytrap             Up About a minute                      
ipphoney              Up About a minute                      0.0.0.0:631->631/tcp, [::]:631->631/tcp
kibana                Up 25 seconds (health: starting)       127.0.0.1:64296->5601/tcp
logstash              Up 25 seconds (health: starting)       127.0.0.1:64305->64305/tcp
mailoney              Up About a minute                      0.0.0.0:25->25/tcp, [::]:25->25/tcp, 0.0.0.0:587->25/tcp, [::]:587->25/tcp
map_data              Up 25 seconds                          
map_redis             Up About a minute                      
map_web               Up About a minute                      127.0.0.1:64299->64299/tcp
medpot                Up About a minute                      0.0.0.0:2575->2575/tcp, [::]:2575->2575/tcp
miniprint             Up About a minute                      0.0.0.0:9100->9100/tcp, [::]:9100->9100/tcp
nginx                 Up About a minute                      0.0.0.0:64294->64294/tcp, [::]:64294->64294/tcp, 0.0.0.0:64297->64297/tcp, [::]:64297->64297/tcp
p0f                   Up About a minute                      
rdphoneypot           Up About a minute                      0.0.0.0:3389->3389/tcp, [::]:3389->3389/tcp
redishoneypot         Up About a minute                      0.0.0.0:6379->6379/tcp, [::]:6379->6379/tcp
sentrypeer            Up About a minute                      0.0.0.0:5060->5060/tcp, 0.0.0.0:5060->5060/udp, [::]:5060->5060/tcp, [::]:5060->5060/udp
snare                 Up About a minute                      0.0.0.0:80->80/tcp, [::]:80->80/tcp
spiderfoot            Up About a minute (healthy)            127.0.0.1:64303->8080/tcp
suricata              Up About a minute                      
tanner                Up About a minute                      
tanner_api            Up About a minute                      
tanner_phpox          Up About a minute                      
tanner_redis          Up About a minute                      
tpotinit              Up About a minute (healthy)            
wordpot               Up About a minute                      0.0.0.0:8080->80/tcp, [::]:8080->80/tcp

• On Linux: What is the status of the T-Pot service (systemctl status tpot)?

sudo systemctl status tpot
● tpot.service - T-Pot
     Loaded: loaded (/etc/systemd/system/tpot.service; enabled; preset: enabled)
     Active: active (running) since Tue 2026-08-04 01:30:48 CEST; 2min 55s ago
 Invocation: 3a84d39548be47308a9a42b3313e000d
    Process: 41670 ExecStartPre=/usr/bin/docker compose -f /home/kalator/tpotce/docker-compose.yml down -v (code=exited, status=0/SUCCESS)
   Main PID: 41724 (docker)
      Tasks: 21 (limit: 18576)
     Memory: 39M (peak: 40.8M)
        CPU: 1.030s
     CGroup: /system.slice/tpot.service
             ├─41724 /usr/bin/docker compose -f /home/kalator/tpotce/docker-compose.yml up
             └─41740 /usr/libexec/docker/cli-plugins/docker-compose compose -f /home/kalator/tpotce/docker-compose.yml up

Aug 04 01:33:41 kalator-standardpc docker[41740]: elasticsearch        | [2026-08-03T23:33:41,808][INFO ][o.e.x.i.IndexLifecycleTransition] [tpotcluster-node-01] moving index [.internal.alerts-ml.anomaly-detection.alerts-default-00000>
Aug 04 01:33:41 kalator-standardpc docker[41740]: elasticsearch        | [2026-08-03T23:33:41,810][INFO ][o.e.x.i.IndexLifecycleTransition] [tpotcluster-node-01] moving index [.internal.alerts-streams.alerts-default-000001] from [{"ph>
Aug 04 01:33:41 kalator-standardpc docker[41740]: elasticsearch        | [2026-08-03T23:33:41,814][INFO ][o.e.x.i.IndexLifecycleTransition] [tpotcluster-node-01] moving index [.internal.alerts-observability.uptime.alerts-default-00000>
Aug 04 01:33:41 kalator-standardpc docker[41740]: elasticsearch        | [2026-08-03T23:33:41,815][INFO ][o.e.x.i.IndexLifecycleTransition] [tpotcluster-node-01] moving index [.internal.alerts-observability.slo.alerts-default-000001] >
Aug 04 01:33:41 kalator-standardpc docker[41740]: elasticsearch        | [2026-08-03T23:33:41,819][INFO ][o.e.x.i.IndexLifecycleTransition] [tpotcluster-node-01] moving index [.internal.alerts-observability.threshold.alerts-default-00>
Aug 04 01:33:41 kalator-standardpc docker[41740]: elasticsearch        | [2026-08-03T23:33:41,821][INFO ][o.e.x.i.IndexLifecycleTransition] [tpotcluster-node-01] moving index [.internal.alerts-default.alerts-default-000001] from [{"ph>
Aug 04 01:33:41 kalator-standardpc docker[41740]: elasticsearch        | [2026-08-03T23:33:41,822][INFO ][o.e.x.i.IndexLifecycleTransition] [tpotcluster-node-01] moving index [.internal.alerts-stack.alerts-default-000001] from [{"phas>
Aug 04 01:33:41 kalator-standardpc docker[41740]: elasticsearch        | [2026-08-03T23:33:41,823][INFO ][o.e.x.i.IndexLifecycleTransition] [tpotcluster-node-01] moving index [.internal.alerts-security.alerts-default-000001] from [{"p>
Aug 04 01:33:41 kalator-standardpc docker[41740]: elasticsearch        | [2026-08-03T23:33:41,825][INFO ][o.e.x.i.IndexLifecycleTransition] [tpotcluster-node-01] moving index [.internal.alerts-observability.logs.alerts-default-000001]>
Aug 04 01:33:41 kalator-standardpc docker[41740]: elasticsearch        | [2026-08-03T23:33:41,826][INFO ][o.e.x.i.IndexLifecycleTransition] [tpotcluster-node-01] moving index [.internal.alerts-transform.health.alerts-default-000001] f>
lines 1-23/23 (END)

• What ports are being occupied? Stop T-Pot systemctl stop tpot and run grc netstat -tulpen

sudo systemctl stop tpot && grc netstat -tulpen
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name    
tcp        0      0 0.0.0.0:64295           0.0.0.0:*               LISTEN      0          165362     -                   
tcp6       0      0 :::64295                :::*                    LISTEN      0          165364     -                   
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           103        8492       -                   
udp        0      0 0.0.0.0:56145           0.0.0.0:*                           103        8494       -                   
udp6       0      0 :::5353                 :::*                                103        8493       -                   
udp6       0      0 :::49428                :::*                                103        8495       -  

[t3chn0m4g3]

I cannot reproduce this. After a fresh install I simply connect to https://<ip>:64297 and it works right away.

[github-actions]

This issue has been marked as stale because it has had no activity for 7 days. If you are still experiencing this issue, please comment or it will be closed in 7 days.