I cannot access the webUI and the kibana dashboards #1838

alysaamni · 2025-09-04T04:19:58Z

alysaamni
Sep 4, 2025

Issue: I installed tpot in my vmware using NAT because i just wanted to do attack simulation. at first, everything is fine. i can access the tpot webUI and can open attack map etc but ofcourse no incoming attacks as i didnt expose it to the Internet. However, even then, I can't open Kibana. I clicked the Kibana from the start page but it shows this everytime. sometimes i do troubleshooting and then the webUI itself shows the same error. why? help me fix this :( this is for my uni project.

⚠️ Basic support information (commands are expected to run as `root`)

What OS are you T-Pot running on? Debian 12
What is the version of the OS lsb_release -a and uname -a?
Linux debian 6.1.0-38-amd64 Release needs testing in VM and on a NUC #1 SMP PREEMPT_DYNAMIC Debian 6.1.147-1 (2025-08-02) x86_64 GNU/Linux
What T-Pot version are you currently using (only T-Pot 24.04.x is currently supported)? T-Pot 24.04.1
What architecture are you running on (i.e. hardware, cloud, VM, etc.)? VMware
Review the ~/install_tpot.log, attach the log and highlight the errors.
How long has your installation been running? ** A week**
- If it is a fresh install consult the documentation first.
- Most likely it is a port conflict or a remote dependency was unavailable.
- Retry a fresh installation and only open the issue if the error keeps coming up and is not resolved using the documentation as described here.
Did you install upgrades, packages or use the update script? Yes
Did you modify any scripts or configs? If yes, please attach the changes. No
Please provide a screenshot of htop and docker stats.

How much free disk space is available (df -h)?

honeypot@debian:~$ df -h
Filesystem Size Used Avail Use% Mounted on
udev 3.9G 0 3.9G 0% /dev
tmpfs 791M 4.2M 787M 1% /run
/dev/sda1 31G 15G 15G 51% /
tmpfs 3.9G 0 3.9G 0% /dev/shm
tmpfs 5.0M 8.0K 5.0M 1% /run/lock
tmpfs 791M 100K 791M 1% /run/user/1001

What is the current container status (dps)?

On Linux: What is the status of the T-Pot service (systemctl status tpot)?
What ports are being occupied? Stop T-Pot systemctl stop tpot and run grc netstat -tulpen
- Stop T-Pot systemctl stop tpot
- Run grc netstat -tulpen

(Not all processes could will not be shown, you Active Internet connections Proto Recv-Q Send-Q Local Address tcp 0 0 0.0.0.0:1025 tcp 0 0 0.0.0.0:1080 tcp 0 0 0.0.0.0:5432 tcp 0 0 127.0.0.1:64303 tcp 0 0 127.0.0.1:64298 tcp 0 0 127.0.0.1:64299 tcp 0 0 0.0.0.0:1433 tcp 0 0 0.0.0.0:5555 tcp 0 0 0.0.0.0:1723 tcp 0 0 0.0.0.0:1883 tcp 0 0 0.0.0.0:5900 tcp 0 0 0.0.0.0:10001 tcp 0 0 0.0.0.0:81 tcp 0 0 0.0.0.0:104 tcp 0 0 0.0.0.0:110 tcp 0 0 0.0.0.0:25 tcp 0 0 0.0.0.0:20 tcp 0 0 0.0.0.0:21 tcp 0 0 0.0.0.0:22 tcp 0 0 0.0.0.0:23 tcp 0 0 0.0.0.0:42 tcp 0 0 0.0.0.0:8443 tcp 0 0 0.0.0.0:143 tcp 0 0 0.0.0.0:135 tcp 0 0 0.0.0.0:465 tcp 0 0 0.0.0.0:443 tcp 0 0 0.0.0.0:445 tcp 0 0 0.0.0.0:587 tcp 0 0 0.0.0.0:5060 tcp 0 0 0.0.0.0:993 tcp 0 0 0.0.0.0:995 tcp 0 0 0.0.0.0:9200 tcp 0 0 0.0.0.0:9100 tcp 0 0 0.0.0.0:50100 tcp 0 0 0.0.0.0:3306 tcp 0 0 127.0.0.1:631 tcp 0 0 0.0.0.0:8080 tcp 0 0 0.0.0.0:6379 tcp 0 0 0.0.0.0:2404 tcp 0 0 0.0.0.0:27017 tcp 0 0 0.0.0.0:2575 tcp 0 0 0.0.0.0:11112 tcp 0 0 0.0.0.0:64297 tcp 0 0 0.0.0.0:64294 tcp 0 0 0.0.0.0:64295 tcp 0 0 0.0.0.0:3000 tcp6 0 0 :::1025 tcp6 0 0 :::1080 tcp6 0 0 :::5432 tcp6 0 0 :::1433 tcp6 0 0 :::5555 tcp6 0 0 :::1723 tcp6 0 0 :::1883 tcp6 0 0 :::5900 tcp6 0 0 :::10001 tcp6 0 0 :::81 tcp6 0 0 :::104 tcp6 0 0 :::110 tcp6 0 0 :::25 tcp6 0 0 :::20 tcp6 0 0 :::21 tcp6 0 0 :::22 tcp6 0 0 :::23 tcp6 0 0 :::42 tcp6 0 0 :::8443 tcp6 0 0 :::143 tcp6 0 0 :::135 tcp6 0 0 :::465 tcp6 0 0 :::443 tcp6 0 0 :::445 tcp6 0 0 :::587 tcp6 0 0 :::5060 tcp6 0 0 :::993 tcp6 0 0 :::995 tcp6 0 0 :::9200 tcp6 0 0 :::9100 tcp6 0 0 :::50100 tcp6 0 0 ::1:631 tcp6 0 0 :::3306 tcp6 0 0 :::8080 tcp6 0 0 :::6379 tcp6 0 0 :::2404 tcp6 0 0 :::27017 tcp6 0 0 :::2575 tcp6 0 0 :::11112 tcp6 0 0 :::64297 tcp6 0 0 :::64294 tcp6 0 0 :::64295 tcp6 0 0 :::3000 udp 0 0 0.0.0.0:5353 udp 0 0 0.0.0.0:54656 udp 0 0 0.0.0.0:69 udp 0 0 0.0.0.0:161 udp 0 0 0.0.0.0:623 udp 0 0 0.0.0.0:5000 udp 0 0 0.0.0.0:5060 udp6 0 0 :::5353 udp6 0 0 :::60291 udp6 0 0 :::69 udp6 0 0 :::161 udp6 0 0 :::623 udp6 0 0 :::5000 udp6 0 0 :::5060 be identified, non-owned process info
would have to be root to see it all.)
(only servers)
Foreign Address State User Inode PID/Program name
0.0.0.0:* LISTEN 0 517632 -
0.0.0.0:* LISTEN 0 516983 -
0.0.0.0:* LISTEN 0 517002 -
0.0.0.0:* LISTEN 0 514305 -
0.0.0.0:* LISTEN 0 516585 -
0.0.0.0:* LISTEN 0 514347 -
0.0.0.0:* LISTEN 0 519571 -
0.0.0.0:* LISTEN 0 518332 -
0.0.0.0:* LISTEN 0 518563 -
0.0.0.0:* LISTEN 0 518583 -
0.0.0.0:* LISTEN 0 517912 -
0.0.0.0:* LISTEN 0 515219 -
0.0.0.0:* LISTEN 0 519477 -
0.0.0.0:* LISTEN 0 520202 -
0.0.0.0:* LISTEN 0 516840 -
0.0.0.0:* LISTEN 0 516274 -
0.0.0.0:* LISTEN 0 519342 -
0.0.0.0:* LISTEN 0 519378 -
0.0.0.0:* LISTEN 0 515751 -
0.0.0.0:* LISTEN 0 514780 -
0.0.0.0:* LISTEN 0 519405 -
0.0.0.0:* LISTEN 0 513906 -
0.0.0.0:* LISTEN 0 516894 -
0.0.0.0:* LISTEN 0 519495 -
0.0.0.0:* LISTEN 0 516910 -
0.0.0.0:* LISTEN 0 516622 -
0.0.0.0:* LISTEN 0 519530 -
0.0.0.0:* LISTEN 0 516444 -
0.0.0.0:* LISTEN 0 519147 -
0.0.0.0:* LISTEN 0 516927 -
0.0.0.0:* LISTEN 0 516946 -
0.0.0.0:* LISTEN 0 510519 -
0.0.0.0:* LISTEN 0 518166 -
0.0.0.0:* LISTEN 0 516735 -
0.0.0.0:* LISTEN 0 519628 -
0.0.0.0:* LISTEN 0 469543 -
0.0.0.0:* LISTEN 0 517517 -
0.0.0.0:* LISTEN 0 516520 -
0.0.0.0:* LISTEN 0 509886 -
0.0.0.0:* LISTEN 0 518635 -
0.0.0.0:* LISTEN 0 517560 -
0.0.0.0:* LISTEN 0 519049 -
0.0.0.0:* LISTEN 0 514183 -
0.0.0.0:* LISTEN 0 514148 -
0.0.0.0:* LISTEN 0 23747 -
0.0.0.0:* LISTEN 0 519197 -
:::* LISTEN 0 517633 -
:::* LISTEN 0 516984 -
:::* LISTEN 0 517003 -
:::* LISTEN 0 519572 -
:::* LISTEN 0 518333 -
:::* LISTEN 0 518564 -
:::* LISTEN 0 518584 -
:::* LISTEN 0 517913 -
:::* LISTEN 0 515220 -
:::* LISTEN 0 519478 -
:::* LISTEN 0 520203 -
:::* LISTEN 0 516841 -
:::* LISTEN 0 516275 -
:::* LISTEN 0 519343 -
:::* LISTEN 0 519379 -
:::* LISTEN 0 515752 -
:::* LISTEN 0 514781 -
:::* LISTEN 0 519406 -
:::* LISTEN 0 513907 -
:::* LISTEN 0 516895 -
:::* LISTEN 0 519496 -
:::* LISTEN 0 516911 -
:::* LISTEN 0 516623 -
:::* LISTEN 0 519531 -
:::* LISTEN 0 516445 -
:::* LISTEN 0 519148 -
:::* LISTEN 0 516928 -
:::* LISTEN 0 516947 -
:::* LISTEN 0 510520 -
:::* LISTEN 0 518167 -
:::* LISTEN 0 516736 -
:::* LISTEN 0 469542 -
:::* LISTEN 0 519629 -
:::* LISTEN 0 517518 -
:::* LISTEN 0 516521 -
:::* LISTEN 0 509887 -
:::* LISTEN 0 518636 -
:::* LISTEN 0 517561 -
:::* LISTEN 0 519050 -
:::* LISTEN 0 514184 -
:::* LISTEN 0 514149 -
:::* LISTEN 0 23749 -
:::* LISTEN 0 519198 -
0.0.0.0:* 104 21810 -
0.0.0.0:* 104 21812 -
0.0.0.0:* 0 519441 -
0.0.0.0:* 0 509846 -
0.0.0.0:* 0 519298 -
0.0.0.0:* 0 513677 -
0.0.0.0:* 0 520326 -
:::* 104 21811 -
:::* 104 21813 -
:::* 0 519442 -
:::* 0 509847 -
:::* 0 519299 -
:::* 0 513678 -
:::* 0 520327 -

Run T-Pot manually with docker compose -f ~/tpotce/docker-compose.yml up and check for errors

Attaching to adbhoney, ciscoasa, conpot_guardian_ast, conpot_iec104, conpot_ipmi, conpot_kamstrup_382, cowrie, dicompot, dionaea, elasticpot, elasticsearch, ewsposter, fatt, h0neytr4p, heralding, honeyaml, honeytrap, ipphoney, kibana, logstash, mailoney, map_data, map_redis, map_web, medpot, miniprint, nginx, p0f, redishoneypot, sentrypeer, snare, spiderfoot, suricata, tanner, tanner_api, tanner_phpox, tanner_redis, tpotinit, wordpot
dionaea exited with code 255
sentrypeer exited with code 137
sentrypeer exited with code 137
dionaea exited with code 255
sentrypeer exited with code 137
dionaea exited with code 255
dionaea exited with code 255
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x48 pc=0x20e6092]
w Enable Watch
goroutine 382 [running]:
github.com/docker/compose/v2/pkg/compose.(*monitor).Start(0xc0006c23c0, {0x2d2ffd0, 0x4387460})
github.com/docker/compose/v2/pkg/compose/monitor.go:153 +0xbf2
github.com/docker/compose/v2/pkg/compose.(*composeService).Up.func6()
github.com/docker/compose/v2/pkg/compose/up.go:234 +0x2e
github.com/hashicorp/go-multierror.(*Group).Go.func1()
github.com/hashicorp/[email protected]/group.go:23 +0x59
created by github.com/hashicorp/go-multierror.(*Group).Go in goroutine 1
github.com/hashicorp/[email protected]/group.go:20 +0x76

Stop execution with CTRL-C and docker compose -f ~/tpotce/docker-compose.yml down -v

honeypot@debian:~$ docker compose -f ~/tpotce/docker-compose.yml down -v
[+] Running 10/10
✔ Container suricata Removed 0.0s
✔ Container ipphoney Removed 0.0s
✔ Container fatt Removed 0.0s
✔ Container kibana Removed 0.1s
✔ Container logstash Removed 0.0s
✔ Container snare Removed 0.0s
✔ Container map_data Removed 0.1s
✔ Container honeytrap Removed 0.0s
✔ Container p0f Removed 0.0s
✔ Container tanner Removed

If a single container shows as DOWN you can run docker logs <container-name> for the latest log entries

t3chn0m4g3 · 2025-09-04T08:15:00Z

t3chn0m4g3
Sep 4, 2025
Maintainer

Based on your information there might be more issues than one, unfortunately nothing that seems to be T-Pot related:

You mentioned everything worked just fine, looking at the docker compose output one can see segmentation faults which might indicate RAM or storage limitations
It seems (i cannot really tell) that you installed a desktop environment with Debian on your honeypot, that comes with lots of packages and dependencies that will introduce issues. Should that be the case please follow the install instructions to use the Debian Net Install image and only install SSH as a package.
Run netstat -tulpen only when T-Pot is stopped to see if ports / services are being use by the OS already.

2 replies

alysaamni Sep 4, 2025
Author

thank you so much for replying. as for the ram, is it because the new tpot version requires more than 8GB RAM? or it can be settled below 8GB? what if i just enable a few dockers like cowrie and tanner to reduce the ram usage?

t3chn0m4g3 Sep 4, 2025
Maintainer

This really depends on your install, with the desktop environment enabled you are probably looking at 12-16GB required RAM. Other than that the ELK stack alone requires around 4GB.
You can walk the less RAM route by using a distributed install for sensors and hive.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

I cannot access the webUI and the kibana dashboards #1838

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

I cannot access the webUI and the kibana dashboards #1838

Uh oh!

alysaamni Sep 4, 2025

⚠️ Basic support information (commands are expected to run as root)

Replies: 1 comment · 2 replies

Uh oh!

Uh oh!

t3chn0m4g3 Sep 4, 2025 Maintainer

Uh oh!

alysaamni Sep 4, 2025 Author

Uh oh!

Uh oh!

t3chn0m4g3 Sep 4, 2025 Maintainer

alysaamni
Sep 4, 2025

⚠️ Basic support information (commands are expected to run as `root`)

Replies: 1 comment 2 replies

t3chn0m4g3
Sep 4, 2025
Maintainer

alysaamni Sep 4, 2025
Author

t3chn0m4g3 Sep 4, 2025
Maintainer