Pihole lighttpd error log being spammed

Help
1

Please follow the below template, it will help us to help you!

Expected Behaviour:

OS: Raspberry Pi OS (Bookworm)
Raspberry Pi 4
Device is on a vlanned network and is served to three of them with vlan specific addresses. (Noting this as you will see it in the debug token).

There should be no errors in error-pihole.log.

Actual Behaviour:

While investigating an what was initially thought to be an unexpected shutdown (it was actually expected due to raspibackup operation), I found this in the lighttpd error log (error-pihole.log).

2025-01-14 21:01:44: (mod_fastcgi.c.449) FastCGI-stderr:PHP Warning: Undefined array key "auth" in /var/www/html/admin/scripts/pi-hole/php/password.php on line 108

This error is occurring once per minute non-stop. How can I fix this?

Debug Token:

https://tricorder.pi-hole.net/rKA49F6l/

2

Are you using some app or script calling the API? If you are, please post the URL used.

3

No app or script is in use. The closes thing is raspibackup but all that is doing is running systemctl stop/start pihole-FTL before and after the backup hits.

4

Is this happening while the web interface dashboard is opened in a browser (when you are logged in)? Or does it happen when you are logged off?

Does it happens if you access the web interface from a different browser?

5

The issue occurs regardless of if I’m logged in, logged out, or tab closed and computer off.

6

How often does that backup job run?
Could you share the crontab schedule for that job?

7

Raspibackup runs daily at 5am ET. Raspibackup is scheduled using systemd timer.

The only interaction that Raspibackup has with pihole is it runs

sudo systemctl stop pihole-FTL

before the backup starts and once the backup completes it runs

sudo systemctl start pihole-FTL

8

PHP only generates error messages like this if password.php file is accessed.
We know there is something (a script or external app) requesting a page once a minute, but we don't know which page (password.php is used by every page in Pi-hole web interface).

Please execute this command to find out what is requesting the page (logout from the web interface before executing the command to avoid false positives):

tail /var/log/lighttpd/access-pihole.log
10

and behold the mystery is solved! So upon querying access-pihole.log as you suggested, it revealed that the requests were coming from my RHEL server. Turns out I had connected the old pihole installation to Zabbix which is running on the RHEL server. When I rebuilt the pihole installation I used a different password and forgot to update Zabbix.
As a temporary measure I've disabled the zabbix host for pihole and the spamming has stopped.