Duplicati rogue process

I have a system that is running duplicati as a service with no issues. However, there is another duplicati instance (non-server based) that fires off at 11:27 AM and errors because of missing source files. I have tried to find it, making sure that the only sqlite files are service based, including the duplicati-server one. I’ve removed any startup files from taskman, and tried to find the process by checking port 8300 and 8400.
This is not causing any harm, other than to myself beating my head against a wall.
If I could be on the machine between 11:25 and 11:30, I could probably find it, but the system is almost always being used then (and off on the weekends).
Barring some elegant forum solution, I’ll get them to leave it on this weekend, but I’m still iffy on whether I can catch the process, since it fails so quickly.
Thanks for any and all suggestions.
Rick

You sure you don’t have a shortcut for Duplicati in Startup folder? The installer wants to place one there by default, and this will cause a second instance if you’ve set it up as a Service too. (Or even a third or more instances if multiple users log in simultaneously.)

When you checked port 8300 and 8400, did you get a Duplicati Web UI?

Where exactly do you see these alerts at 11:27am?

All startup folders are cleared, no GUI or anything at 8300 or 8400 (“Hmmm…can’t reach this page” splash screen).

The alerts are sent to my gmail account that I set up specifically for duplicati messages. So I get 3 emails a day from this account: two from my service jobs that fire at 8:30 and 9 (completed successfully) and the failed one from 11:27.

Here is the text of the failed job – it aborts on a missing source folder (D:) and also complains about a 404 but I don’t do HTML at all.

Failed: The source folder D:\ does not exist, aborting backup

Details: System.IO.IOException: The source folder D:\ does not exist, aborting backup

at Duplicati.Library.Main.Controller.ExpandInputSources(String inputsources, IFilter filter)

at Duplicati.Library.Main.Controller.<>c__DisplayClass14_0.b__0(BackupResults result)

at Duplicati.Library.Main.Controller.RunAction[T](T result, String& paths, IFilter& filter, Action`1 method)

Log data:

2021-04-13 11:27:21 -07 - [Warning-Duplicati.Library.Modules.Builtin.SendHttpMessage-HttpResponseError]: HTTP Response: 404 - Not Found:

Not Found html, body { background-color: #fff; color: #636b6f; font-family: 'Nunito', sans-serif; font-weight: 100; height: 100vh; margin: 0; } .full-height { height: 100vh; } .flex-center { align-items: center; display: flex; justify-content: center; } .position-ref { position: relative; } .code { border-right: 2px solid; font-size: 26px; padding: 0 15px 0 15px; text-align: center; } .message { font-size: 18px; text-align: center; }

404

Not Found

System.Net.WebException: The remote server returned an error: (404) Not Found.

at System.Net.HttpWebRequest.GetResponse()

at Duplicati.Library.Modules.Builtin.SendHttpMessage.SendMessage(String subject, String body)

2021-04-13 11:27:21 -07 - [Warning-Duplicati.Library.Modules.Builtin.ReportHelper-ReportSubmitError]: Failed to send message: System.Net.WebException: The remote server returned an error: (404) Not Found.

System.Net.WebException: The remote server returned an error: (404) Not Found.

at Duplicati.Library.Modules.Builtin.SendHttpMessage.SendMessage(String subject, String body)

at Duplicati.Library.Modules.Builtin.ReportHelper.OnFinish(Object result)

If you don’t see a Web UI on 8300 then it doesn’t sound like this machine has more than one instance running.

Is it possible the email alert is coming from a different computer entirely?

No. Because the name of the backup comes from this option line:

–send-mail-subject=Duplicati %PARSEDRESULT%, %OPERATIONNAME% report for %backup-name%

It identifies the computer and the job. And the job name was the one I used originally, before I ‘converted’ to service.

(Duplicati Fatal, Backup report for PYW.Mija - External Drive)

After converting to duplicati service, the successful backups show up like this:

(Duplicati Success, Backup report for PYW.Mija – ext)

I had to rename the backup-name, because I was new to service setups at that time and wanted them to run in parallel. After a couple of days, I deleted the stand alone json and removed duplicati from the startup folders. Also made sure that no duplicati processes were left running – just duplicati-server.

I’ve since verified that there is only one duplicati-server.sqlite file and only one control_dir_v2 directory, both in c:\programdata\duplicati\data

Which prompts another question, maybe answered elsewhere in the forum: is there a way to look inside the duplicati-server.sqlite file? The SQL browser program that works fine on the databases won’t touch it, saying “file is not a database”. And I can’t find any other tools to take a peek.

Back on track: So I’ve got a ghost. If I save the json files I want, uninstall duplicati, reboot, then re-install server only and reload the json files I should be good to go. So maybe this is just an unnecessary exercise. Let me know what you think

Thanks

Rick

By default, this database is encrypted on Windows. SQLite DB Browser can’t read it. There’s a way to tell Duplicati to not encrypt this file, discussed elsewhere in the forum (I don’t recall off hand how to do it). But I don’t think it’s relevant to your issue.

If the Duplicati Web UI only shows the intended jobs, then I don’t think there are any “ghosts” in your database or any reason to export, uninstall, reinstall, and reimport the jobs.

Is it possible you scheduled Duplicati.CommandLine.exe using task scheduler during your testing? That command line executable runs independently from the web server Duplicati process.

I checked task scheduler, looking for anything dup and found nothing. Even checked the registry ‘run’ and ‘run-once’ locations. Doesn’t look like there is going to be anything elegant about ghostbusting this process. I’ll set it up to watch this weekend and when/if I catch it, I’ll let you know what it was.

Thanks for your help, as always!!

Rick

If you install Sysinternals Process Monitor and have it ready at 11:25 to watch Duplicati processes, that should pick up anything that happens at 11:27. Don’t leave it up constantly, as logging can be extensive.

In Gmail web UI, click three-dot “More” menu on right of screen, then choose “Show original” and see if originating IP addresses are the same. IP would probably be on the bottom Received header line, e.g.:

Received: from [###.###.###.###] (helo=[192.168.0.109]) by

This is missing some things. Are there also two Duplicati.WindowsService.exe processes running now?

What’s the modification time on Duplicati-server.sqlite? If you check its time after 11:27, is it 9 or 11:27?

Note you can’t check SYSTEM profile easily from File Explorer. You can use Command Prompt (Admin).

If your service has been specially configured to use the ProgramData location (good idea), it would need either --serverdatafolder on service start, or DUPLICATI_HOME in the environment, as documented, which also shows --unencrypted-database if you still really want to try DB Browser for SQLite or such.

Easier first step would be to read About → System Info → Server state properties → Proposed schedule.
You should see the 8:30 and 9 sitting there. Is there an 11:27? If not, it’s probably not this server that did it, however you can also set up a log-file=<path> log-file-log-level=information and because I assume you’ve already checked the visible jobs, you can put them in either Settings → Default options or on service start.

2021-04-14 06:01:54 -04 - [Information-Duplicati.Library.Modules.Builtin.SendMail-SendMailComplete]: Email sent successfully using server: smtp://smtpauth.isp.net:587/?starttls=always
2021-04-14 06:01:55 -04 - [Information-Duplicati.Library.Main.Controller-CompletedOperation]: The operation Backup has completed
2021-04-14 06:40:00 -04 - [Information-Duplicati.Library.Main.Controller-StartingOperation]: The operation Backup has started

would be some of the interesting lines near 11:27, if in fact this server is the one that’s sending the email.
If it’s something else on this system starting a Duplicati, somehow, Process Monitor should pick that up.