Tools for monitoring and diagnosing SmartThings smart home devices.
Requires the SmartThings CLI:
brew install smartthingscommunity/smartthings/smartthings| Script | Description |
|---|---|
monitor-lock.sh |
Full device diagnostics for Z-Wave locks |
log-battery.sh |
Log battery levels to CSV (run via cron) |
battery-trend.sh |
View battery drain history |
# Full diagnostics on Front door lock
./monitor-lock.sh
# Check a specific device
./monitor-lock.sh <device-id>
# View battery drain trend
./battery-trend.sh
# Manual battery log
./log-battery.shDaily battery logging at 8 AM:
0 8 * * * /path/to/smart/log-battery.sh >> /path/to/smart/logs/cron.log 2>&1| Property | Value |
|---|---|
| Model | Schlage BE469 (non-ZP) |
| Part# | 12385868-017 |
| Model# | 23685159 |
| Firmware | 0.8.0 (01/11/2019) |
| Z-Wave Security | S0_LEGACY only (S2 not supported) |
| SmartThings ID | a9a852ec-f357-4de0-a12b-240df0ade739 |
Note: BE469 (original) only supports S0 security. The newer BE469ZP supports S2.
Credentials stored in credentials/front-door.txt (gitignored).
Programming instructions: https://instructions.allegion.com/instr/146/32418
| Property | Value |
|---|---|
| SmartThings ID | 915d7c8b-b66f-414e-ae48-1fcfc9d53db5 |
| Z-Wave Security | S2_ACCESS_CONTROL |
| Property | Value |
|---|---|
| Model | Schlage BE469ZP (warranty replacement) |
| SmartThings ID | b608437a-d821-41f9-b8f1-24b858477b2d |
| Z-Wave Security | S2_ACCESS_CONTROL |
| Notes | Warranty replacement unit — was flaky on prior drivers, stable on RBoy |
| Property | Right heater | Left heater |
|---|---|---|
| Model | Leviton DZPA1 | Minoston MP31ZP (replacing with DZPA1) |
| SmartThings ID | b0dca074-7167-4e36-95d5-4ccf067c2bb2 | 421abfbc-410f-4d2c-911f-d585f104e725 |
| Z-Wave Security | LEGACY_NON_SECURE | S2_AUTHENTICATED |
| Room | Mike Office | Mike Office |
| Status | Working | Commands fail from office — S2 issue |
Note: MP31ZP has S2 command delivery issues at distance from hub. Replacing with Leviton DZPA1 which works reliably as non-secure.
Created to diagnose Schlage BE469 Z-Wave lock battery drain issues. Key findings:
ZWAVE_S0_LEGACYencryption uses ~3x more messages than S2provisioningState: NONFUNCTIONALcauses failed Z-Wave retries- Re-pairing the device can fix provisioning issues
- Driver changes on locks cause NONFUNCTIONAL — only fix is exclude/re-pair
- Z-Wave Repair does NOT fix provisioning state
All three Schlage locks now use the RBoy Universal Enhanced Z-Wave Lock driver (c8d6a4ae).
- Source: RBoy Apps (paid, actively maintained)
- Profile: schlage-lock with schlage-be469 device name
- Features: 33 commands, firmware update, Schlage-specific settings (alarm controls, pin code length, auto-lock, vacation mode)
- Key advantage: Driver change from philh30/stock did NOT cause NONFUNCTIONAL provisioning — RBoy properly handles
driverChangedtransitions
| Driver | S0 Locks | S2 Locks | Guest Access | Driver Change Safe | Status |
|---|---|---|---|---|---|
| RBoy Universal Enhanced | ✅ Works | ✅ Works | TBD | ✅ Yes | Actively maintained |
| Z-Wave Lock PH (philh30) | ✅ Works | ? | Works | ❌ Causes NONFUNCTIONAL | Abandoned (author moved to HA, Jan 2023) |
| Z-Wave Lock (stock Samsung) | ? | Works | Broken (S2 shows "unknown") | ❌ Causes NONFUNCTIONAL | Samsung-maintained |
- Driver changes on Z-Wave locks cause NONFUNCTIONAL provisioning (stock Samsung and philh30 drivers)
- Exception: RBoy driver handles
driverChangedproperly — switching to RBoy fixed Garage Door from NONFUNCTIONAL to PROVISIONED without re-pair - Z-Wave Repair does not fix provisioning — only rebuilds routing tables
- For non-RBoy drivers, exclude/re-pair is the only known fix (each re-pair changes device ID)
- S2_AUTHENTICATED pairing succeeds but commands fail at distance
- Power metering reports work (device→hub) but switch commands fail (hub→device)
- SmartThings does not offer option to skip S2 on this device
- Works fine close to hub; fails from office (~30+ ft through walls)
- Replacing with Leviton DZPA1 (non-secure, proven reliable)
As of Feb 2026, primary monitoring has moved to Home Assistant running on the Synology NAS (IRIS, DS1520+). The SmartThings CLI scripts in this repo remain useful for ad-hoc Z-Wave diagnostics (provisioning state, security level, driver info) that HA doesn't expose.
SmartThings Hub (Z-Wave) ──cloud──▶ SmartThings Cloud
│
Nabu Casa OAuth
│
▼
Synology IRIS (DS1520+) ◀── Docker ── Home Assistant (2026.2.x)
└─ /volume3/docker/homeassistant/ │
├── Lock Monitor dashboard
├── Battery alert automation
└── 61 SmartThings entities
- Lock Monitor dashboard — Real-time lock status tiles with lock/unlock controls, battery gauges (color-coded: green >50%, yellow 20-50%, red <20%), 30-day battery history graph, tamper status, and lock activity logbook
- Battery alert automation — Persistent notification + push to iPhone when any lock battery drops below 20%
- SmartThings integration — 31 devices / 61 entities including locks, switches, lights, climate, and media players
The SmartThings CLI exposes Z-Wave details that HA does not:
provisioningState(PROVISIONED vs NONFUNCTIONAL)networkSecurityLevel(S0_LEGACY, S2_ACCESS_CONTROL, etc.)- Device health state and event history
- Z-Wave network IDs and driver assignments
Use monitor-lock.sh for deep diagnostics; use HA for day-to-day monitoring.
| Resource | Value |
|---|---|
| NAS | Synology DS1520+ (IRIS) |
| HA Config | /volume3/docker/homeassistant/ |
| HA Container | home_assistant (Docker, host networking, port 8123) |
| HA URL (external) | https://ha.conant.com |
| HA URL (internal) | http://10.1.11.98:8123 |
| Git Working Copy | /volume3/docker/projects/smart/ |
| Git Bare Repo | /volume3/docker/git/smart.git (auto-deploy via post-receive hook) |
This repo has two remotes:
# Push to GitHub
git push origin main
# Push to Synology (auto-deploys to /volume3/docker/projects/smart/)
git push synology main
# Push to both
git push origin main && git push synology main| Resource | Value |
|---|---|
| URL | https://ha.conant.com |
| DNS | CNAME ha → conant.synology.me (auto-follows Synology DDNS) |
| Certificate | Let's Encrypt wildcard (*.conant.com + conant.com), ECC, expires May 2026 |
| Cert Tool | acme.sh v3.1.3 at /volume3/docker/acme.sh/ with GoDaddy DNS-01 challenge |
| Reverse Proxy | DSM Login Portal → Reverse Proxy: https://ha.conant.com:443 → http://localhost:8123 |
| WebSocket | Enabled (Upgrade + Connection headers) |
| Auto-Renewal | DSM Task Scheduler "Renew wildcard cert" — daily 3 AM, runs renew-and-deploy.sh |
Note: Auto-renewal renews the cert in acme.sh's store but does not re-deploy to DSM automatically. After renewal (~every 60 days), the cert must be manually re-imported via DSM Security > Certificate, or the deploy hook needs to be configured with DSM credentials.
| File | Purpose |
|---|---|
configuration.yaml |
Main config — includes Lock Monitor dashboard, http (trusted_proxies), homeassistant (external/internal URLs) |
automations.yaml |
Battery alert automation (low_battery_alert) |
dashboards/lock-monitor.yaml |
Lock Monitor dashboard layout (YAML mode) |
| Document | Scope |
|---|---|
| docs/services.md | Service registry — hardware, network, all services and their config |
| docs/runbook.md | Operational procedures, health checks, incident response |
| CHANGELOG.md | Dated log of all configuration changes |
| RECOVERY.md | Backup strategy, data classification, disaster recovery, S3 config |
| TODO.md | Planned work and roadmap |