Constant requests to api.github.com from Pi-Hole device

Help
1

Please follow the below template, it will help us to help you!

Expected Behaviour:

Pi-Hole was working fine for around a week or two but now I'm getting LOADS of api.github.com requests in the log coming from localhost/127.0.0.1

Actual Behaviour:

small example, this is repeatedly non stop all the time

2017-07-18 02:14:07 IPv4 api.github.com localhost OK (cached) Blacklist
2017-07-18 02:14:07 IPv6 api.github.com localhost OK (cached) Blacklist
2017-07-18 02:14:06 IPv4 api.github.com localhost OK (cached) Blacklist
2017-07-18 02:14:06 IPv6 api.github.com localhost OK (cached) Blacklist
2017-07-18 02:14:05 IPv4 api.github.com localhost OK (forwarded) Blacklist
2017-07-18 02:14:05 IPv6 api.github.com localhost OK (forwarded) Blacklist

Debug Token

qyhfkf9hj5

also, around the same time my router started going absolutely crazy connecting to my ISPs config(?) url's for some reason

2017-07-18 02:31:47 IPv4 pppacs.tpg.com.au 192.168.1.1 OK (cached) Blacklist
2017-07-18 02:31:47 IPv4 pppacs.tpg.com.au.Home 192.168.1.1 OK (cached) Blacklist
2017-07-18 02:31:47 IPv4 pppacs.tpg.com.au 192.168.1.1 OK (cached) Blacklist
2017-07-18 02:31:47 IPv4 pppacs.tpg.com.au.Home 192.168.1.1 OK (cached) Blacklist
2017-07-18 02:31:47 IPv4 pppacs.tpg.com.au 192.168.1.1 OK (cached) Blacklist
2017-07-18 02:31:47 IPv4 pppacs.tpg.com.au.Home 192.168.1.1 OK (cached) Blacklist

this happens every single minute without fail and is flooding the "top domains" section with thousands and thousands of requests each day

2

The router will probably stop flooding you if you whitelist it. Have you setup any custom scripts to check the version of Pi-hole, or are you using chronometer?

3

I haven't blacklisted any addresses - the 'Blacklist' in the text is because the button is there to click so I can blacklist it, if I want... I guess. But I haven't.

would adding it to a whitelist stop it from appearing 7000 times a day? it never happened previously

I haven't setup any custom scripts and have no idea what chronometer is. Just standard install of Pi-Hole on my N40L HP Microserver running Ubuntu 16.04

4

I guess it might be how your router is programmed then. You can try blacklisting it and see what that does.

5

so what about the stupid amount of requests to api.github.com ?

6

Are you on the latest version of the web interface? We make sure to only use the GitHub API to check the versions once every 30 min by caching the response, and I think the only other place we use the API is via pihole -v, which should not be called automatically.

7

:~$ pihole -v
Pi-hole version is v3.1 (Latest: v3.1)
AdminLTE version is v3.1 (Latest: v3.1)
FTL version is v2.9.4 (Latest: v2.9.4)

2017-07-18 05:50:33 IPv4 api.github.com localhost OK (cached) Blacklist
2017-07-18 05:50:33 IPv6 api.github.com localhost OK (cached) Blacklist
2017-07-18 05:50:32 IPv4 api.github.com localhost OK (cached) Blacklist
2017-07-18 05:50:32 IPv6 api.github.com localhost OK (cached) Blacklist
2017-07-18 05:50:31 IPv4 api.github.com localhost OK (forwarded) Blacklist
2017-07-18 05:50:31 IPv6 api.github.com localhost OK (forwarded) Blacklist
2017-07-18 05:41:55 IPv4 api.github.com localhost OK (cached) Blacklist
2017-07-18 05:41:55 IPv6 api.github.com localhost OK (cached) Blacklist
2017-07-18 05:41:54 IPv4 api.github.com localhost OK (cached) Blacklist
2017-07-18 05:41:54 IPv6 api.github.com localhost OK (cached) Blacklist
2017-07-18 05:41:53 IPv4 api.github.com localhost OK (forwarded) Blacklist
2017-07-18 05:41:53 IPv6 api.github.com localhost OK (forwarded) Blacklist
2017-07-18 03:58:41 IPv4 api.github.com localhost OK (cached) Blacklist
2017-07-18 03:58:41 IPv6 api.github.com localhost OK (cached) Blacklist
2017-07-18 03:58:39 IPv4 api.github.com localhost OK (cached) Blacklist
2017-07-18 03:58:39 IPv6 api.github.com localhost OK (cached) Blacklist
2017-07-18 03:58:38 IPv4 api.github.com localhost OK (forwarded) Blacklist
2017-07-18 03:58:38 IPv6 api.github.com localhost OK (forwarded) Blacklist
2017-07-18 03:16:32 IPv4 api.github.com localhost OK (cached) Blacklist
2017-07-18 03:16:32 IPv6 api.github.com localhost OK (cached) Blacklist
2017-07-18 03:16:31 IPv4 api.github.com localhost OK (cached) Blacklist
2017-07-18 03:16:31 IPv6 api.github.com localhost OK (cached) Blacklist
2017-07-18 03:16:30 IPv4 api.github.com localhost OK (forwarded) Blacklist
2017-07-18 03:16:30 IPv6 api.github.com localhost OK (forwarded) Blacklist

8

@frosty, do you have anything else running on your HP Microserver? (Seafile/sonarr/transmission/sarnzbd etc etc) Otherwise that's a whole lot of kit to just be running Pi-hole! Point being, I'm not so sure it's Pi-hole itself that is generating the lookups.

9

it's just used to share a few 4TB sata drives over SAMBA, thats all.... the HP MicroServers are cheap (or were cheap)

I just can't for the life of me figure out why it only just started happening a few days back. Prior to that everything was working perfectly fine, nothing was updated, changed or installed. I completely nuked Pi-Hole and started from scratch but the exact same thing starts happening.

I took a tcpdump and fed it into wireshark but when I get to the api.github.com line it was all squiggly characters around it so I couldn't see what was going on

is there any possible way to just disable the connections to github completely or turn off updates? i mean once a day would be fine but not every few minutes

the only thing I did install was fail2ban, but after all these dramas I removed it and the config files for it

10

For what they are, they're very good! I have an N54L under my desk right now that acts as my piratetotally legitimate linux distro downloading box, as well as pi-hole.

The only thing I can suggest is to maybe disable services one by one and see if they affect the rate at which the requests are made.

11

could also run pihole -t to see it live

12

I too as of recent am having my Pi-Hole RPi make excessive queries to api.github.com (6 times every 10 minutes).

2017-12-13 23:20:03 IPv4 api.github.com localhost OK (cached)
2017-12-13 23:20:03 IPv6 api.github.com localhost OK (cached)
2017-12-13 23:20:02 IPv4 api.github.com localhost OK (cached)
2017-12-13 23:20:02 IPv6 api.github.com localhost OK (cached)
2017-12-13 23:20:01 IPv4 api.github.com localhost OK (forwarded)
2017-12-13 23:20:01 IPv6 api.github.com localhost OK (forwarded)

pihole -v
Pi-hole version is v3.2 (Latest: v3.2)
AdminLTE version is v3.2 (Latest: v3.2)
FTL version is vDev-437af07 (Latest: v2.12)

crontab -e
shows no scheduled tasks

How does one troubleshoot this problem?

13

If it's happening every ten minutes, it's probably the version & branch checker. We've made it query much less often in the development version, which will be released soon(tm).

14

read this topic. to find the cause.

I've changed the cron job into:

# Pi-hole: Grab remote version and branch once a day @ 06h29
29 6 * * * root PATH="$PATH:/usr/local/bin/" pihole updatechecker

Please, use a different time...

15

Hey folks, I also have have a similar problem, currently 927 queries in last 24 hours (~1 query every 2 minutes) from localhost to api.github.com.

Pi-hole version is v3.2 (Latest: v3.2)
AdminLTE version is v3.2 (Latest: v3.2)
FTL version is vDev-437af07 (Latest: v2.12)

This is running on a raspberry pi 2 with stock raspbian Stretch and only pi-hole installed manually. I'm not overly concerned, just curious why this is happening. Installed about a month ago and its been doing this since then.

EDIT: Since I started writing this it queried github another 5 times!

16

This is fixed in the next version 3.2.1

17

Sweet! Thanks :slight_smile:

1 Like
18

This issue is resolved in v3.2.1, which was released today.