Clearing the audit log – clarification

Help
1

This post is to request clarification on managing the Audit Log. After playing with it for a while I was wondering how to edit or reset it in the current version. The only info I was aware of previously was from when 5.0 was in beta and uses sqlite3 commands. I believe that pihole-FTL is now the preferred mechanism for interacting with the FTL database?

I also found this article which mentions the command pihole -a clearaudit. I tried that and it works and returns the Audit Log to an original unaudited state. However I can't find any reference for this option. It doesn't appear in pihole help or admin help options, nor in the man page, nor in the docs for the pihole command.

The artcle also mentions pihole -a audit <domain> and that also works, and again no references. I found one article in here from 2020 which shows all these options in an older version of pihole -h, but they appear to have gone since then.

So just clarifying if this is a deprecated feature that's going away, or help options that have lost some text at some point, or just missing docs or something else. Thanks.

2

There is no "easy" way implemented to do this. You can use the linked sql commands or use pihole -a clearaudit

Yes, it's undocumented because it is not meant to be used by users, but as a way for the web interface to trigger a shell action. There are more commands undocumented, but all other (?) can be triggered from the web interface. However, the "clear audit log" button was never added.

The commands you linked above are still there, but undocumented:

See: Missmatch of pihole -a options and decription in help and man pages · Issue #3496 · pi-hole/pi-hole · GitHub

3

Thankyou for clarifying. In normal use I wouldn't expect audited domains to ever need to be edited, any more than reconciled receipts would need to be re-reconciled. That said, the clearaudit option is a handy shortcut to know for starting over.

4

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.