Faulty regex consumes all memory and causes issues with pihole -q

I've been using pihole -q and got some strange output

nanopi@nanopi:~$ pihole -q prophet.heise.de
/opt/pihole/query.sh: line 37: 21386 Killed                  awk 'NR==FNR{regexps[$0];next}{for (r in regexps)if($0 ~ r)print r}' <(echo "${lists}") <(echo "${domain}") 2> /dev/null
 Match found in https://hosts-file.net/ad_servers.txt:
   prophet.heise.de 

I'm unsure what the first line means - error at line 37?

/opt/pihole/query.sh: line 37: 21500 Killed                  awk 'NR==FNR{regexps[$0];next}{for (r in regexps)if($0 ~ r)print r}' <(echo "${lists}") <(echo "${domain}") 2> /dev/null

The relevant part of query.sh is

# /dev/null forces filename to be printed when only one list has been generated
    # shellcheck disable=SC2086
    case "${type}" in
        "exact" ) grep -i -E -l "(^|(?<!#)\\s)${esc_domain}($|\\s|#)" ${lists} /dev/null 2>/dev/null;;
        # Create array of regexps
        # Iterate through each regexp and check whether it matches the domainQuery
        # If it does, print the matching regexp and continue looping
        # Input 1 - regexps | Input 2 - domainQuery
        "regex" ) awk 'NR==FNR{regexps[$0];next}{for (r in regexps)if($0 ~ r)print r}' \
                  <(echo "${lists}") <(echo "${domain}") 2>/dev/null;;
        *       ) grep -i "${esc_domain}" ${lists} /dev/null 2>/dev/null;;
    esac

Are you on the most recent beta?

  Pi-hole version is v4.3.2-433-g8ecaaba (Latest: v4.3.5)
  AdminLTE version is v4.3.2-433-g0b4a5de5 (Latest: v4.3.3)
  FTL version is vDev-71e8498 (Latest: v4.3.1)

Yes.

  Pi-hole version is v4.3.2-433-g8ecaaba (Latest: v4.3.5)
  AdminLTE version is v4.3.2-433-g0b4a5de (Latest: v4.3.3)
  FTL version is vDev-71e8498 (Latest: v4.3.1

Debug token please.

Your init system has killed the process for some reason. Could be the process took too long, used too many resources or the system needed to purge running tasks for its own needs.

Edit: May be a bad regex is looping as well. The debug log will help a lot.

https://tricorder.pi-hole.net/mdjcygjqmz

What is the board that this is running on? How much RAM and free disk space?

You're running out of resources and the init system is trying to kill what it can to keep from going down:

   2020-02-25 11:06:07: (server.c.1464) server started (lighttpd/1.4.53) 
   2020-02-25 12:17:17: (mod_fastcgi.c.421) FastCGI-stderr: PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 20480 bytes) in /var/www/html/admin/api_db.php on line 112
   2020-02-25 19:34:45: (mod_fastcgi.c.421) FastCGI-stderr: PHP Warning:  file(http://127.0.0.1/admin/scripts/pi-hole/php/queryads.php?domain=localhost&amp;bp): failed to open stream: HTTP request failed! in /var/www/html/pihole/index.php on line 134
   2020-02-25 19:34:45: (mod_fastcgi.c.421) FastCGI-stderr: PHP Warning:  array_filter() expects parameter 1 to be array, string given in /var/www/html/pihole/index.php on line 135
   2020-02-25 19:34:45: (mod_fastcgi.c.421) FastCGI-stderr: PHP Warning:  array_values() expects parameter 1 to be array, null given in /var/www/html/pihole/index.php on line 135
   2020-02-25 19:34:48: (mod_fastcgi.c.421) FastCGI-stderr: PHP Warning:  file(http://127.0.0.1/admin/scripts/pi-hole/php/queryads.php?domain=localhost&amp;bp): failed to open stream: HTTP request failed! in /var/www/html/pihole/index.php on line 134
   2020-02-25 19:34:48: (mod_fastcgi.c.421) FastCGI-stderr: PHP Warning:  array_filter() expects parameter 1 to be array, string given in /var/www/html/pihole/index.php on line 135
   2020-02-25 19:34:48: (mod_fastcgi.c.421) FastCGI-stderr: PHP Warning:  array_values() expects parameter 1 to be array, null given in /var/www/html/pihole/index.php on line 135
   [2020-02-25 12:24:01.862 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:01.912 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.1 msec
   [2020-02-25 12:24:14.388 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:14.439 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.1 msec
   [2020-02-25 12:24:17.269 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:17.320 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.0 msec
   [2020-02-25 12:24:17.930 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:17.980 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.0 msec
   [2020-02-25 12:24:18.938 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:18.988 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.1 msec
   [2020-02-25 12:24:20.229 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:20.278 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.1 msec
   [2020-02-25 12:24:20.911 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:20.976 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.1 msec
   [2020-02-25 12:24:24.105 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:24.155 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.2 msec
   [2020-02-25 12:24:28.357 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:28.407 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.2 msec
   [2020-02-25 12:24:30.845 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:30.892 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.2 msec
   [2020-02-25 12:24:32.088 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:32.140 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.2 msec
   [2020-02-25 12:24:32.638 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:32.687 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.3 msec
   [2020-02-25 12:24:34.373 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:34.425 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.3 msec
   [2020-02-25 12:24:35.045 19005] Received: Real-time signal 0 (34 -> 0)
   [2020-02-25 12:24:35.093 19005] Compiled 1 whitelist and 23 blacklist regex filters in 15.3 msec

Mhh, strange. I have a NanoPi Neo Plus 2, with Pihole being the only thing running on it. 1GB RAM.

nanopi@nanopi:~$ free -m
              total        used        free      shared  buff/cache   available
Mem:            989         146         744           1          97         767
Swap:           494          95         398
nanopi@nanopi:~$ df -ha
Filesystem      Size  Used Avail Use% Mounted on
sysfs              0     0     0    - /sys
proc               0     0     0    - /proc
udev            426M     0  426M   0% /dev
devpts             0     0     0    - /dev/pts
tmpfs            99M   11M   89M  11% /run
/dev/mmcblk2p1  7,1G  1,6G  5,2G  23% /
securityfs         0     0     0    - /sys/kernel/security
tmpfs           495M  900K  494M   1% /dev/shm
tmpfs           5,0M  4,0K  5,0M   1% /run/lock
tmpfs           495M     0  495M   0% /sys/fs/cgroup
cgroup2            0     0     0    - /sys/fs/cgroup/unified
cgroup             0     0     0    - /sys/fs/cgroup/systemd
cgroup             0     0     0    - /sys/fs/cgroup/cpu,cpuacct
cgroup             0     0     0    - /sys/fs/cgroup/blkio
cgroup             0     0     0    - /sys/fs/cgroup/rdma
cgroup             0     0     0    - /sys/fs/cgroup/perf_event
cgroup             0     0     0    - /sys/fs/cgroup/hugetlb
cgroup             0     0     0    - /sys/fs/cgroup/devices
cgroup             0     0     0    - /sys/fs/cgroup/net_cls,net_prio
cgroup             0     0     0    - /sys/fs/cgroup/memory
cgroup             0     0     0    - /sys/fs/cgroup/freezer
cgroup             0     0     0    - /sys/fs/cgroup/pids
cgroup             0     0     0    - /sys/fs/cgroup/cpuset
hugetlbfs          0     0     0    - /dev/hugepages
mqueue             0     0     0    - /dev/mqueue
debugfs            0     0     0    - /sys/kernel/debug
systemd-1          0     0     0    - /proc/sys/fs/binfmt_misc
configfs           0     0     0    - /sys/kernel/config
tmpfs           495M  9,1M  486M   2% /tmp
/dev/mmcblk2p1  7,1G  1,6G  5,2G  23% /var/log.hdd
/dev/zram0       49M  8,0M   37M  18% /var/log
tmpfs            99M     0   99M   0% /run/user/998
tmpfs            99M     0   99M   0% /run/user/1000

Seems like I run out of memory when pihole -q is running. It returns to normal state immediately after the process stops/is killed.

Can you disable your regex filters and try them one at a time to see if one of them is causing the spike?

And can you disable file:///home/nanopi/blacklist_spy-adware.txt to see if that file contents are related to the issue?

Disabled all regex filters via web GUI and the file:/// adlist. Performed pihole -g, but error still occurs

 [βœ“] Storing downloaded domains in new gravity database
  [βœ“] Building tree
  [βœ“] Swapping databases
  [i] Number of gravity domains: 252334 (204806 unique domains)
  [i] Number of exact blacklisted domains: 6
  [i] Number of regex blacklist filters: 0
  [i] Number of exact whitelisted domains: 3
  [i] Number of regex whitelist filters: 0
  [βœ“] Flushing DNS cache
  [βœ“] Cleaning up stray matter

  [βœ“] DNS service is running
  [βœ“] Pi-hole blocking is Enabled
nanopi@nanopi:~$ pihole -q gstatic.com
/opt/pihole/query.sh: line 37: 11252 Killed                  awk 'NR==FNR{regexps[$0];next}{for (r in regexps)if($0 ~ r)print r}' <(echo "${lists}") <(echo "${domain}") 2> /dev/null
 Match found in https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts:
   csi.gstatic.com 

Okay, try going through the adlists then.

This is the line for the PHP Fatal error:

Tried with the 6 default adlists: failed

nanopi@nanopi:~$ pihole -g
[sudo] password for nanopi: 
  [i] Neutrino emissions detected...
  [βœ“] Pulling blocklist source list into range

  [βœ“] Preparing new gravity database
  [i] Target: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
  [βœ“] Status: Retrieval successful
  [i] Received 51220 domains

  [i] Target: https://mirror1.malwaredomains.com/files/justdomains
  [βœ“] Status: No changes detected
  [i] Received 26860 domains

  [i] Target: http://sysctl.org/cameleon/hosts
  [βœ“] Status: No changes detected
  [i] Received 20567 domains

  [i] Target: https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt
  [βœ“] Status: No changes detected
  [i] Received 34 domains

  [i] Target: https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
  [βœ“] Status: No changes detected
  [i] Received 2701 domains

  [i] Target: https://hosts-file.net/ad_servers.txt
  [βœ“] Status: No changes detected
  [i] Received 45736 domains

  [βœ“] Storing downloaded domains in new gravity database
  [βœ“] Building tree
  [βœ“] Swapping databases
  [i] Number of gravity domains: 147118 (125108 unique domains)
  [i] Number of exact blacklisted domains: 6
  [i] Number of regex blacklist filters: 0
  [i] Number of exact whitelisted domains: 3
  [i] Number of regex whitelist filters: 0
  [βœ“] Flushing DNS cache
  [βœ“] Cleaning up stray matter

  [βœ“] DNS service is running
  [βœ“] Pi-hole blocking is Enabled
nanopi@nanopi:~$ pihole -q gstatic.com
/opt/pihole/query.sh: line 37: 14510 Killed                  awk 'NR==FNR{regexps[$0];next}{for (r in regexps)if($0 ~ r)print r}' <(echo "${lists}") <(echo "${domain}") 2> /dev/null
 Match found in https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts:
   csi.gstatic.com 
 Match found in https://hosts-file.net/ad_servers.txt:
   csi.gstatic.com 
   p2-aahhyknavsj2m-wtnlrzkba6lht33q-if-v6exp3-v4.metric.gstatic.com 
   p2-f6rp6piuxns4u-uzq4vp76bu3w2tso-if-v6exp3-v4.metric.gstatic.com 
   p2-n3zurhre4jjvk-can5rb2f2a4urcxh-if-v6exp3-v4.metric.gstatic.com 
   p4-ajvwyt5lpjazy-us7r2dzqcjsqh7pt-164149-i1-v6exp3-v4.metric.gstatic.com 
   p4-ajvwyt5lpjazy-us7r2dzqcjsqh7pt-164149-i2-v6exp3-ds.metric.gstatic.com 
   p4-ajvwyt5lpjazy-us7r2dzqcjsqh7pt-164149-s1-v6exp3-v4.metric.gstatic.com 
   p4-ajvwyt5lpjazy-us7r2dzqcjsqh7pt-if-v6exp3-v4.metric.gstatic.com 
   p5-lj5aujgj7jl7w-r2pmxqvndsgx2im2-931517-i1-v6exp3-v4.metric.gstatic.com 
   p5-lj5aujgj7jl7w-r2pmxqvndsgx2im2-931517-i2-v6exp3-ds.metric.gstatic.com 
   s6.netlogstatic.com 
   v6exp3-ds.metric.gstatic.com 
   v6exp3-v4.metric.gstatic.com 

Tried with only one default adlist: failed

nanopi@nanopi:~$ pihole -g
  [i] Neutrino emissions detected...
  [βœ“] Pulling blocklist source list into range

  [βœ“] Preparing new gravity database
  [i] Target: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
  [βœ“] Status: Retrieval successful
  [i] Received 51220 domains

  [βœ“] Storing downloaded domains in new gravity database
  [βœ“] Building tree
  [βœ“] Swapping databases
  [i] Number of gravity domains: 51220 (51220 unique domains)
  [i] Number of exact blacklisted domains: 6
  [i] Number of regex blacklist filters: 0
  [i] Number of exact whitelisted domains: 3
  [i] Number of regex whitelist filters: 0
  [βœ“] Flushing DNS cache
  [βœ“] Cleaning up stray matter

  [βœ“] DNS service is running
  [βœ“] Pi-hole blocking is Enabled
nanopi@nanopi:~$ pihole -q gstatic.com
/opt/pihole/query.sh: line 37: 14732 Killed                  awk 'NR==FNR{regexps[$0];next}{for (r in regexps)if($0 ~ r)print r}' <(echo "${lists}") <(echo "${domain}") 2> /dev/null
 Match found in https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts:
   csi.gstatic.com 

Tried with another default adlist: failed

nanopi@nanopi:~$ pihole -g
  [i] Neutrino emissions detected...
  [βœ“] Pulling blocklist source list into range

  [βœ“] Preparing new gravity database
  [i] Target: https://mirror1.malwaredomains.com/files/justdomains
  [βœ“] Status: Retrieval successful
  [i] Received 26860 domains

  [βœ“] Storing downloaded domains in new gravity database
  [βœ“] Building tree
  [βœ“] Swapping databases
  [i] Number of gravity domains: 26860 (26860 unique domains)
  [i] Number of exact blacklisted domains: 6
  [i] Number of regex blacklist filters: 0
  [i] Number of exact whitelisted domains: 3
  [i] Number of regex whitelist filters: 0
  [βœ“] Flushing DNS cache
  [βœ“] Cleaning up stray matter

  [βœ“] DNS service is running
  [βœ“] Pi-hole blocking is Enabled
nanopi@nanopi:~$ pihole -q gstatic.com
/opt/pihole/query.sh: line 37: 14867 Killed                  awk 'NR==FNR{regexps[$0];next}{for (r in regexps)if($0 ~ r)print r}' <(echo "${lists}") <(echo "${domain}") 2> /dev/null
  [i] No results found for gstatic.com within the block lists

Disabled all exact white- and blacklist and only one default adlist: failed

nanopi@nanopi:~$ pihole -g
  [i] Neutrino emissions detected...
  [βœ“] Pulling blocklist source list into range

  [βœ“] Preparing new gravity database
  [i] Target: https://mirror1.malwaredomains.com/files/justdomains
  [βœ“] Status: No changes detected
  [i] Received 26860 domains

  [βœ“] Storing downloaded domains in new gravity database
  [βœ“] Building tree
  [βœ“] Swapping databases
  [i] Number of gravity domains: 26860 (26860 unique domains)
  [i] Number of exact blacklisted domains: 0
  [i] Number of regex blacklist filters: 0
  [i] Number of exact whitelisted domains: 0
  [i] Number of regex whitelist filters: 0
  [βœ“] Flushing DNS cache
  [βœ“] Cleaning up stray matter

  [βœ“] DNS service is running
  [βœ“] Pi-hole blocking is Enabled
nanopi@nanopi:~$ pihole -q gstatic.com
/opt/pihole/query.sh: line 37: 15062 Killed                  awk 'NR==FNR{regexps[$0];next}{for (r in regexps)if($0 ~ r)print r}' <(echo "${lists}") <(echo "${domain}") 2> /dev/null
  [i] No results found for gstatic.com within the block lists

Thank you for the detailed information. I'm not sure what is causing the issue, I'll try to get you a test command that runs query.sh with bash -x, I need to see what command line positional variables to use.

sudo bash -x /opt/pihole/query.sh <XXX> <YYY>

I'm not quite sure what you meant with <XXX> <YYY>

nanopi@nanopi:~$ sudo bash -x /opt/pihole/query.sh gstatic.com
[sudo] password for nanopi: 
+ piholeDir=/etc/pihole
+ gravityDBfile=/etc/pihole/gravity.db
+ options=gstatic.com
+ all=
+ exact=
+ blockpage=
+ matchType=match
+ colfile=/opt/pihole/COL_TABLE
+ source /opt/pihole/COL_TABLE
++ [[ -t 1 ]]
+++ tput colors
++ [[ 256 -ge 8 ]]
++ COL_BOLD=''
++ COL_ULINE=''
++ COL_NC=''
++ COL_GRAY=''
++ COL_RED=''
++ COL_GREEN=''
++ COL_YELLOW=''
++ COL_BLUE=''
++ COL_PURPLE=''
++ COL_CYAN=''
++ COL_WHITE=''
++ COL_BLACK=''
++ COL_LIGHT_BLUE=''
++ COL_LIGHT_GREEN=''
++ COL_LIGHT_CYAN=''
++ COL_LIGHT_RED=''
++ COL_URG_RED=''
++ COL_LIGHT_PURPLE=''
++ COL_BROWN=''
++ COL_LIGHT_GRAY=''
++ COL_DARK_GRAY=''
++ TICK='[βœ“]'
++ CROSS='[βœ—]'
++ INFO='[i]'
++ QST='[?]'
++ DONE=' done!'
++ OVER='\r'
+ [[ gstatic.com == \-\h ]]
+ [[ gstatic.com == \-\-\h\e\l\p ]]
+ [[ gstatic.com == *\-\b\p* ]]
+ [[ gstatic.com == *\-\a\l\l* ]]
+ [[ gstatic.com == *\-\e\x\a\c\t* ]]
++ sed -E 's/ ?-(bp|adlists?|all|exact) ?//g'
+ options=gstatic.com
+ case "${options}" in
+ domainQuery=gstatic.com
+ [[ -n '' ]]
+ scanDatabaseTable gstatic.com whitelist 0
+ local domain table type querystr result extra
++ printf %q gstatic.com
+ domain=gstatic.com
+ table=whitelist
+ type=0
+ [[ whitelist == \g\r\a\v\i\t\y ]]
+ case "${exact}" in
+ querystr='SELECT domain,enabled FROM domainlist WHERE type = '\''0'\'' AND domain LIKE '\''%gstatic.com%'\'' ESCAPE '\''\'\'''
++ sqlite3 /etc/pihole/gravity.db 'SELECT domain,enabled FROM domainlist WHERE type = '\''0'\'' AND domain LIKE '\''%gstatic.com%'\'' ESCAPE '\''\'\'''
+ result=
+ [[ -z '' ]]
+ return
+ scanDatabaseTable gstatic.com blacklist 1
+ local domain table type querystr result extra
++ printf %q gstatic.com
+ domain=gstatic.com
+ table=blacklist
+ type=1
+ [[ blacklist == \g\r\a\v\i\t\y ]]
+ case "${exact}" in
+ querystr='SELECT domain,enabled FROM domainlist WHERE type = '\''1'\'' AND domain LIKE '\''%gstatic.com%'\'' ESCAPE '\''\'\'''
++ sqlite3 /etc/pihole/gravity.db 'SELECT domain,enabled FROM domainlist WHERE type = '\''1'\'' AND domain LIKE '\''%gstatic.com%'\'' ESCAPE '\''\'\'''
+ result=
+ [[ -z '' ]]
+ return
+ scanRegexDatabaseTable gstatic.com whitelist 2
+ local domain list
+ domain=gstatic.com
+ list=whitelist
+ type=2
+ mapfile -t regexList
++ sqlite3 /etc/pihole/gravity.db 'SELECT domain FROM domainlist WHERE type = 2'
+ [[ 1 -ne 0 ]]
++ printf '%s\n' '(\.|^)*\.services\.generalmagic\.com$'
+ str_regexList='(\.|^)*\.services\.generalmagic\.com$'
+ mapfile -t regexMatches
++ scanList gstatic.com '(\.|^)*\.services\.generalmagic\.com$' regex
++ local domain=gstatic.com 'esc_domain=gstatic\.com' 'lists=(\.|^)*\.services\.generalmagic\.com$' type=regex
++ cd /etc/pihole
++ export LC_CTYPE=C
++ LC_CTYPE=C
++ case "${type}" in
+++ echo '(\.|^)*\.services\.generalmagic\.com$'
++ awk 'NR==FNR{regexps[$0];next}{for (r in regexps)if($0 ~ r)print r}' /dev/fd/63 /dev/fd/62
+++ echo gstatic.com
/opt/pihole/query.sh: line 37:  4134 Killed                  awk 'NR==FNR{regexps[$0];next}{for (r in regexps)if($0 ~ r)print r}' <(echo "${lists}") <(echo "${domain}") 2> /dev/null
+ [[ 0 -ne 0 ]]
+ scanRegexDatabaseTable gstatic.com blacklist 3
+ local domain list
+ domain=gstatic.com
+ list=blacklist
+ type=3
+ mapfile -t regexList
++ sqlite3 /etc/pihole/gravity.db 'SELECT domain FROM domainlist WHERE type = 3'
+ [[ 23 -ne 0 ]]
++ printf '%s\n' '^(.+[.-])?ad[sxv]?[0-9]*[.-]' '^(.+[.-])?adse?rv(er?|ice)?s?[0-9]*[.-]' '^(.+[.-])?telemetry[.-]' '^(www[0-9].)?xn–' '^adim(age|g)s?[0-9][.-]' '^adtrack(er|ing)?[0-9]*[.-]' '^advert(s|is(ing|ements?))?[0-9][.-]' '^aff(iliat(es?|ion))?[.-]' '^analytics?[.-]' '^banners?[.-]' '^beacons?[0-9][.-]' '^count(ers?)?[0-9]*[.-]' '^mads.' '^pixels?[-.]' '^stat(s|istics)?[0-9][_.-]' '^track(ers?|ing)?[0-9][_.-]' '^traff(ic)?[.-]' '^.*metric.*\..*\..*$' '^logs?\..*\..*$' '(^|[-_.]+)(m?a(d((vert(s|is(ing|e?ments?))?|im(age|g)s?)|([vx]|s(e?rv(er?|ice)?s?)?)|track(ers?|ing))?|ff(iliat(es?|ion))?|nalytics?)|b((anner|eacon)s?)|count(ers?)?|pixels?|stat(s|istics?)?|t(elemetry|ra(ffic|ck(ers?|ing))))[-_]*[0-9]*[-_.]' '^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-]' '^(.+[_.-])?ad[sxv]?[0-9]*[_.-]' '(^|\.)asn\.advolution\.de$'
+ str_regexList='^(.+[.-])?ad[sxv]?[0-9]*[.-]
^(.+[.-])?adse?rv(er?|ice)?s?[0-9]*[.-]
^(.+[.-])?telemetry[.-]
^(www[0-9].)?xn–
^adim(age|g)s?[0-9][.-]
^adtrack(er|ing)?[0-9]*[.-]
^advert(s|is(ing|ements?))?[0-9][.-]
^aff(iliat(es?|ion))?[.-]
^analytics?[.-]
^banners?[.-]
^beacons?[0-9][.-]
^count(ers?)?[0-9]*[.-]
^mads.
^pixels?[-.]
^stat(s|istics)?[0-9][_.-]
^track(ers?|ing)?[0-9][_.-]
^traff(ic)?[.-]
^.*metric.*\..*\..*$
^logs?\..*\..*$
(^|[-_.]+)(m?a(d((vert(s|is(ing|e?ments?))?|im(age|g)s?)|([vx]|s(e?rv(er?|ice)?s?)?)|track(ers?|ing))?|ff(iliat(es?|ion))?|nalytics?)|b((anner|eacon)s?)|count(ers?)?|pixels?|stat(s|istics?)?|t(elemetry|ra(ffic|ck(ers?|ing))))[-_]*[0-9]*[-_.]
^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-]
^(.+[_.-])?ad[sxv]?[0-9]*[_.-]
(^|\.)asn\.advolution\.de$'
+ mapfile -t regexMatches
++ scanList gstatic.com '^(.+[.-])?ad[sxv]?[0-9]*[.-]
^(.+[.-])?adse?rv(er?|ice)?s?[0-9]*[.-]
^(.+[.-])?telemetry[.-]
^(www[0-9].)?xn–
^adim(age|g)s?[0-9][.-]
^adtrack(er|ing)?[0-9]*[.-]
^advert(s|is(ing|ements?))?[0-9][.-]
^aff(iliat(es?|ion))?[.-]
^analytics?[.-]
^banners?[.-]
^beacons?[0-9][.-]
^count(ers?)?[0-9]*[.-]
^mads.
^pixels?[-.]
^stat(s|istics)?[0-9][_.-]
^track(ers?|ing)?[0-9][_.-]
^traff(ic)?[.-]
^.*metric.*\..*\..*$
^logs?\..*\..*$
(^|[-_.]+)(m?a(d((vert(s|is(ing|e?ments?))?|im(age|g)s?)|([vx]|s(e?rv(er?|ice)?s?)?)|track(ers?|ing))?|ff(iliat(es?|ion))?|nalytics?)|b((anner|eacon)s?)|count(ers?)?|pixels?|stat(s|istics?)?|t(elemetry|ra(ffic|ck(ers?|ing))))[-_]*[0-9]*[-_.]
^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-]
^(.+[_.-])?ad[sxv]?[0-9]*[_.-]
(^|\.)asn\.advolution\.de$' regex
++ local domain=gstatic.com 'esc_domain=gstatic\.com' 'lists=^(.+[.-])?ad[sxv]?[0-9]*[.-]
^(.+[.-])?adse?rv(er?|ice)?s?[0-9]*[.-]
^(.+[.-])?telemetry[.-]
^(www[0-9].)?xn–
^adim(age|g)s?[0-9][.-]
^adtrack(er|ing)?[0-9]*[.-]
^advert(s|is(ing|ements?))?[0-9][.-]
^aff(iliat(es?|ion))?[.-]
^analytics?[.-]
^banners?[.-]
^beacons?[0-9][.-]
^count(ers?)?[0-9]*[.-]
^mads.
^pixels?[-.]
^stat(s|istics)?[0-9][_.-]
^track(ers?|ing)?[0-9][_.-]
^traff(ic)?[.-]
^.*metric.*\..*\..*$
^logs?\..*\..*$
(^|[-_.]+)(m?a(d((vert(s|is(ing|e?ments?))?|im(age|g)s?)|([vx]|s(e?rv(er?|ice)?s?)?)|track(ers?|ing))?|ff(iliat(es?|ion))?|nalytics?)|b((anner|eacon)s?)|count(ers?)?|pixels?|stat(s|istics?)?|t(elemetry|ra(ffic|ck(ers?|ing))))[-_]*[0-9]*[-_.]
^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-]
^(.+[_.-])?ad[sxv]?[0-9]*[_.-]
(^|\.)asn\.advolution\.de$' type=regex
++ cd /etc/pihole
++ export LC_CTYPE=C
++ LC_CTYPE=C
++ case "${type}" in
+++ echo '^(.+[.-])?ad[sxv]?[0-9]*[.-]
^(.+[.-])?adse?rv(er?|ice)?s?[0-9]*[.-]
^(.+[.-])?telemetry[.-]
^(www[0-9].)?xn–
^adim(age|g)s?[0-9][.-]
^adtrack(er|ing)?[0-9]*[.-]
^advert(s|is(ing|ements?))?[0-9][.-]
^aff(iliat(es?|ion))?[.-]
^analytics?[.-]
^banners?[.-]
^beacons?[0-9][.-]
^count(ers?)?[0-9]*[.-]
^mads.
^pixels?[-.]
^stat(s|istics)?[0-9][_.-]
^track(ers?|ing)?[0-9][_.-]
^traff(ic)?[.-]
^.*metric.*\..*\..*$
^logs?\..*\..*$
(^|[-_.]+)(m?a(d((vert(s|is(ing|e?ments?))?|im(age|g)s?)|([vx]|s(e?rv(er?|ice)?s?)?)|track(ers?|ing))?|ff(iliat(es?|ion))?|nalytics?)|b((anner|eacon)s?)|count(ers?)?|pixels?|stat(s|istics?)?|t(elemetry|ra(ffic|ck(ers?|ing))))[-_]*[0-9]*[-_.]
^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-]
^(.+[_.-])?ad[sxv]?[0-9]*[_.-]
(^|\.)asn\.advolution\.de$'
++ awk 'NR==FNR{regexps[$0];next}{for (r in regexps)if($0 ~ r)print r}' /dev/fd/63 /dev/fd/62
+++ echo gstatic.com
+ [[ 0 -ne 0 ]]
+ mapfile -t results
++ scanDatabaseTable gstatic.com gravity
++ local domain table type querystr result extra
+++ printf %q gstatic.com
++ domain=gstatic.com
++ table=gravity
++ type=
++ [[ gravity == \g\r\a\v\i\t\y ]]
++ case "${exact}" in
++ querystr='SELECT gravity.domain,adlist.address,adlist.enabled FROM gravity LEFT JOIN adlist ON adlist.id = gravity.adlist_id WHERE domain LIKE '\''%gstatic.com%'\'' ESCAPE '\''\'\'''
+++ sqlite3 /etc/pihole/gravity.db 'SELECT gravity.domain,adlist.address,adlist.enabled FROM gravity LEFT JOIN adlist ON adlist.id = gravity.adlist_id WHERE domain LIKE '\''%gstatic.com%'\'' ESCAPE '\''\'\'''
++ result=
++ [[ -z '' ]]
++ return
+ [[ -z '' ]]
+ [[ -z '' ]]
+ [[ -z '' ]]
+ echo -e '  [i] No results found for gstatic.com within the block lists'
  [i] No results found for gstatic.com within the block lists
+ exit 0

It seems to be killed while scanning the whitelist regex. Not sure why it is still scanning this list, because I disabled all regex for this test.

EDIT

Yes, it was the whitelist regex

(\.|^)*\.services\.generalmagic\.com$

Despite being already disabled I removed it via web UI and pihole -q runs very fast without error.

nanopi@nanopi:~$ pihole -q gstatic.com
  [i] No results found for gstatic.com within the block lists
nanopi@nanopi:~$ sudo bash -x /opt/pihole/query.sh gstatic.com
+ piholeDir=/etc/pihole
+ gravityDBfile=/etc/pihole/gravity.db
+ options=gstatic.com
+ all=
+ exact=
+ blockpage=
+ matchType=match
+ colfile=/opt/pihole/COL_TABLE
+ source /opt/pihole/COL_TABLE
++ [[ -t 1 ]]
+++ tput colors
++ [[ 256 -ge 8 ]]
++ COL_BOLD=''
++ COL_ULINE=''
++ COL_NC=''
++ COL_GRAY=''
++ COL_RED=''
++ COL_GREEN=''
++ COL_YELLOW=''
++ COL_BLUE=''
++ COL_PURPLE=''
++ COL_CYAN=''
++ COL_WHITE=''
++ COL_BLACK=''
++ COL_LIGHT_BLUE=''
++ COL_LIGHT_GREEN=''
++ COL_LIGHT_CYAN=''
++ COL_LIGHT_RED=''
++ COL_URG_RED=''
++ COL_LIGHT_PURPLE=''
++ COL_BROWN=''
++ COL_LIGHT_GRAY=''
++ COL_DARK_GRAY=''
++ TICK='[βœ“]'
++ CROSS='[βœ—]'
++ INFO='[i]'
++ QST='[?]'
++ DONE=' done!'
++ OVER='\r'
+ [[ gstatic.com == \-\h ]]
+ [[ gstatic.com == \-\-\h\e\l\p ]]
+ [[ gstatic.com == *\-\b\p* ]]
+ [[ gstatic.com == *\-\a\l\l* ]]
+ [[ gstatic.com == *\-\e\x\a\c\t* ]]
++ sed -E 's/ ?-(bp|adlists?|all|exact) ?//g'
+ options=gstatic.com
+ case "${options}" in
+ domainQuery=gstatic.com
+ [[ -n '' ]]
+ scanDatabaseTable gstatic.com whitelist 0
+ local domain table type querystr result extra
++ printf %q gstatic.com
+ domain=gstatic.com
+ table=whitelist
+ type=0
+ [[ whitelist == \g\r\a\v\i\t\y ]]
+ case "${exact}" in
+ querystr='SELECT domain,enabled FROM domainlist WHERE type = '\''0'\'' AND domain LIKE '\''%gstatic.com%'\'' ESCAPE '\''\'\'''
++ sqlite3 /etc/pihole/gravity.db 'SELECT domain,enabled FROM domainlist WHERE type = '\''0'\'' AND domain LIKE '\''%gstatic.com%'\'' ESCAPE '\''\'\'''
+ result=
+ [[ -z '' ]]
+ return
+ scanDatabaseTable gstatic.com blacklist 1
+ local domain table type querystr result extra
++ printf %q gstatic.com
+ domain=gstatic.com
+ table=blacklist
+ type=1
+ [[ blacklist == \g\r\a\v\i\t\y ]]
+ case "${exact}" in
+ querystr='SELECT domain,enabled FROM domainlist WHERE type = '\''1'\'' AND domain LIKE '\''%gstatic.com%'\'' ESCAPE '\''\'\'''
++ sqlite3 /etc/pihole/gravity.db 'SELECT domain,enabled FROM domainlist WHERE type = '\''1'\'' AND domain LIKE '\''%gstatic.com%'\'' ESCAPE '\''\'\'''
+ result=
+ [[ -z '' ]]
+ return
+ scanRegexDatabaseTable gstatic.com whitelist 2
+ local domain list
+ domain=gstatic.com
+ list=whitelist
+ type=2
+ mapfile -t regexList
++ sqlite3 /etc/pihole/gravity.db 'SELECT domain FROM domainlist WHERE type = 2'
+ [[ 0 -ne 0 ]]
+ scanRegexDatabaseTable gstatic.com blacklist 3
+ local domain list
+ domain=gstatic.com
+ list=blacklist
+ type=3
+ mapfile -t regexList
++ sqlite3 /etc/pihole/gravity.db 'SELECT domain FROM domainlist WHERE type = 3'
+ [[ 23 -ne 0 ]]
++ printf '%s\n' '^(.+[.-])?ad[sxv]?[0-9]*[.-]' '^(.+[.-])?adse?rv(er?|ice)?s?[0-9]*[.-]' '^(.+[.-])?telemetry[.-]' '^(www[0-9].)?xn–' '^adim(age|g)s?[0-9][.-]' '^adtrack(er|ing)?[0-9]*[.-]' '^advert(s|is(ing|ements?))?[0-9][.-]' '^aff(iliat(es?|ion))?[.-]' '^analytics?[.-]' '^banners?[.-]' '^beacons?[0-9][.-]' '^count(ers?)?[0-9]*[.-]' '^mads.' '^pixels?[-.]' '^stat(s|istics)?[0-9][_.-]' '^track(ers?|ing)?[0-9][_.-]' '^traff(ic)?[.-]' '^.*metric.*\..*\..*$' '^logs?\..*\..*$' '(^|[-_.]+)(m?a(d((vert(s|is(ing|e?ments?))?|im(age|g)s?)|([vx]|s(e?rv(er?|ice)?s?)?)|track(ers?|ing))?|ff(iliat(es?|ion))?|nalytics?)|b((anner|eacon)s?)|count(ers?)?|pixels?|stat(s|istics?)?|t(elemetry|ra(ffic|ck(ers?|ing))))[-_]*[0-9]*[-_.]' '^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-]' '^(.+[_.-])?ad[sxv]?[0-9]*[_.-]' '(^|\.)asn\.advolution\.de$'
+ str_regexList='^(.+[.-])?ad[sxv]?[0-9]*[.-]
^(.+[.-])?adse?rv(er?|ice)?s?[0-9]*[.-]
^(.+[.-])?telemetry[.-]
^(www[0-9].)?xn–
^adim(age|g)s?[0-9][.-]
^adtrack(er|ing)?[0-9]*[.-]
^advert(s|is(ing|ements?))?[0-9][.-]
^aff(iliat(es?|ion))?[.-]
^analytics?[.-]
^banners?[.-]
^beacons?[0-9][.-]
^count(ers?)?[0-9]*[.-]
^mads.
^pixels?[-.]
^stat(s|istics)?[0-9][_.-]
^track(ers?|ing)?[0-9][_.-]
^traff(ic)?[.-]
^.*metric.*\..*\..*$
^logs?\..*\..*$
(^|[-_.]+)(m?a(d((vert(s|is(ing|e?ments?))?|im(age|g)s?)|([vx]|s(e?rv(er?|ice)?s?)?)|track(ers?|ing))?|ff(iliat(es?|ion))?|nalytics?)|b((anner|eacon)s?)|count(ers?)?|pixels?|stat(s|istics?)?|t(elemetry|ra(ffic|ck(ers?|ing))))[-_]*[0-9]*[-_.]
^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-]
^(.+[_.-])?ad[sxv]?[0-9]*[_.-]
(^|\.)asn\.advolution\.de$'
+ mapfile -t regexMatches
++ scanList gstatic.com '^(.+[.-])?ad[sxv]?[0-9]*[.-]
^(.+[.-])?adse?rv(er?|ice)?s?[0-9]*[.-]
^(.+[.-])?telemetry[.-]
^(www[0-9].)?xn–
^adim(age|g)s?[0-9][.-]
^adtrack(er|ing)?[0-9]*[.-]
^advert(s|is(ing|ements?))?[0-9][.-]
^aff(iliat(es?|ion))?[.-]
^analytics?[.-]
^banners?[.-]
^beacons?[0-9][.-]
^count(ers?)?[0-9]*[.-]
^mads.
^pixels?[-.]
^stat(s|istics)?[0-9][_.-]
^track(ers?|ing)?[0-9][_.-]
^traff(ic)?[.-]
^.*metric.*\..*\..*$
^logs?\..*\..*$
(^|[-_.]+)(m?a(d((vert(s|is(ing|e?ments?))?|im(age|g)s?)|([vx]|s(e?rv(er?|ice)?s?)?)|track(ers?|ing))?|ff(iliat(es?|ion))?|nalytics?)|b((anner|eacon)s?)|count(ers?)?|pixels?|stat(s|istics?)?|t(elemetry|ra(ffic|ck(ers?|ing))))[-_]*[0-9]*[-_.]
^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-]
^(.+[_.-])?ad[sxv]?[0-9]*[_.-]
(^|\.)asn\.advolution\.de$' regex
++ local domain=gstatic.com 'esc_domain=gstatic\.com' 'lists=^(.+[.-])?ad[sxv]?[0-9]*[.-]
^(.+[.-])?adse?rv(er?|ice)?s?[0-9]*[.-]
^(.+[.-])?telemetry[.-]
^(www[0-9].)?xn–
^adim(age|g)s?[0-9][.-]
^adtrack(er|ing)?[0-9]*[.-]
^advert(s|is(ing|ements?))?[0-9][.-]
^aff(iliat(es?|ion))?[.-]
^analytics?[.-]
^banners?[.-]
^beacons?[0-9][.-]
^count(ers?)?[0-9]*[.-]
^mads.
^pixels?[-.]
^stat(s|istics)?[0-9][_.-]
^track(ers?|ing)?[0-9][_.-]
^traff(ic)?[.-]
^.*metric.*\..*\..*$
^logs?\..*\..*$
(^|[-_.]+)(m?a(d((vert(s|is(ing|e?ments?))?|im(age|g)s?)|([vx]|s(e?rv(er?|ice)?s?)?)|track(ers?|ing))?|ff(iliat(es?|ion))?|nalytics?)|b((anner|eacon)s?)|count(ers?)?|pixels?|stat(s|istics?)?|t(elemetry|ra(ffic|ck(ers?|ing))))[-_]*[0-9]*[-_.]
^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-]
^(.+[_.-])?ad[sxv]?[0-9]*[_.-]
(^|\.)asn\.advolution\.de$' type=regex
++ cd /etc/pihole
++ export LC_CTYPE=C
++ LC_CTYPE=C
++ case "${type}" in
+++ echo '^(.+[.-])?ad[sxv]?[0-9]*[.-]
^(.+[.-])?adse?rv(er?|ice)?s?[0-9]*[.-]
^(.+[.-])?telemetry[.-]
^(www[0-9].)?xn–
^adim(age|g)s?[0-9][.-]
^adtrack(er|ing)?[0-9]*[.-]
^advert(s|is(ing|ements?))?[0-9][.-]
^aff(iliat(es?|ion))?[.-]
^analytics?[.-]
^banners?[.-]
^beacons?[0-9][.-]
^count(ers?)?[0-9]*[.-]
^mads.
^pixels?[-.]
^stat(s|istics)?[0-9][_.-]
^track(ers?|ing)?[0-9][_.-]
^traff(ic)?[.-]
^.*metric.*\..*\..*$
^logs?\..*\..*$
(^|[-_.]+)(m?a(d((vert(s|is(ing|e?ments?))?|im(age|g)s?)|([vx]|s(e?rv(er?|ice)?s?)?)|track(ers?|ing))?|ff(iliat(es?|ion))?|nalytics?)|b((anner|eacon)s?)|count(ers?)?|pixels?|stat(s|istics?)?|t(elemetry|ra(ffic|ck(ers?|ing))))[-_]*[0-9]*[-_.]
^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-]
^(.+[_.-])?ad[sxv]?[0-9]*[_.-]
(^|\.)asn\.advolution\.de$'
++ awk 'NR==FNR{regexps[$0];next}{for (r in regexps)if($0 ~ r)print r}' /dev/fd/63 /dev/fd/62
+++ echo gstatic.com
+ [[ 0 -ne 0 ]]
+ mapfile -t results
++ scanDatabaseTable gstatic.com gravity
++ local domain table type querystr result extra
+++ printf %q gstatic.com
++ domain=gstatic.com
++ table=gravity
++ type=
++ [[ gravity == \g\r\a\v\i\t\y ]]
++ case "${exact}" in
++ querystr='SELECT gravity.domain,adlist.address,adlist.enabled FROM gravity LEFT JOIN adlist ON adlist.id = gravity.adlist_id WHERE domain LIKE '\''%gstatic.com%'\'' ESCAPE '\''\'\'''
+++ sqlite3 /etc/pihole/gravity.db 'SELECT gravity.domain,adlist.address,adlist.enabled FROM gravity LEFT JOIN adlist ON adlist.id = gravity.adlist_id WHERE domain LIKE '\''%gstatic.com%'\'' ESCAPE '\''\'\'''
++ result=
++ [[ -z '' ]]
++ return
+ [[ -z '' ]]
+ [[ -z '' ]]
+ [[ -z '' ]]
+ echo -e '  [i] No results found for gstatic.com within the block lists'
  [i] No results found for gstatic.com within the block lists
+ exit 0

I re-enabled all adlists and black/whitelist (without the specified whitelist regex) and it worked without issues.
I'm not very good at regex, is this an faulty one?

(\.|^)*\.services\.generalmagic\.com

If I remember correctly I created it with pihole webUI by entering *.service*.generalmagic*.com and setting type to 'whitecard whitelist'

Judging from the results, yes.

https://docs.pi-hole.net/ftldns/regex/tutorial/

Wildcard is for exact domains, the wildcard blocks subdomains of the top domain. Entering regex chars like the * and choosing wildcard is trying to wildcard that value.

That says literally β€œZero or more (.|^) chars” which is not right.

regexr.com/4v4vl

Edit: copy paste breaks the formatting but the regexr link shows what I mean.

1 Like

Thanks for the answer. I think I misinterpreted wildcard - I'm used to understand 'I can use wildcard characters'.
I tried to match domains like

content1.ro.m71os.services.generalmagic.com
shop1.m7.services.generalmagic.com
pubsub1.ro.m71os.services.generalmagic.com
overlays1.ro.m71os.services.generalmagic.com

I think using services.generalmagic.com as wildcard whitelist will be sufficient.

I don't think pihole should have a full-grown regex validator (In terms of 'This is what the regex means') but maybe a simple syntax checker ('This is not a valid regex und will never match any domain.) - especially as a non-valid regex can break pihole's scripts. Or pihole should be more robust against faulty regex.

edit
Changes the topic's title to what I think reflects the issue better.