Generation of log and/or database entries

Hi,

i am running a pihole with coredns for tls termination so i can use android 9’s private dns feature with it. Everything works well, except that in the pihole stats, every request is coming from localhost.localdomain. This is caused by the fact, that coredns accepts all requests first and just forwards them to pihole-FTL.

I really want to see the real IP adresses in the pi-hole stats. Where does the pihole load the IPs from? Is it the log file*? Is it the ftl.db? Is there some sort of hook i can use to inject the correct ip-adresses? Coredns has a wonderful query-log feature and it would be a shame if i couldn’t use this to integrate into the pihole stats :wink:

*Which parts of the log file are really used for statistics? Is it only the query or also the response?

Look in /var/log/pihole.log

This is the dnsmasq file of all queries and replies. If you only see one incoming IP, that is what dnsmasq/Pi-Hole sees.

Is this where the statistics are directly generated from?

Data is also in the long term database, and that is what populates the dashboard.

@Phil1

I suspect that rather than injecting into one of the existing tables inside /etc/pihole/pihole-FTL.db that it may be better to create a new table then get Core DNS to write to that (date time, domain queried , local IP etc etc ) then do a union to get the stats back.

Of course its (relatively) early morning after a night out and I haven’t drunk my coffee yet and I may be talking tosh.

Thinking further out loud you would probably end up needing to write a custom stats page as well ., or just export for analysis in excel

You can use AWstats. I think this one is the best in the market right now.