How to flush logs for the last 48 hours

[CrDo]

Hi guys,

I'm curious how I can flush logs for the last 48 hours (or any other manually specified time that isn't 24 hours)? The Web interface only allows flushing for the last 24 hours, as does the command pihole -f.

Thanks.

[jfb]

If you look at the code for the log flushing, you can see how this is done. We remove the previous 24 hours of data from the long term database, then we rotate the dnsmasq log twice to remove those (up to two) days of data.

You can run the database command with a time range of 48 hours in the past, and you can manually delete the dnsmasq log files (easier than manually log rotating).

advanced/Scripts/piholeLogFlush.sh

I think this command will work - didn't test it because I want to keep my database intact. You might want to copy your database to the side so you can restore it if needed.

sudo cp /etc/pihole/pihole-FTL.db /etc/pihole/pihole-FTL-copy.db

Start and stop FTL around this command to first close the database and then to reload the dashboard (which in this case will show no prior 24 hour history because you just erased it):

sudo service pihole-FTL stop

sudo sqlite3 /etc/pihole/pihole-FTL.db "DELETE FROM queries WHERE timestamp >= strftime('%s','now')-136,800; select changes() from queries limit 1"

sudo service pihole-FTL start

Then, for the dnsmasq logs, delete the appropriate logs that cover the time range you want to eliminate.

ls -lha /var/log/pihole.log*

-rw-r--r-- 1 pihole pihole 857K Jan 24 09:18 /var/log/pihole.log
-rw-r--r-- 1 pihole pihole 2.3M Jan 24 00:00 /var/log/pihole.log.1
-rw-r--r-- 1 pihole pihole 224K Jan 23 00:00 /var/log/pihole.log.2.gz
-rw-r--r-- 1 pihole pihole 94K Jan 22 00:00 /var/log/pihole.log.3.gz
-rw-r--r-- 1 pihole pihole 129K Jan 21 14:15 /var/log/pihole.log.4.gz
-rw-r--r-- 1 pihole pihole 225K Jan 21 00:00 /var/log/pihole.log.5.gz

[CrDo]

Thanks! That did it! I just had to change the amount of seconds to do 48 hours (which is 172800 seconds) and remove the comma when setting the seconds It should be -136800 and not -136,800.

Two additional questions. I deleted /var/log/pihole.log.2.gz because that one covered the time range that I wanted to eliminate.

1. I've deleted pihole.log.2.gz, thats all good and fine right? Nothing is going to get broken and the file will get automatically replaced in time when the logs rotate?
2. That log covered a larger range that I wanted - is there any chance I could've edited the range deleted? Let's say that single file covered 4 days and I wanted to eliminate only 2 days of logging.

[jfb]

@CrDo

I've deleted pihole.log.2.gz , thats all good and fine right? Nothing is going to get broken and the file will get automatically replaced in time when the logs rotate?

Correct.

@CrDo

That log covered a larger range that I wanted - is there any chance I could've edited the range deleted? Let's say that single file covered 4 days and I wanted to eliminate only 2 days of logging.

You can edit these files with the appropriate text editor. A single file only covers a calendar day (not multiple days) due to the midnight log rotation. You have today's file (still being built), and the previous 5 days. At the end of today, your oldest file is deleted and today's file becomes yesterday's file and a new file for tomorrow (the new today) starts.