I've noticed one issue and a few minor inconsistencies with the links from the dashboard stats to the query log.
Issue:
Clicking on Top Clients (blocked only) one would expect to see only blocked queries from that client. But the query log shows all queries from that client (within the last 24h).
Inconsistencies:
Clicking on one of the following opens the query log:
"Query Typs"/"Queries answered by"/"Top permitted domains"/"Top blocked domains"/"Top Clients (total)"/"Top Clients (blocked only)"
In the header of the query log it stats "Recent Queries" but in fact it is (and would be better called) "Queries in the last 24h"
Clicking on "Query Typs" or "Queries answered by" opens the query log:
In the header of the query log it stats "Show up to 100" but in fact it is shows all queries from the last 24h
nanopi@nanopi:~$ pihole -v
Pi-hole version is v4.3.5-462-g0f20470 (Latest: v4.4)
AdminLTE version is v4.3.2-464-gade3ef5 (Latest: v4.3.3)
FTL version is vDev-853261b (Latest: v4.3.1)
When the query log opens, the top is hard coded to say 100 queries, but only the number of queries selected in the pull down is shown. The pull down selection is sticky and should be the same as the last time that menu was used. Is that the same as what you are seeing?
The 100 is hard coded and comes from the "normal" way to the query log (click on "Query log" on the left side of the page). If you do so max 100 entries are shown and the drop-down "100" is equal "all".
But accessing the query log via Dashboard -> "Queries answered by" more than 100 entries are loaded (in your case 7795) and in the drop-down all !=100 anymore. If the sticky selection is "all" the term "showing up to 100 queries" is wrong.
I disagree. Even when the 24 hours is hard-coded, this value can be changed by the user when compiling FTL from source without any chance for the web interface to detect this change. In such a case, we'd show incorrect information. The current formulation was explicitly chosen to be implicit.
Confirmed. We will fix this. Even more, this also happens when clicking on clients.
Multi-dimensional filtering is not available currently (filtering by both, a client, and a query type). So this is a new feature. I added this now to the API, however, it also requires an update of the FTL daemon which is providing you with all the data.
Try it using
pihole checkout web fix/wording_query_log_links
pihole checkout ftl new/query_log_blocked_client_filtering
Ok, point for you. I've never thought about compiling FTL from source just to change the time frame for the stats at the dashboard...
I still think an additional information what "recent" means in this case would be useful for users. In the "normal" query log this information is given by "up to 100 queries". I'll go and open an feature request on this (as I also think the headings on the dashboard modules could benefit from an info about the includes time frame)
Mhh.. not for me. Clicking on one client in "Top Clients (total)" gives
The link from "Top Clients (blocked only)" does include status= unknown in the query log in contrast to the dashboard view. Result is a slightly increased blocked requests count.
There is no link from "Client activity over last 24 hours" to the query log at all. Would be nice to have the same as in "Total queries over last 24 hours" (clicking on one bar queries the log for that particular times range). No need to filter for individual clients here as it is too hard to precisely hit one client.
As mentioned in the other thread, I forgot about this and just opened PRs for this.
Hmm, yeah, UNKNOWN was not handled explicitly during filtering. I changed this now to only show such queries when no filtering for either only-permitted or only-blocked has been requested.
