Moving the Pi-hole log to another location/device

FAQs
1

I will describe in this FAQ how to use the powerful symbolic links Linux offer to move the Pi-hole log to any destination.
It does not matter if the location is local as in

  • another folder
  • a plugged in USB stick / USB hard drive

or if it is a distant device like a server that is connected via sshfs as long as the directory is available (mounted) within the local file system.

Note that this will (by intention) render the log flushing Pi-hole installs useless, since it is unlikely that you will want the logrotate copies to be placed on the SD card (i.e. /var/log/). Take care of setting up a log rotation script for your new location. You can easily do this by starting from already existing file /etc/pihole/logrotate. This will be described in step 8 and following.

For this FAQ, I will describe in detail how to outsource the Pi-hole log to an USB hard disk directly connected to the Raspberry Pi:

  1. Mount the USB drive in /media/usb 
pi@raspberrypi:~ $ sudo mkdir /media/usb
pi@raspberrypi:~ $ sudo mount /dev/sda1 /media/usb
  1. Stop pihole-FTL 
pi@raspberrypi:~ $ sudo service pihole-FTL stop
  1. Move log with current content to mounted USB drive
pi@raspberrypi:~ $ sudo mkdir /media/usb/pihole
pi@raspberrypi:~ $ sudo cp /var/log/pihole/pihole.log /media/usb
pi@raspberrypi:~ $ sudo cp /var/log/pihole/FTL.log /media/usb
pi@raspberrypi:~ $ sudo rm -rf /var/log/pihole
  1. Create a symbolic link to the new location
pi@raspberrypi:~ $ sudo ln -s /media/usb/pihole/ /var/log/pihole/
  1. Start pihole-FTL again since we are done with moving the log
pi@raspberrypi:~ $ sudo service pihole-FTL start
  1. Verify that the symlink works
pi@raspberrypi:~ $ ls -lh /var/log/pihole
lrwxrwxrwx 1 root root 23 Mar  5 19:24 /var/log/pihole -> /media/usb/pihole
  1. You should check the permissions of the file on the new target. Especially, you will need to have reading for all enabled
sudo chmod a+r /media/usb/pihole
  1. Check if new file gets populated when browsing the web
pi@raspberrypi:~ $ tail -f /media/usb/pihole/pihole.log 
Mar  5 19:25:00 dnsmasq[30081]: query[A] www.amazon.de from 192.168.2.2
Mar  5 19:25:00 dnsmasq[30081]: cached www.amazon.de is <CNAME>
Mar  5 19:25:00 dnsmasq[30081]: cached www.cdn.amazon.de is <CNAME>
Mar  5 19:25:00 dnsmasq[30081]: cached opf-www.amazon.de is 54.239.34.172
Mar  5 19:25:00 dnsmasq[30081]: query[AAAA] www.amazon.de from 192.168.2.2
Mar  5 19:25:00 dnsmasq[30081]: cached www.amazon.de is <CNAME>
Mar  5 19:25:00 dnsmasq[30081]: cached www.cdn.amazon.de is <CNAME>
Mar  5 19:25:00 dnsmasq[30081]: cached opf-www.amazon.de is NODATA-IPv6
  1. Make a copy of the existing logrotate config file
pi@raspberrypi:~ $ sudo cp /etc/pihole/logrotate /etc/pihole/logrotate-custom
  1. Modify the new file and update it with your new path (first line), e.g.
/media/usb/pihole/pihole.log {
   su root root
   daily
   copytruncate
   rotate 5
   compress
   delaycompress
   notifempty
   nomail
}
  1. Add an entry to your cron table:
echo "0 0 * * * root /usr/sbin/logrotate --force /etc/pihole/logrotate-custom" | sudo tee /etc/cron.d/pihole-custom-flushing
echo "@reboot root /usr/sbin/logrotate /etc/pihole/logrotate-custom" | sudo tee -a /etc/cron.d/pihole-custom-flushing
12 Likes