Option to ignore hosts from appearing in the Query Log


#1

Some services are polling several times in a minute. All these entries are showing up in the Query Log. There should be an option to hide or ignore/exclude domains from the Query Log viewer.


Filter out sites from Query Log
#2

How about hiding the domains that is in the exclude list (left input box) also in the Query Log?


I assume that users exclude domains in there that are queries most often and which should then also be hidden on the Query Log?

In contrast to an additional list, implementing it as I suggest will be less than ten minutes of work.


#3

Nice, option to exclude domains from Query log page would be great!


#4

This feature will help to hide commonly appearing domains and some blacklisted domains contacting several thousand times a day (like Amazon metrics, some NTP domains, and littlefield.logs.roku )

And also it helps in the analysis of large number of queries. What do you think @DL6ER?


#5

I second this also. Hiding them from the query list will be great !

I’m flooded by localhost queries every time i access the query log.


#6

Is it something i can change within the code (use the same top list from the api option) and have those entries ignored and not displayed in the wuery log?


200+ local DNS queries an hour
#7

At least for localhost, there is already a feature for this in FTLDNS:


#8

This only prevents hits TO localhost, right?

It will not ignore legitimate hits to different hosts, originating from localhost

As in, localhost querying github will still show, right?


#9

No, see the description of this config option:

IGNORE_LOCALHOST=no|yes (Should FTL ignore queries coming from the local machine?)


#10

It’s a good feature however, I personally would still like to see if locahost is “dialing” out and where EXCEPT for self queries.

It would be just a cosmetic thing I agree.

What I was thinking about is an approach like the API/Web Interface Exclude options.

Not only in the Top lists but also Query log.

So if a query is placed to localhost and/or localhost.local, or any domain specified in the Exclude Boxes, strip it from being displayed …


#11

I see, but, unfortunately, there is a (significant!) performance penalty connected to this feature which is the sole reason for why we have not added it yet. Assume we have 15 clients on a typical system with 20.000 queries within 24 hours. Then, the filter would have to be applied 15*20.000 = 300.000 times as we would have to check in each and every query for each and every domain individually if we want to show them or not. Not even going to mention how wildcard comparisons might perform (they are much more costly in terms of computations time). Sure, there are ways to code around this like using tree methods and similar techniques, but this would make the code still slower (albeit not as dramatic) but also much harder to maintain).