Pi-Hole Dashboard Query Graphs and rare very high query counts

I've had this happen several times. The Dashboard display, default page and others, runs a display of the number of queries, in ten minute blocks. Currently it's a bar chart, though that can be changed back to the older style. Either way, it scales automatically to show the full range from zero to whatever the maximum was for the last 24 hours.

Most of the time my maximum for the last 24 hours is under 100 queries per ten minute block. Occasionally I see it rise to 200, usually when I have been using an Android tablet. This maximum is getting awkward for showing the more usual variations but it is tolerable.

My internet connection is by VDSL. If it goes down for any reason a very large number of queries. sometimes over 2000, can be logged. This seems to be from my Android devices, and makes the graphs almost useless. I can plan for it, such as if I wish to reboot the modem/router, and disable Pi-Hole for five minutes.

Unfortunately, line drops can happen without warning. An the last occasion, when my ISP re-trained the modem after about 10 days, I logged 2000 queries in ten minutes. The information is still in the graph, but most of the bars are one or two pixels high.

My set-up is a pretty standard Pi-Hole on a Raspbery Pi Zero, connecting to external DNS (not my ISP server) when necessary, and acting as DNS server to the modem/router providing DHCP to my network.

I am pretty sure that it is my Android hardware, a smartphone and a tablet, which is generating the high query numbers. There may be some Android setting which stops this, but I have not been able to find it it. Query rates are so high that I suspect something may not be RFC compliant. And neither was active, just sleeping.

Increasing the cache size used by my modem/router did help with similar problems but this 2000-query spike is insanely high. If the source is the Android hardware, repeated queries for the same domain should not be getting past the cache.

(OK, the modem/router is a BT Home Hub 5A running OpenWRT 19.07.07, with the Pi-Hole as the specified DNS server.)

I do get some much smaller spikes when I use Wireguard VPN to connect my smartphone to the Pi-Hole rather than relying on the smartphone network's ISP, and this does work. The smartphone to check internet things would problems. This is part of why I suspect Android issues.

Providing the DHCP from the Pi-Hole might change all this. I am reluctant to get through the hassle. It anyone seeing similar spikes with that sort of set-up?

My alternative fix would be to change how the graphs are displayed so the automatic re-scaling is limited. If the maximum displayed was 10% of the maximum recorded, but those excess spike were somehow marked, it would show the usual variations, without hiding anything. Something such as a logarithmic scale is an answer, but is it too complicated to calculate?

Anyway, there might even be something buried somewhere that would fix this. Let's just say I can get grumpy about how some things get documented, and when people just post a link, it is not unknown for me to use litotes.

I'm not sure if I understood you correctly, but at the moment the graph will always scale to the maximum peak. No other scaling is available at the moment. You might want to support this feature request

I don't seem to be able to vote on new features yet, but I see the original poster on that feature thread is seeing something very like what I do.

There is, I think, one very obvious question that arises from that thread. What do people actually want to do with these graphs?

Do you want to see the usual level of variation or these rare spikes? Do you only want to see one?

There are still very strange things about these repeated queries being generated. I am going to have dig into a lot of places, and log a lot of stuff to find out just where the queries are generated, and why replies from the DNS aren't stopping them.

It looks like the server response could be SERVFAIL, not NXDOMAIN, possibly REFUSED. Any of them, it isn't the same as the "DNS server not responding" which a lot of web pages explain fixes for. Maybe the same root cause, a connection down, but Pi-Hole, the DNS server, is still there.

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.