Pi-hole deleting logs even though logging is set with nginx

Why does my pi-hole stats and logs reset every 24 hours or so even when I have logging fully enabled and haven't reset / flushed logging? I want to see total blocked queries etc, total queries, but can only get total for past 24 hours. How do I prevent this? It never used to do this and now it does randomly after I guess the last update? I want to keep queries, and blocked queries for as long as possible. I do not care about how big the file gets or how much space it needs. I do not ever want logs to be removed, how can I changed this?

the logs refresh either in a 24 hour rolling period or daily at midnight. to see further logs use the long term logging features in the web admin.

if you still think there is something wrong run pihole -d and provide us with a debug to take a look

The dashboard shows a rolling 24 hour display. The data for this display is not taken from the Pi-Hole log (/var/log/pihole.log), but from the long term database (/etc/pihole/pihole-FTL.db).

I don't believe this behavior has changed in any recent update.

The long term database is configured by default on installation to retain data for 365 days. When you start Pi-Hole (in particular, pihole-FTL), by default 24 hours of data are read from the database to populate the dashboard. To see the data from the long term database, from the WebGUI, select "Long Term Data" on the left column. Note this is different than looking at the query log (one row above that in the column).

Settings for the long term database are described here:

https://docs.pi-hole.net/ftldns/database/

and here:

https://docs.pi-hole.net/ftldns/configfile/

That's part of the issue, no matter the dates I select for long time graphics, nothing appears. When I select long time query, a popup says "An unknown error occurred while loading the data", and with top lists, selecting any dates like graphics, does nothing. So maybe it's not deleting logs, but my issue is that the way to view older logs is broken in my case. Could it be that I'm using nginx as the webpage webserver instead of the default lighttpd? How can I fix this? Everything else works fine.

Do you have your /var/ partition on a ramdisk that is purged on cycle?

I do not, it seems it is keeping logs, the pihole-FTL.db is 12mb, so it is logging long term data, but I cannot access the logs via the web interface as it won't load or I get 'an unknown error occurred while loading the data', so it seems something with my web interface is broken? I cannot use any of the features in the long term data drop down. graphics and top lists won't load anything after choosing a date, and query log gives me the 'unknown error occured while loading the data' popup. Do you want me to upload a debug file?

Sure, though we just trap the lighttpd error logs so it may not show anything. You'll have to check the nginx access and error logs yourself to see what errors are being generated and also check the web browser Developers Tools to see what is not being loaded and why it is not being loaded.

yeah seems php fpm is throwing an error. I have php7.0-fpm installed (I use nginx/phpfpm for another site locally, which is why I chose nginx over lighttpd.) Any ideas? No browser console errors.

This is for when I click query log, no errors for graphics or top lists

2019/07/22 12:17:16 [error] 21363#21363: *253431 FastCGI sent in stderr: "PHP message: PHP Fatal error: Uncaught Error: Class 'SQLite3' not found in /var/www/html/admin/api_db.php:71
Stack trace:
#0 /var/www/html/admin/api_db.php(86): SQLite3_connect(true)
#1 {main}
thrown in /var/www/html/admin/api_db.php on line 71" while reading response header from upstream, client: 192.168.3.118, server: , request: "GET /admin/api_db.php?getAllQueries=empty&types=1,2,3,4,5,6,7,8&=1563812236693 HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "pi.hole", referrer: "http://pi.hole/admin/db_queries.php"

Which distribution?

Raspbian 9.9 Stretch
pihole v4.3.1
adminlte v4.3
ftl v4.3.1
nginx 1.10.3
php7.0

Do you have the Debian -- Details of package php7.0-sqlite3 in stretch installed?

2 Likes

I wasn't aware I needed php7.0-sqlite3, sorrry, installed it, and it fixed it, and now long term data is loading properly. Thank you for helping me debug this issue.

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.