Pi-Hole Docker Logs to Graylog

Help
1

Hi,

I'm trying to forward my Pi-Hole logs to Graylog but I'm having trouble finding the DNS query logs location. I'm using the following docker-compose " Docker - Pi-hole documentation " with the "./etc-dnsmasq.d:/etc/dnsmasq.d" line uncommented but I'm not seeing any logs in that location. Where are the DNS queries stored or is there a different compose file I should be using?

2

I'm having trouble finding the DNS query logs location

If you want the raw DNS logs, they are stored in/var/log/pihole/pihole.log, inside the container.

If you want the data showed in the Query Log page, it is stored in /etc/pihole/pihole-FTL.db (this is a SQLite database).

This has nothing to do with logs.

This path is used only when a user wants to add advanced configuration files to dnsmasq (and the misc.etc_dnsmasq_d is enabled). You don't need this.

3

Thank you so much for the response, I greatly appreciate it. It doesn't sound like I'll be able to forward those logs to Graylog after all. Bummer.

4

If you only care about the .log files, you can try to create a volume for the logs:

    volumes:
      # For persisting Pi-hole's databases and common configuration file
      - './etc-pihole:/etc/pihole'
      # Pi-hole Logs
      - 'path_on_the_host/for/your/logs:/var/log/pihole'

Then you can access the logs on the host machine: path_on_the_host/for/your/logs/pihole.log. Just remember to replace "path_on_the_host/for/your/logs" with a real path.