Pi-hole stops working within 24 hrs, high CPU and RAM usage

[Dlak]

Please follow the below template, it will help us to help you!

Expected Behaviour:

Intend to run pi-hole 24/7 (Sorry I'm non tech user so will try my best to explain the issue)

Actual Behaviour:

At random time (within 24 hrs of running) pi-hole it stops working with FTL error and when I run htop, it shows CPU usage 100% or even more with memory usage of about 80% or higher. Currently I restarted rasberry pi and everything seems to be fine but i see memory usage almost 70% which I believe at some point will cause pi-hole to stop working again.

Debug Token:

I did cat /var/log/pihole-FTL.log | nc tricorder.pi-hole.net 9999 and below is the token #3foqjp7ew2.

also did pihole -d and token is: 54k7byfwnv

Let me know if you need anything else.

Htop screenshot here..

[jfb]

With your large number of blocked domains in gravity (a few million), you may be pushing your memory limits, depending on what hardware you are running. With this many domains in gravity and using the NULL blocking mode, there have been reports of high CPU and RAM usage. Here is one related thread:

High CPU, High RAM, not working, dnsmasq issues? - Solved

Yeah, my apologies, I keep getting the 'load' and CPU usage mixed up on this Linux thing. The load is high, the CPU is not, as according to 'htop'. I do not currently have IPv6 connectivity, and didn't pick it during install (though I did have it enabled pre-4.0). The website linked also states 'No IPv6 address detected'. Copypasting in the echo above seems to do nothing, but as said, Linux novice, I might possibly be doing this wrong. I did find a site talking about the NXDOMAIN thing while…

What is the output of the following commands from the Pi terminal:

echo ">stats" | nc localhost 4711

free -m

df -a -h

An additional note, and perhaps related to your problem. From your debug log, there are some abnormal line entries in your ad lists file (/etc/pihole/adlists.list). This list is normally populated with web addresses of each blocklist to which you subscribe.

Your list has some individual domains listed (lines 21 to 48), and an asterisk in line 54.

Edit this file and remove these lines, then rebuild gravity with pihole - g

[Dlak]

I deleted ad lists lines 21 to 48 and an asterisk in line 54. But issue still persisted. Here is the output of

echo ">stats" | nc localhost 4711

domains_being_blocked 725026
dns_queries_today 9261
ads_blocked_today 5185
ads_percentage_today 55.987473
unique_domains 1003
queries_forwarded 3691
queries_cached 1303
clients_ever_seen 18
unique_clients 15
dns_queries_all_types 9680
reply_NODATA 1053
reply_NXDOMAIN 16
reply_CNAME 1869
reply_IP 7953
status enabled

free -m

                total        used        free      shared  buff/cache   available
 Mem:            927         701          97           2         127         173
 Swap:            99          83          16

df -a -h

Filesystem      Size  Used Avail Use% Mounted on
/dev/root        16G  4.9G  9.7G  34% /
devtmpfs        460M     0  460M   0% /dev
sysfs              0     0     0    - /sys
proc               0     0     0    - /proc
tmpfs           464M     0  464M   0% /dev/shm
devpts             0     0     0    - /dev/pts
tmpfs           464M   13M  452M   3% /run
tmpfs           5.0M  4.0K  5.0M   1% /run/lock
tmpfs           464M     0  464M   0% /sys/fs/cgroup
cgroup             0     0     0    - /sys/fs/cgroup/systemd
cgroup             0     0     0    - /sys/fs/cgroup/net_cls
cgroup             0     0     0    - /sys/fs/cgroup/cpuset
cgroup             0     0     0    - /sys/fs/cgroup/blkio
cgroup             0     0     0    - /sys/fs/cgroup/cpu,cpuacct
cgroup             0     0     0    - /sys/fs/cgroup/devices
cgroup             0     0     0    - /sys/fs/cgroup/freezer
debugfs            0     0     0    - /sys/kernel/debug
mqueue             0     0     0    - /dev/mqueue
systemd-1          0     0     0    - /proc/sys/fs/binfmt_misc
sunrpc             0     0     0    - /run/rpc_pipefs
configfs           0     0     0    - /sys/kernel/config
/dev/mmcblk0p6   68M   22M   46M  33% /boot
tmpfs            93M     0   93M   0% /run/user/1000
gvfsd-fuse         0     0     0    - /run/user/1000/gvfs
fusectl            0     0     0    - /sys/fs/fuse/connections
/dev/mmcblk0p9   12G   30M   11G   1% /media/pi/Storage
/dev/mmcblk0p8  512M  143M  370M  28% /media/pi/System
/dev/mmcblk0p5   30M  398K   28M   2% /media/pi/SETTINGS
tmpfs            93M     0   93M   0% /run/user/999

Memory usage didnt decrease so I tried to uninstall using command pihole uninstall followed by normal installation process. At the end it erred "Error during updating repository..."

I checked pi-hole and it still running with default adlist. Now, I just have around 100k blocklist but I dont see any improvement in memory usage. This morning its around 83% and I guess its just matter of time where it will stop working again.

I regenerated debugging token. 7z0i4ex7eo

cat /var/log/pihole-FTL.log | nc tricorder.pi-hole.net 9999 token is cxdejtknm2

[jfb]

Your new debug log appears normal. Since this is a new install, you should have the default options selected only. Your memory use still seems higher than normal.

One of the parameters that can affect RAM usage is BLOCKINGMODE, an option set in file /etc/pihole/pihole-FTL.conf (Configuration - Pi-hole documentation). The default is NULL, which results in double entries for each item on the gravity list (one for AAAA and one for A records). Let's change this blocking mode to NXDOMAIN and see what affect that has on RAM usage:

sudo nano /etc/pihole/pihole-FTL.conf

the file might be empty, which is expected in your case. Add this line: BLOCKINGMODE=NXDOMAIN , then save and exit. Next restart FTL with this command:

sudo service pihole-FTL restart

See what this does to RAM usage.

[Dlak]

This seems to have resolved the issue. Here is before and after screenshot. The impact was significant. Now memory usage is 14% vs 83%.
lo jiu8nhy78

[jfb]

Good that this improved things. I'm still curious why your RAM usage was so high before - that's not usual for that many domains and queries. Just for comparison, I have several Pi-Holes that serve subsets of clients, with different options for testing, etc. Here are the same screen shots for these. The closest to your setup is the last and it sits about about 20% RAM usage.

Pi 3B+ with V4.0 master, wired, BLOCKINGMODE=IP-NODATA-AAAA

Pi 3B+ with development latest version, wireless, BLOCKINGMODE=NULL

Pi ZeroW with V4.0 master, wireless, BLOCKINGMODE=IP-NODATA-AAAA

[Dlak]

I've Pi 3B+ with V4.0, wired. Should I make the change using same steps but this time set parameter BLOCKINGMODE=NULL and see what happens? or something else?

[jfb]

Whatever you prefer. I would experiment a bit and see if the CPU/RAM usage settles down. Changes are easy enough to make.

What other software is running on this Pi (other than ssh)?

[Dlak]

no other software for now.

[Mcat12]

If you stop FTL (sudo service pihole-FTL stop), does the memory usage go down? Using most of your memory is not necessarily bad; it means the system is not letting any memory go to waste.