PiHole Log Clears Itself

Help Community Help
1

The issue I am facing:
Logs are clearing after a certain period of time and MAXDAYS is not set. Total Queries data does not load and throws the error saying it will not load. Have tried deleting pihole-FTL.db and creating it again many times with no luck. Storage is set to 32GB. This has been an issue I have had on multiple systems and installations. Unsure what the deal is.

Details about my system:
Running in an Ubuntu LXC container on Proxmox with 8gb of RAM and 2 cores with the Ryzen 9 7900. I have ran on a Debian and Raspberry Pi container as well. Same issue.

What I have changed since installing Pi-hole:
I have added Unbound to my setup.

Debug Log:
https://tricorder.pi-hole.net/K2NzSqps/

2

Usually, the file size of an empty database is around 80kb, but your database file is empty
(0 bytes - there are not even empty tables in the database):

*** [ DIAGNOSING ]: Pi-hole FTL Query Database
-rw-rw-r-- 1 pihole pihole 0 Aug 27 19:56 /etc/pihole/pihole-FTL.db

To fix the database, run these commands to move the existing database to a new file name and create a fresh database.

sudo service pihole-FTL stop

sudo mv /etc/pihole/pihole-FTL.db /etc/pihole/pihole-FTL-old.db

sudo service pihole-FTL start
3

I have tried these commands previously on past installation and though it does fix the issue of me being able to view the data on Total Queries, it still results in the logs being cleared after a certain period of time. I never see my logs go above 60,000.

4

Where do you get that 60,000 from?

5

I check my PiHole very often and have never seen it above 60,000. I check roughly a few times a day.

6

But where do you take that number from?
Is it a screen reading?
Are you referring to Total queries as shown in Pi-hole's dashboard?

7

Oh yes. The number shown in PiHole's dashboard.

8

This simply means you don't have more than 60,000 queries in the last period of 24h.

There is nothing wrong.

9

You should be aware that Pi-hole employs a rolling time frame of 24 hours for statistics shown on its Dashboard, i.e. after 24 hours, the number will probably fluctuate around an average daily count of queries.

You have to refer to Long-term Data if you want to view more than those current 24 hours.

10

I have all data shown enabled when I configured PiHole. I was unsure why my total queries would be wiped only after a day. Is there a configuration I have wrong?

11

No data gets wiped.
The dashboard just always shows the most current 24 hours.

Data is still stored in Pi-hole's long-term Query database, which is accessible via its Long-term Data UI section (and via direct SQL statements, if you prefer).

12

The long-term data section in the UI is displaying nothing. Does Total Queries on the dashboard not display long-term data as well? Is that number just the last 24 hours? Any way to change that?

13

Your database was completely empty, so there is no long-term data stored.
In this specific case, an empty Long-term section is expected.

If the procedure above successfully created a new database file, you will be able to see long-term data on the next days (new data will be stored from now on).

Yes.
The dashboard page only shows the last 24 hours, stored in memory.

This is roughly how it works:

  1. every DNS query sent to Pi-hole is initially stored in memory;
  2. the in-memory data retains the last 24 hours (to show on the dashboard);
  3. Pi-hole saves the in-memory data to the database in intervals (once a minute, if I'm not mistaken);
  4. when Pi-hole starts (reboot or container restart), there is no in-memory data, so Pi-hole loads the last 24h from the database to display in the dashboard;
  5. the Long-term pages always access directly the database.

What happened in your case:

Items 1 and 2 were working.
The item 3 wasn't working (broken database);
As a consequence, items 4 and 5 had nothing to show.

If the procedure to create a new database failed, you probably have an issue in your filesystem preventing the file creation.

14

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.