Pihole log file is being rotated twice a day, once at midnight, and again between midnight and 1am

Schrodingers-cat · October 9, 2026, 12:00pm

My pihole log file keeps getting rotated twice a day at weird times.

-rw-r----- 1 pihole pihole  1.0M Oct  3 00:00 /var/log/pihole/pihole.log.14.gz
-rw-r----- 1 pihole pihole   36K Oct  3 00:48 /var/log/pihole/pihole.log.13.gz
-rw-r----- 1 pihole pihole  925K Oct  4 00:00 /var/log/pihole/pihole.log.12.gz
-rw-r----- 1 pihole pihole   12K Oct  4 00:16 /var/log/pihole/pihole.log.11.gz
-rw-r----- 1 pihole pihole  814K Oct  5 00:00 /var/log/pihole/pihole.log.10.gz
-rw-r----- 1 pihole pihole   37K Oct  5 00:56 /var/log/pihole/pihole.log.9.gz
-rw-r----- 1 pihole pihole  957K Oct  6 00:00 /var/log/pihole/pihole.log.8.gz
-rw-r----- 1 pihole pihole   27K Oct  6 00:45 /var/log/pihole/pihole.log.7.gz
-rw-r----- 1 pihole pihole 1023K Oct  7 00:00 /var/log/pihole/pihole.log.6.gz
-rw-r----- 1 pihole pihole   20K Oct  7 00:15 /var/log/pihole/pihole.log.5.gz
-rw-r----- 1 pihole pihole  1.1M Oct  8 00:00 /var/log/pihole/pihole.log.4.gz
-rw-r----- 1 pihole pihole   31K Oct  8 00:40 /var/log/pihole/pihole.log.3.gz
-rw-r----- 1 pihole pihole  842K Oct  9 00:00 /var/log/pihole/pihole.log.2.gz
-rw-r----- 1 pihole pihole  249K Oct  9 00:17 /var/log/pihole/pihole.log.1
-rw-r----- 1 pihole pihole   11M Oct  9 21:59 /var/log/pihole/pihole.log

The reason that I noticed this is because my Pi was set to reboot daily or every second day at 23:55 (to resolve this https://discourse.pi-hole.net/t/what-is-the-effect-of-rtr-advert-eth0-ipv6-prefix-old-prefix/). I stopped this after seeing the log rotation times (on the 6th).

Because of the reboots, I changed rotate 5 to rotate 14 in the pihole.log section of /etc/logrotate.d/pihole.

As you can see, the rotations are not due to reboots.

Oct 03 12:32:14 dns-server systemd-logind[336]: The system will reboot now!
Oct 03 23:55:01 dns-server systemd-logind[335]: The system will reboot now!
Oct 04 16:34:45 dns-server systemd-logind[338]: The system will reboot now!
Oct 04 23:55:01 dns-server systemd-logind[334]: The system will reboot now!
Oct 05 20:09:11 dns-server systemd-logind[336]: The system will reboot now!
Oct 05 23:55:01 dns-server systemd-logind[335]: The system will reboot now!

The timestamps of the first and last entries in each log file:

/var/log/pihole/pihole.log.14.gz
Oct  2 00:32:54
Oct  3 00:00:01

/var/log/pihole/pihole.log.13.gz
Oct  3 00:00:05
Oct  3 00:48:33

/var/log/pihole/pihole.log.12.gz
Oct  3 00:48:33
Oct  4 00:00:00

/var/log/pihole/pihole.log.11.gz
Oct  4 00:00:04
Oct  4 00:16:13

/var/log/pihole/pihole.log.10.gz
Oct  4 00:16:16
Oct  5 00:00:00

/var/log/pihole/pihole.log.9.gz
Oct  5 00:00:01
Oct  5 00:56:58

/var/log/pihole/pihole.log.8.gz
Oct  5 00:57:11
Oct  6 00:00:00

/var/log/pihole/pihole.log.7.gz
Oct  6 00:00:03
Oct  6 00:45:31

/var/log/pihole/pihole.log.6.gz
Oct  6 00:45:52
Oct  7 00:00:01

/var/log/pihole/pihole.log.5.gz
Oct  7 00:00:02
Oct  7 00:15:19

/var/log/pihole/pihole.log.4.gz
Oct  7 00:15:24
Oct  8 00:00:01

/var/log/pihole/pihole.log.3.gz
Oct  8 00:00:01
Oct  8 00:40:58

/var/log/pihole/pihole.log.2.gz
Oct  8 00:41:03
Oct  9 00:00:00

/var/log/pihole/pihole.log.1
Oct  9 00:00:03
Oct  9 00:17:20

/var/log/pihole/pihole.log
Oct  9 00:17:43
Oct  9 22:36:15

Can anyone tell why my pihole log file is being rotated at midnight (correct) and then again at 00:15, 00:16, 00:17, 00:40, 00:45, 00:48, 00:50 or 00:56?

DanSchaper · October 9, 2026, 3:58pm

Can you post what your logrotate file looks like now? We stop managing that file if you make changes to it.

Schrodingers-cat · October 10, 2026, 4:04am

Certainly.

 $ cat /etc/logrotate.d/pihole
/var/log/pihole/pihole.log {
    su root root
    daily
    create 640 pihole pihole
    rotate 14
    compress
    delaycompress
    notifempty
    nomail
    postrotate
        kill -USR2 $(cat /run/pihole-FTL.pid 2>/dev/null) 2>/dev/null || true
    endscript
}

# FTL.log and webserver.log are opened and closed for each line, therefore no postrotate is needed
/var/log/pihole/FTL.log {
    su root root
    weekly
    create 640 pihole pihole
    rotate 3
    compress
    delaycompress
    notifempty
    nomail
}

/var/log/pihole/webserver.log {
    su root root
    weekly
    create 640 pihole pihole
    rotate 3
    compress
    delaycompress
    notifempty
    nomail
}

DanSchaper · October 10, 2026, 4:47pm

Okay, anything in /etc/logrotate.conf?

Does logrotate -d /etc/logrotate.d/pihole show anything?

I'm looking for a system cron job that is causing multiple logrotate runs. Anything in /etc/cron.daily/ that looks duplicated? How does sudo crontab -u pihole -l look? And the root users crontab -l output?

Schrodingers-cat · October 10, 2026, 8:05pm

$ cat /etc/logrotate.conf
# see "man logrotate" for details

# global options do not affect preceding include directives

# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
#dateext

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# system-specific logs may also be configured here.

$ ls -l /etc/logrotate.d/
total 36
-rw-r--r-- 1 root root 120 Oct  8  2025 alternatives
-rw-r--r-- 1 root root 173 Jun 25  2025 apt
-rw-r--r-- 1 root root 130 Jun 23  2020 btmp
-rw-r--r-- 1 root root 125 Oct 20  2025 cloud-init
-rw-r--r-- 1 root root 112 Oct  8  2025 dpkg
-rw-r--r-- 1 root root 682 Aug 15 09:05 pihole
-rw-r--r-- 1 root root  94 Feb 18  2025 ppp
-rw-r--r-- 1 root root 145 Jul 27  2021 wtmp
-rw-r--r-- 1 root root  85 Oct 21  2025 wtmpdb

$ sudo logrotate -d /etc/logrotate.d/pihole
warning: logrotate in debug mode does nothing except printing debug messages!  Consider using verbose mode (-v) instead if this is not what you want.

reading config file /etc/logrotate.d/pihole
Reading state from file: /var/lib/logrotate/status
Allocating hash table for state file, size 64 entries
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state

Handling 3 logs

rotating pattern: /var/log/pihole/pihole.log after 1 days empty log files are not rotated, (14 rotations), old logs are removed
considering log /var/log/pihole/pihole.log
  Now: 2026-10-11 07:35
  Last rotated at 2026-10-11 00:29
  log does not need rotating (log has been rotated at 2026-10-11 00:29, which is less than a day ago)

rotating pattern: /var/log/pihole/FTL.log weekly empty log files are not rotated, (3 rotations), old logs are removed
considering log /var/log/pihole/FTL.log
  Now: 2026-10-11 07:35
  Last rotated at 2026-10-10 00:01
  log needs rotating
rotating log /var/log/pihole/FTL.log, log->rotateCount is 3
dateext suffix '-20261011'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
compressing log with: /bin/gzip
renaming /var/log/pihole/FTL.log.3.gz to /var/log/pihole/FTL.log.4.gz (rotatecount 3, logstart 1, i 3),
renaming /var/log/pihole/FTL.log.2.gz to /var/log/pihole/FTL.log.3.gz (rotatecount 3, logstart 1, i 2),
renaming /var/log/pihole/FTL.log.1.gz to /var/log/pihole/FTL.log.2.gz (rotatecount 3, logstart 1, i 1),
log /var/log/pihole/FTL.log.4.gz doesn't exist -- won't try to dispose of it
renaming /var/log/pihole/FTL.log to /var/log/pihole/FTL.log.1
creating new /var/log/pihole/FTL.log mode = 0640 uid = 999 gid = 1001

rotating pattern: /var/log/pihole/webserver.log weekly empty log files are not rotated, (3 rotations), old logs are removed
considering log /var/log/pihole/webserver.log
  Now: 2026-10-11 07:35
  Last rotated at 2026-10-06 00:45
  log needs rotating
rotating log /var/log/pihole/webserver.log, log->rotateCount is 3
dateext suffix '-20261011'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
compressing log with: /bin/gzip
renaming /var/log/pihole/webserver.log.3.gz to /var/log/pihole/webserver.log.4.gz (rotatecount 3, logstart 1, i 3),
renaming /var/log/pihole/webserver.log.2.gz to /var/log/pihole/webserver.log.3.gz (rotatecount 3, logstart 1, i 2),
renaming /var/log/pihole/webserver.log.1.gz to /var/log/pihole/webserver.log.2.gz (rotatecount 3, logstart 1, i 1),
log /var/log/pihole/webserver.log.4.gz doesn't exist -- won't try to dispose of it
renaming /var/log/pihole/webserver.log to /var/log/pihole/webserver.log.1
creating new /var/log/pihole/webserver.log mode = 0640 uid = 999 gid = 1001

$ ls -la /etc/cron.daily/
total 20
drwxr-xr-x 1 root root   82 Apr 21 10:07 .
drwxr-xr-x 1 root root 3244 Oct 11 04:38 ..
-rwxr-xr-x 1 root root 1478 Jun 25  2025 apt-compat
-rwxr-xr-x 1 root root  123 Dec 16  2025 dpkg
-rwxr-xr-x 1 root root  377 Apr  8  2025 logrotate
-rwxr-xr-x 1 root root 1395 May  2  2025 man-db
-rw-r--r-- 1 root root  102 Jun 13  2025 .placeholder

$ sudo crontab -u pihole -l
no crontab for pihole

$ sudo crontab -l
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').
#
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
#
# Output of the crontab jobs (including errors) is sent through
# email to the user the crontab file belongs to (unless redirected).
#
# For example, you can run a backup of all your user accounts
# at 5 a.m every week with:
# 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/
#
# For more information see the manual pages of crontab(5) and cron(8)
#
# m h  dom mon dow   command

# reboot daily at 11:55pm
#55 23 * * * /sbin/reboot

# reboot every second day at 11:55pm
#55 23 */2 * * /sbin/reboot

Schrodingers-cat · October 10, 2026, 8:32pm

$ sudo journalctl --since "2026-10-02 23:30" | grep pihole | grep logrotate
Oct 03 12:32:51 <hostname> CRON[509]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)
Oct 03 23:55:33 <hostname> CRON[504]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)
Oct 04 16:35:21 <hostname> CRON[522]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)
Oct 04 23:55:28 <hostname> CRON[496]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)
Oct 05 20:05:37 <hostname> CRON[519]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)
Oct 05 20:09:44 <hostname> CRON[489]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)
Oct 05 22:03:38 <hostname> CRON[484]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)
Oct 05 22:40:33 <hostname> CRON[542]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)
Oct 05 23:55:28 <hostname> CRON[486]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)
Oct 06 00:26:19 <hostname> CRON[521]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)
Oct 06 00:59:03 <hostname> CRON[513]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)
Oct 06 19:31:16 <hostname> CRON[507]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)
Oct 10 01:04:48 <hostname> CRON[515]: (root) CMD (/usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole)

darkexplosiveqwx · October 10, 2026, 10:46pm

In addition to logrotate’s default rotation, Pi-hole’s cronjob also triggers logrotate at midnight and after each reboot:

github.com/pi-hole/pi-hole

advanced/Templates/pihole.cron

f47b8ede5

# Pi-hole: A black hole for Internet advertisements
# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
# Network-wide ad blocking via your own hardware.
#
# Updates ad sources every week
#
# This file is copyright under the latest version of the EUPL.
# Please see LICENSE file for your rights under this license.
#
#
#
# This file is under source-control of the Pi-hole installation and update
# scripts, any changes made to this file will be overwritten when the software
# is updated or re-installed. Please make any changes to the appropriate crontab
# or other cron file snippets.

# Pi-hole: Update the ad sources once a week on Sunday at a random time in the
#          early morning. Download any updates from the adlists
#          Squash output to log, then splat the log to stdout on error to allow for
#          standard crontab job error handling.

This file has been truncated. show original

# Pi-hole: Flush the log daily at 00:00
#          The flush script uses logrotate
#          parameter "once": logrotate only once (default is twice)
#          parameter "quiet": don't print messages
00 00   * * *   root    PATH="$PATH:/usr/sbin:/usr/local/bin/" pihole flush once quiet

@reboot root /usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/logrotate.d/pihole

Using a second statefile has previously been reported to cause double-rotation and a PR has been merged to development:

github.com/pi-hole/pi-hole

Stop double-rotating logs now that pihole is in /etc/logrotate.d (#6663)

development ← fix/logrotate-double-rotation

merged 02:51PM - 08 Jul 26 UTC

PromoFaux

+21 -8

## Thank you for your contribution to the Pi-hole Community! Please read the co…mments below to help us consider your Pull Request. We are all volunteers and completing the process outlined will help us review your commits quicker. **Please make sure you** 1. Base your code and PRs against the repositories developmental branch. 2. [Sign Off](https://docs.pi-hole.net/guides/github/how-to-signoff/) all commits as we enforce the [DCO](https://docs.pi-hole.net/guides/github/dco/) for all contributions 3. [Sign](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits) all your commits as they must have verified signatures 4. File a pull request for any change that requires changes to [our documentation](https://docs.pi-hole.net/) at our [documentation repo](https://github.com/pi-hole/docs) --- **What does this PR aim to accomplish?:** Fixes double log rotation reported [here](https://www.reddit.com/r/pihole/comments/1upboi8/comment/ow1xea3/): since the logrotate config moved to `/etc/logrotate.d/pihole`, the system's own scheduled logrotate reads it too, on top of our own nightly/`@reboot` forced runs. **How does this PR accomplish the above?:** Our forced runs were using a private state file (`/var/lib/logrotate/pihole`), left over from when the config lived outside `/etc/logrotate.d/` and the system logrotate never saw it. Now that both the system and our own runs read the same config, two separate state files mean neither knows the other already rotated a log, so it happens twice. - Drop the private state file, use logrotate's default one so both runs agree on what's rotated - Clean up stale `/etc/pihole/logrotate` and the old state file left over from pre-migration installs - Force `nodateext` on our stanzas: if the system's `/etc/logrotate.conf` has `dateext` on (the upstream default), our config would inherit it when read via that file, but our own forced runs invoke `/etc/logrotate.d/pihole` directly and bypass it, so rotated filenames depended on which side rotated first. `piholeLogFlush.sh` also already assumes numeric suffixes for its manual flush path. **Link documentation PRs if any are needed to support this PR:** None needed. --- **By submitting this pull request, I confirm the following:** 1. I have read and understood the [contributors guide](https://docs.pi-hole.net/guides/github/contributing/), as well as this entire template. I understand which branch to base my commits and Pull Requests against. 2. I have commented my proposed changes within the code and I have tested my changes. 3. I am willing to help maintain this change if there are issues with it later. 4. It is compatible with the [EUPL 1.2 license](https://opensource.org/licenses/EUPL-1.2) 5. I have squashed any insignificant commits. ([`git rebase`](http://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html)) 6. I have checked that another pull request for this purpose does not exist. 7. I have considered, and confirmed that this submission will be valuable to others. 8. I accept that this submission may not be used, and the pull request closed at the will of the maintainer. 9. I give this submission freely, and claim no ownership to its content. --- - [x] I have read the above and my PR is ready for review. *Check this box to confirm*

Schrodingers-cat · October 11, 2026, 7:04am

Okay. Thanks for the information.

What can I do in the interim to resolve the problem, while we wait for an updated release?

Would removing /etc/pihole/logrotate be the best solution?

DanSchaper · October 11, 2026, 7:49pm

Schrodingers-cat:

rotating pattern: /var/log/pihole/FTL.log weekly empty log files are not rotated, (3 rotations), old logs are removed
considering log /var/log/pihole/FTL.log
  Now: 2026-10-11 07:35
  Last rotated at 2026-10-10 00:01
  log needs rotating

That seems off to me. It's a weekly rotation but less than a week between now and Last rotated yet it still shows as needing rotation.

Schrodingers-cat · October 12, 2026, 4:35am

I've implemented the changes in Stop double-rotating logs now that pihole is in /etc/logrotate.d.

Now the status of the FTL and webserver logs is log does not need rotating, so perhaps that fixed the problem that was causing the FTL and webserver logs to be rotated daily (since Saturday).

$ sudo logrotate -d /etc/logrotate.d/pihole

reading config file /etc/logrotate.d/pihole
Reading state from file: /var/lib/logrotate/status
Allocating hash table for state file, size 64 entries

Handling 3 logs

rotating pattern: /var/log/pihole/pihole.log after 1 days empty log files are not rotated, (14 rotations), old logs are removed
considering log /var/log/pihole/pihole.log
  Now: 2026-10-12 15:41
  Last rotated at 2026-10-12 00:49
  log does not need rotating (log has been rotated at 2026-10-12 00:49, which is less than a day ago)

rotating pattern: /var/log/pihole/FTL.log weekly empty log files are not rotated, (3 rotations), old logs are removed
considering log /var/log/pihole/FTL.log
  Now: 2026-10-12 15:41
  Last rotated at 2026-10-10 00:01
  log does not need rotating (log has been rotated at 2026-10-10 00:01, which is less than a week ago)

rotating pattern: /var/log/pihole/webserver.log weekly empty log files are not rotated, (3 rotations), old logs are removed
considering log /var/log/pihole/webserver.log
  Now: 2026-10-12 15:41
  Last rotated at 2026-10-06 00:45
  log does not need rotating (log has been rotated at 2026-10-06 00:45, which is less than a week ago)

Interestingly, the date and time the FTL and webserver logs were last rotated are wrong above. Each has been rotated three time since.

-rw-r----- 1 pihole pihole     125 Oct 10 00:01 FTL.log.3.gz
-rw-r----- 1 pihole pihole   10517 Oct 11 00:00 FTL.log.2.gz
-rw-r----- 1 pihole pihole   62319 Oct 12 00:00 FTL.log.1
-rw-r----- 1 pihole pihole   22835 Oct 12 18:56 FTL.log

-rw-r----- 1 pihole pihole     134 Oct  6 19:31 webserver.log.3.gz
-rw-r----- 1 pihole pihole     193 Oct 10 16:53 webserver.log.2.gz
-rw-r----- 1 pihole pihole     606 Oct 11 23:55 webserver.log.1
-rw-r----- 1 pihole pihole       0 Oct 12 00:00 webserver.log

I'll monitor the system to check everything is working as expected after the changes.

Also, why are all directory listings shown in red with a pink background (I worked out how to stop this)?