PiHole randomly stop serving DNS

Expected Behaviour:

Be able to browse the internet and not needing to reboot pi-hole every few days

Actual Behaviour:

Every other few days pi-hole stops responding and I can't resolve DNS. I can ping my pi-hole. But DNS just isn't resolved anymore. When I reboot my Raspberry it works again.

Debug Token:

https://tricorder.pi-hole.net/3zszu8ots4!

Nothing unusual shows in your debug log. The next time this happens, do some basic DNS checks from a client:

nslookup pi.hole

nslookup cnn.com

nslookup cnn.com 1.1.1.1

Also, following the problem look in these logs on the Pi for any errors:

/var/log/pihole.log

/var/log/pihole-FTL.log

/var/log/syslog

I have the error again. For nslookup I get

PS C:\WINDOWS\system32> nslookup pi.hole
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.178.254

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.

PS C:\WINDOWS\system32> nslookup cnn.com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.178.254

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.

PS C:\WINDOWS\system32> nslookup cnn.com 1.1.1.1
Server: one.one.one.one
Address: 1.1.1.1

Non-authoritative answer:
Name: cnn.com
Addresses: 2a04:4e42:200::323
2a04:4e42:400::323
2a04:4e42:600::323
2a04:4e42::323
151.101.193.67
151.101.1.67
151.101.65.67
151.101.129.67

In the admin panel I see Red icon for DNS not running and red icon for ftl
This is my debug.log sanitized

This process collects information from your Pi-hole, and optionally uploads it to a unique and random directory on tricorder.pi-hole.net.

The intent of this script is to allow users to self-diagnose their installations. This is accomplished by running tests against our software and providing the user with links to FAQ articles when a problem is detected. Since we are a small team and Pi-hole has been growing steadily, it is our hope that this will help us spend more time on development.

NOTE: All log files auto-delete after 48 hours and ONLY the Pi-hole developers can access your data via the given token. We have taken these extra steps to secure your data and will work to further reduce any personal information gathered.

*** [ INITIALIZING ]
[i] 2019-04-16:13:57:52 debug log has been initialized.

*** [ INITIALIZING ] Sourcing setup variables
[i] Sourcing /etc/pihole/setupVars.conf...

*** [ DIAGNOSING ]: Core version
[i] Core: v4.2.2 (How do I update Pi-hole?)
[i] Branch: master
[i] Commit: v4.2.2-0-gba1e94d

*** [ DIAGNOSING ]: Web version
[i] Web: v4.2 (How do I update Pi-hole?)
[i] Branch: master
[i] Commit: v4.2-0-g347994db

*** [ DIAGNOSING ]: FTL version
[✓] FTL: v4.2.3 (How do I update Pi-hole?)

*** [ DIAGNOSING ]: lighttpd version
[i] 1.4.45

*** [ DIAGNOSING ]: php version
[i] 7.0.27

*** [ DIAGNOSING ]: Operating system
[✓] Raspbian GNU/Linux 9 (stretch)

*** [ DIAGNOSING ]: SELinux
[i] SELinux not detected

*** [ DIAGNOSING ]: Processor
[✓] armv7l

*** [ DIAGNOSING ]: Networking
[✓] IPv4 address(es) bound to the eth0 interface:
192.168.178.254/24 matches the IP found in /etc/pihole/setupVars.conf

[✓] IPv6 address(es) bound to the eth0 interface:
fe80::a0f2:e6fc:120d:4990 does not match the IP found in /etc/pihole/setupVars.conf (Use IPv6 ULA addresses for Pi-hole)

^ Please note that you may have more than one IP address listed.
As long as one of them is green, and it matches what is in /etc/pihole/setupVars.conf, there is no need for concern.

The link to the FAQ is for an issue that sometimes occurs when the IPv6 address changes, which is why we check for it.

[i] Default IPv4 gateway: 192.168.178.1

  • Pinging 192.168.178.1...
    [✓] Gateway responded.

*** [ DIAGNOSING ]: Ports in use
:22 sshd (IPv4)
:22 sshd (IPv6)
[
:80] is in use by lighttpd
[
:80] is in use by lighttpd
*:8080 domoticz (IPv6)
*:443 domoticz (IPv6)
*:6144 domoticz (IPv6)

*** [ DIAGNOSING ]: Name resolution (IPv4) using a random blocked domain and a known ad-serving domain
[✗] Failed to resolve bid.openx.net via localhost (127.0.0.1)
[✗] Failed to resolve bid.openx.net via Pi-hole (192.168.178.254)
[✓] doubleclick.com is 172.217.17.46 via a remote, public DNS server (8.8.8.8)

*** [ DIAGNOSING ]: Pi-hole processes
[✓] lighttpd daemon is active
[✓] pihole-FTL daemon is active

*** [ DIAGNOSING ]: Setup variables
PIHOLE_INTERFACE=eth0
IPV4_ADDRESS=192.168.178.254/24
IPV6_ADDRESS=
PIHOLE_DNS_1=8.8.8.8
PIHOLE_DNS_2=8.8.4.4
QUERY_LOGGING=true
INSTALL_WEB_SERVER=true
INSTALL_WEB_INTERFACE=true
LIGHTTPD_ENABLED=true
BLOCKING_ENABLED=true

*** [ DIAGNOSING ]: Dashboard and block page
[✗] Block page X-Header: X-Header does not match or could not be retrieved.
HTTP/1.1 200 OK
Content-type: text/html; charset=UTF-8
Date: Tue, 16 Apr 2019 12:01:53 GMT
Server: lighttpd/1.4.45

[✓] Web interface X-Header: X-Pi-hole: The Pi-hole Web interface is working!

*** [ DIAGNOSING ]: Gravity list
-rw-r--r-- 1 root root 2630167 Apr 14 03:03 /etc/pihole/gravity.list
-----head of gravity.list------
0.0.0.0
0.nextyourcontent.com
0.r.msn.com
0.start.bz

-----tail of gravity.list------
zzz.clickbank.net
zzzezeroe.fr
zzzpooeaz-france.com
zzzrtrcm2.com

*** [ DIAGNOSING ]: contents of /etc/pihole

-rw-r--r-- 1 root root 381 Aug 10 2018 /etc/pihole/adlists.list
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://mirror1.malwaredomains.com/files/justdomains
http://sysctl.org/cameleon/hosts
https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist
https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt
https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
https://hosts-file.net/ad_servers.txt

-rw-r--r-- 1 root root 0 Aug 10 2018 /etc/pihole/blacklist.txt

-rw-r--r-- 1 root root 52 Apr 14 03:03 /etc/pihole/local.list
192.168.178.254 raspberrypi
192.168.178.254 pi.hole

-rw-r--r-- 1 root root 234 Mar 19 12:07 /etc/pihole/logrotate
/var/log/pihole.log {
su root root
daily
copytruncate
rotate 5
compress
delaycompress
notifempty
nomail
}
/var/log/pihole-FTL.log {
su root root
weekly
copytruncate
rotate 3
compress
delaycompress
notifempty
nomail
}

-rw-r--r-- 1 root root 162 Sep 15 2018 /etc/pihole/whitelist.txt
raw.githubusercontent.com
mirror1.malwaredomains.com
sysctl.org
zeustracker.abuse.ch
s3.amazonaws.com
hosts-file.net
www.googleadservices.com
adservice.google.nl

*** [ DIAGNOSING ]: contents of /etc/dnsmasq.d

-rw-r--r-- 1 root root 1586 Mar 19 12:07 /etc/dnsmasq.d/01-pihole.conf
addn-hosts=/etc/pihole/gravity.list
addn-hosts=/etc/pihole/black.list
addn-hosts=/etc/pihole/local.list
localise-queries
no-resolv
cache-size=10000
log-queries
log-facility=/var/log/pihole.log
local-ttl=2
log-async
dhcp-name-match=set:wpad-ignore,wpad
dhcp-ignore-names=tag:wpad-ignore
server=8.8.8.8
server=8.8.4.4
interface=eth0

*** [ DIAGNOSING ]: contents of /etc/lighttpd

-rw-r--r-- 1 root root 3102 Mar 19 12:07 /etc/lighttpd/lighttpd.conf
server.modules = (
"mod_access",
"mod_accesslog",
"mod_auth",
"mod_expire",
"mod_compress",
"mod_redirect",
"mod_setenv",
"mod_rewrite"
)
server.document-root = "/var/www/html"
server.error-handler-404 = "pihole/index.php"
server.upload-dirs = ( "/var/cache/lighttpd/uploads" )
server.errorlog = "/var/log/lighttpd/error.log"
server.pid-file = "/var/run/lighttpd.pid"
server.username = "www-data"
server.groupname = "www-data"
server.port = 80
accesslog.filename = "/var/log/lighttpd/access.log"
accesslog.format = "%{%s}t|%V|%r|%s|%b"
index-file.names = ( "index.php", "index.html", "index.lighttpd.html" )
url.access-deny = ( "~", ".inc", ".md", ".yml", ".ini" )
static-file.exclude-extensions = ( ".php", ".pl", ".fcgi" )
compress.cache-dir = "/var/cache/lighttpd/compress/"
compress.filetype = ( "application/javascript", "text/css", "text/html", "text/plain" )
include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port
include_shell "/usr/share/lighttpd/create-mime.assign.pl"
include_shell "find /etc/lighttpd/conf-enabled -name '*.conf' -a ! -name 'letsencrypt.conf' -printf 'include "%p"
' 2>/dev/null"
$HTTP["url"] =~ "^/admin/" {

   setenv.add-response-header = (
       "X-Pi-hole" => "The Pi-hole Web interface is working!",
       "X-Frame-Options" => "DENY"
   )
   $HTTP["url"] =~ ".ttf$" {
       
       setenv.add-response-header = ( "Access-Control-Allow-Origin" => "*" )
   }

}
$HTTP["url"] =~ "^/admin/.(.*)" {
url.access-deny = ("")
}
include_shell "cat external.conf 2>/dev/null"

*** [ DIAGNOSING ]: contents of /etc/cron.d

-rw-r--r-- 1 root root 1703 Mar 19 12:07 /etc/cron.d/pihole
3 3 * * 7 root PATH="$PATH:/usr/local/bin/" pihole updateGravity >/var/log/pihole_updateGravity.log || cat /var/log/pihole_updateGravity.log
00 00 * * * root PATH="$PATH:/usr/local/bin/" pihole flush once quiet
@reboot root /usr/sbin/logrotate /etc/pihole/logrotate
*/10 * * * * root PATH="$PATH:/usr/local/bin/" pihole updatechecker local
25 17 * * * root PATH="$PATH:/usr/local/bin/" pihole updatechecker remote
@reboot root PATH="$PATH:/usr/local/bin/" pihole updatechecker remote reboot

*** [ DIAGNOSING ]: contents of /var/log/lighttpd

-rw-r--r-- 1 www-data www-data 1799 Apr 16 14:01 /var/log/lighttpd/error.log
2019-04-14 06:25:04: (server.c.1534) logfiles cycled UID = 0 PID = 9905
2019-04-16 13:41:04: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Notice: Undefined offset: 2 in /var/www/html/admin/scripts/pi-hole/php/update_checker.php on line 47
2019-04-16 13:41:04: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Notice: Undefined offset: 2 in /var/www/html/admin/scripts/pi-hole/php/update_checker.php on line 52
2019-04-16 13:56:50: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: exec(): Unable to fork [sudo pihole status web] in /var/www/html/admin/scripts/pi-hole/php/header.php on line 326
2019-04-16 14:01:34: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: file(http://127.0.0.1/admin/scripts/pi-hole/php/queryads.php?domain=localhost&bp): failed to open stream: HTTP request failed! in /var/www/html/pihole/index.php on line 137
2019-04-16 14:01:34: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: array_filter() expects parameter 1 to be array, string given in /var/www/html/pihole/index.php on line 138
2019-04-16 14:01:34: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: array_values() expects parameter 1 to be array, null given in /var/www/html/pihole/index.php on line 138
2019-04-16 14:01:53: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: file(http://127.0.0.1/admin/scripts/pi-hole/php/queryads.php?domain=localhost&bp): failed to open stream: HTTP request failed! in /var/www/html/pihole/index.php on line 137
2019-04-16 14:01:53: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: array_filter() expects parameter 1 to be array, string given in /var/www/html/pihole/index.php on line 138
2019-04-16 14:01:53: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: array_values() expects parameter 1 to be array, null given in /var/www/html/pihole/index.php on line 138

*** [ DIAGNOSING ]: contents of /var/log

-rw-r--r-- 1 root root 4541 Apr 16 13:54 /var/log/pihole-FTL.log
-----head of pihole-FTL.log------
[2019-04-16 13:54:32.635 12503] Using log file /var/log/pihole-FTL.log
[2019-04-16 13:54:32.638 12503] ########## FTL started! ##########
[2019-04-16 13:54:32.638 12503] FTL branch: master
[2019-04-16 13:54:32.638 12503] FTL version: v4.2.3
[2019-04-16 13:54:32.638 12503] FTL commit: aae487e
[2019-04-16 13:54:32.639 12503] FTL date: 2019-02-25 17:18:14 -0800
[2019-04-16 13:54:32.639 12503] FTL user: root
[2019-04-16 13:54:32.642 12503] WARNING: Starting pihole-FTL as user root is not recommended
[2019-04-16 13:54:32.642 12503] Starting config file parsing (/etc/pihole/pihole-FTL.conf)
[2019-04-16 13:54:32.643 12503] SOCKET_LISTENING: only local
[2019-04-16 13:54:32.643 12503] AAAA_QUERY_ANALYSIS: Show AAAA queries
[2019-04-16 13:54:32.643 12503] MAXDBDAYS: max age for stored queries is 365 days
[2019-04-16 13:54:32.643 12503] RESOLVE_IPV6: Resolve IPv6 addresses
[2019-04-16 13:54:32.643 12503] RESOLVE_IPV4: Resolve IPv4 addresses
[2019-04-16 13:54:32.643 12503] DBINTERVAL: saving to DB file every minute
[2019-04-16 13:54:32.644 12503] DBFILE: Using /etc/pihole/pihole-FTL.db
[2019-04-16 13:54:32.644 12503] MAXLOGAGE: Importing up to 24.0 hours of log data
[2019-04-16 13:54:32.646 12503] PRIVACYLEVEL: Set to 0
[2019-04-16 13:54:32.646 12503] IGNORE_LOCALHOST: Show queries from localhost
[2019-04-16 13:54:32.646 12503] BLOCKINGMODE: Null IPs for blocked domains
[2019-04-16 13:54:32.647 12503] REGEX_DEBUGMODE: Inactive
[2019-04-16 13:54:32.647 12503] ANALYZE_ONLY_A_AND_AAAA: Disabled. Analyzing all queries
[2019-04-16 13:54:32.647 12503] DBIMPORT: Importing history from database
[2019-04-16 13:54:32.647 12503] PIDFILE: Using /var/run/pihole-FTL.pid
[2019-04-16 13:54:32.647 12503] PORTFILE: Using /var/run/pihole-FTL.port
[2019-04-16 13:54:32.647 12503] SOCKETFILE: Using /var/run/pihole/FTL.sock
[2019-04-16 13:54:32.648 12503] WHITELISTFILE: Using /etc/pihole/whitelist.txt
[2019-04-16 13:54:32.648 12503] BLACKLISTFILE: Using /etc/pihole/black.list
[2019-04-16 13:54:32.648 12503] GRAVITYFILE: Using /etc/pihole/gravity.list
[2019-04-16 13:54:32.648 12503] REGEXLISTFILE: Using /etc/pihole/regex.list
[2019-04-16 13:54:32.648 12503] SETUPVARSFILE: Using /etc/pihole/setupVars.conf
[2019-04-16 13:54:32.649 12503] AUDITLISTFILE: Using /etc/pihole/auditlog.list
[2019-04-16 13:54:32.649 12503] Finished config file parsing
[2019-04-16 13:54:32.683 12503] Database successfully initialized
[2019-04-16 13:54:32.701 12503] New forward server: 8.8.4.4 (0/4096)

-----tail of pihole-FTL.log------
[2019-04-16 13:54:32.648 12503] BLACKLISTFILE: Using /etc/pihole/black.list
[2019-04-16 13:54:32.648 12503] GRAVITYFILE: Using /etc/pihole/gravity.list
[2019-04-16 13:54:32.648 12503] REGEXLISTFILE: Using /etc/pihole/regex.list
[2019-04-16 13:54:32.648 12503] SETUPVARSFILE: Using /etc/pihole/setupVars.conf
[2019-04-16 13:54:32.649 12503] AUDITLISTFILE: Using /etc/pihole/auditlog.list
[2019-04-16 13:54:32.649 12503] Finished config file parsing
[2019-04-16 13:54:32.683 12503] Database successfully initialized
[2019-04-16 13:54:32.701 12503] New forward server: 8.8.4.4 (0/4096)
[2019-04-16 13:54:32.713 12503] New forward server: 8.8.8.8 (1/4096)
[2019-04-16 13:54:32.716 12503] Resizing "/FTL-strings" from 4096 to 8192
[2019-04-16 13:54:32.728 12503] Resizing "/FTL-strings" from 8192 to 12288
[2019-04-16 13:54:32.770 12503] Resizing "/FTL-strings" from 12288 to 16384
[2019-04-16 13:54:32.785 12503] Resizing "/FTL-queries" from 229376 to 458752
[2019-04-16 13:54:32.806 12503] Resizing "/FTL-strings" from 16384 to 20480
[2019-04-16 13:54:32.876 12503] Resizing "/FTL-queries" from 458752 to 688128
[2019-04-16 13:54:32.883 12503] Resizing "/FTL-strings" from 20480 to 24576
[2019-04-16 13:54:32.955 12503] Resizing "/FTL-strings" from 24576 to 28672
[2019-04-16 13:54:32.959 12503] Resizing "/FTL-queries" from 688128 to 917504
[2019-04-16 13:54:32.966 12503] Imported 12543 queries from the long-term database
[2019-04-16 13:54:32.967 12503] -> Total DNS queries: 12543
[2019-04-16 13:54:32.967 12503] -> Cached DNS queries: 3810
[2019-04-16 13:54:32.967 12503] -> Forwarded DNS queries: 6494
[2019-04-16 13:54:32.968 12503] -> Exactly blocked DNS queries: 2235
[2019-04-16 13:54:32.968 12503] -> Unknown DNS queries: 4
[2019-04-16 13:54:32.968 12503] -> Unique domains: 997
[2019-04-16 13:54:32.968 12503] -> Unique clients: 10
[2019-04-16 13:54:32.968 12503] -> Known forward destinations: 2
[2019-04-16 13:54:32.992 12503] Successfully accessed setupVars.conf
[2019-04-16 13:54:33.024 12503] PID of FTL process: 12503
[2019-04-16 13:54:33.024 12503] Listening on port 4711 for incoming IPv4 telnet connections
[2019-04-16 13:54:33.025 12503] Listening on port 4711 for incoming IPv6 telnet connections
[2019-04-16 13:54:33.026 12503] Listening on Unix socket
[2019-04-16 13:54:33.050 12503] Compiled 0 Regex filters and 8 whitelisted domains in 8.6 msec (0 errors)
[2019-04-16 13:54:33.053 12503] /etc/pihole/black.list: parsed 0 domains (took 0.1 ms)
[2019-04-16 13:54:35.419 12503] /etc/pihole/gravity.list: parsed 112086 domains (took 2272.6 ms)

*** [ DIAGNOSING ]: contents of /dev/shm
-rw------- 1 root root 2621440 Apr 16 13:54 /dev/shm/FTL-clients
-rw------- 1 root root 108 Apr 16 13:54 /dev/shm/FTL-counters
-rw------- 1 root root 131072 Apr 16 13:54 /dev/shm/FTL-domains
-rw------- 1 root root 163840 Apr 16 13:54 /dev/shm/FTL-forwarded
-rw------- 1 root root 28 Apr 16 13:54 /dev/shm/FTL-lock
-rw------- 1 root root 8192 Apr 16 13:54 /dev/shm/FTL-overTime
-rw------- 1 root root 917504 Apr 16 13:59 /dev/shm/FTL-queries
-rw------- 1 root root 12 Apr 16 13:54 /dev/shm/FTL-settings
-rw------- 1 root root 28672 Apr 16 13:54 /dev/shm/FTL-strings

*** [ DIAGNOSING ]: Locale
LANG=

*** [ DIAGNOSING ]: Pi-hole log
-rw-r--r-- 1 pihole pihole 1544983 Apr 16 13:59 /var/log/pihole.log
-----head of pihole.log------
Apr 16 00:00:03 dnsmasq[631]: query[A] gs-loc-new.ls-apple.com.akadns.net from 192.168.178.136
Apr 16 00:00:03 dnsmasq[631]: forwarded gs-loc-new.ls-apple.com.akadns.net to 8.8.4.4
Apr 16 00:00:03 dnsmasq[631]: query[A] log.trannergy.com from 127.0.0.1
Apr 16 00:00:03 dnsmasq[631]: cached log.trannergy.com is 47.88.6.171
Apr 16 00:00:03 dnsmasq[631]: query[AAAA] log.trannergy.com from 127.0.0.1
Apr 16 00:00:03 dnsmasq[631]: cached log.trannergy.com is NODATA-IPv6
Apr 16 00:00:03 dnsmasq[631]: reply gs-loc-new.ls-apple.com.akadns.net is
Apr 16 00:00:03 dnsmasq[631]: reply gs-loc.ls-apple.com.akadns.net is 17.134.127.250
Apr 16 00:00:03 dnsmasq[631]: reply gs-loc.ls-apple.com.akadns.net is 17.134.127.249
Apr 16 00:01:03 dnsmasq[631]: query[A] gs-loc.apple.com from 192.168.178.136
Apr 16 00:01:03 dnsmasq[631]: forwarded gs-loc.apple.com to 8.8.4.4
Apr 16 00:01:03 dnsmasq[631]: reply gs-loc.apple.com is
Apr 16 00:01:03 dnsmasq[631]: reply gs-loc-new.ls-apple.com.akadns.net is
Apr 16 00:01:03 dnsmasq[631]: reply gs-loc.ls-apple.com.akadns.net is 17.134.127.250
Apr 16 00:01:03 dnsmasq[631]: reply gs-loc.ls-apple.com.akadns.net is 17.134.127.249
Apr 16 00:02:05 dnsmasq[631]: query[A] gs-loc.ls-apple.com.akadns.net from 192.168.178.136
Apr 16 00:02:05 dnsmasq[631]: forwarded gs-loc.ls-apple.com.akadns.net to 8.8.4.4
Apr 16 00:02:05 dnsmasq[631]: reply gs-loc.ls-apple.com.akadns.net is 17.167.192.128
Apr 16 00:02:05 dnsmasq[631]: reply gs-loc.ls-apple.com.akadns.net is 17.167.194.149
Apr 16 00:02:10 dnsmasq[631]: query[A] mesu.apple.com from 192.168.178.104

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.