I run pihole on an arm machine that runs dietpi. It seams to run fine but I've notice that the query log is flushed several times per day and the graph is then also cleared. Also if I reboot the machine it seams to flush the log.
Is this normal?
Second, I've notice on my router (ddwrt) that there are many unreplied connection from the pihole to router and back from router to pihole. Can someone please explain?
Thanks.
Dietpi likes to flush the logs for all applications very often, although the Pi-hole log should be excluded from this behavior. The router - Pi-hole connections might be the router trying to call home. What kind of connections do you see?
Sorry for the late reply and thank you for helping me.
This are the connection that I metionet:
My router is set up for local dns names but the dns server is set to Pihole at 192.168.1.222
THis are my router settings:
This are my Pihole setting for upstream dns, custom1 is my router and custom2 is my isp dns:
What I can not understand is that the most of connection (talking) is between the pihole 192.168.1.222 and the router 192.168.1.1
You can see this also from top clients:
In top clients also other clients are showed with there correct local names but the router has 15000 request from 00.00 AM and the nr 2 in top has aprox 450 wich is my laptop.
When I look to the log for ddwrt.home.lan (my router) i can see requests for domaines that belongs to my nas or android phone or my laptop but are count as requested from my router.
Appreciate any other detailed explanation...hoping to learn more about networking and DNS 
THnaks
It's because you entered router IP (192.168.1.1) as pihole upstream server. So pihole is contacting 192.168.1.1 for address resolution. You just remove 192.168.1.1 from pihole and select Google or OpenDNS
Thanks,
Why are then mostly all request from 192.168.1.222 (pihole) to router (192.168.1.1) and back from 192.168.1.1 to 192.168.1.222, unreplied?
Already tried that, you ar right I know that, but if i remove 192.168.1.1 from upstream dns custom1 then pihole does not resolve my local names any more. Local names and dhcp are managed from my router.
I am confused what is the right setup. What I have read on this forum is to let pihole manage dhcp and local names but I do not want that.
I guess thats it, I have to let router as custom1 upstream dns so local names are resolved.
If someone can confirm this, than it I will leave the setup as it is.
Back to actually what was my first question, flushing the log. The log was recorded from 00.00 AM until 10.00 AM. Apparently then it was flushed automaticly. I can se that on the graph because it was cleared and the new graph start from 10.00 AM. It seams that I can not have a log over an entire day because it is flushed. Is there a way to deactivated this behavior and set a custom flushing schedule?
Check your timezone, logs are flushed at midnight.
Use dpkg-reconfigure tzdata to reconfigure your timezone or if you want previous day's log and other goodies enter pihole checkout dev
I don't think it's related to timezone. Last registration in the log is just at my current time so time settings are correct. Now it's 15.12 at my timezone and seams that log was just flushed because all I can see in graph is starting now at 14.00. Has the log a file size limit, can this limit be increased?
Use FTL branch, it has a feature to keep logs for more than a day
It looks like you have a loop going on between the router and Pi-hole. The router is setup so that if it gets asked for DNS, it asks the Pi-hole. The Pi-hole is setup so that if it gets asked for DNS, it (sometimes*) asks the router. You should disable dnsmasq in your router so that instead of internally handling client DNS requests, it just sends the clients the Pi-hole as DNS. This will also have the effect of giving you per-device stats in the Pi-hole web interface. You can also disable DHCP in your router and enable it on the Pi-hole. That will automatically let all devices use Pi-hole, give per-device stats in the web interface, and still keep the local hostnames for devices. Since Pi-hole also uses dnsmasq, you can use all your options you have configured in your router with Pi-hole (add them under /etc/dnsmasq.d/).
*Sometimes because there are two upstreams and dnsmasq isn't configured to always ask both for every query.
@Mcat12
Thanks for your advice, I will try your recommandatiosn when I get home.
Another strange thing that happen on my pihole is that it sometimes resolve local dns names sometimes not. Could this be because of the loop you mentioned that happens on my current setup?
Probably because you have two upstream DNS servers, and it doesn't ask both for every query.
@Mcat12
Thanks for your explanations, I finally find the right setup for my "dns loop" (if I may call it like this)
What I did was let my router serve only the pihole dns (192.168.1.222).
Because of "dhcp-option=6, 192.168.1.222,192.168.1.1" the router was serving the routers IP as the secound dns.
Also I set for the pihole only one upstream dns which is of cource the router dns 192.168.1.1
Now everything is working as expected, pihole resolve all local hostname delivered from my router and I get detailed query log per each local hostname.
Thank you Mcat12 for helping me out and this way learned something more about pihole and networking.
1 Like