Query logging clarification

Help
1

Turned off query logging in "Settings" web page

Expected Behaviour:

No logs in "Query Log" web page

Actual Behaviour:

I can still see logs in "Query Log" web page

As i understand the log file that is flushed and turned off is /var/log/pihole.log. So then where do the logs in the "Query Log" web page come from? Is there any other place where the queries are logged other than dnsmasq? Are they different logs all together?

I'm confused about the logs in pi-hole, can somebody share some light on the files and what they actually log?

3

The data you see in your Query Log is pulled from the /etc/pihole/pihole-FTL.db file.

I order to wipe the Query Log clean, you need to delete the said file and restart pihole-FTL.

4

Is there also a pihole-FTL.log file? If so what is it's relation to the sqlite pihole-FTL.db database? If i would like to send the query logs to a remote rsyslog server, which logs should i send? FTL or dnsmasq? Are they the same?

5

Yes there is.

That one however, is for entries from the pihole-FTL binary, and it does not contain relevant data to actual DNS queries.

/var/log/pihole.log contains the data you want to send to the remote rsyslog server.

The log is actually rotated based on your /etc/cron.d/pihole schedule/file.

6

So i did the dnsmasq changes in /etc/dnsmasq.d/01-pihole.conf and sent the query logs to /var/log/syslog and then to a remote syslog server based on a $programname == 'dnsmasq' filter rather than /var/log/pihole.log. Yet i can still see query logs in the “Query Log” web page. Are they coming from pihole-FTL.db? How is this database still populated and by what program? Does the FTL daemon know that i changed the destination of the dnsmasq logs? Does it tap into dnsmasq somehow and gets a copy of the query logs? Or does it generate its entries despite and independent of dnsmasq?

7

See our Long-term database documentation here:

https://docs.pi-hole.net/ftldns/database/

also configuring parameters:

https://docs.pi-hole.net/ftldns/configfile/#database-settings

8

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.