Recently bridged and am using Pi-Hole as DNS but Pi-Hole won't run properly

Last night, I bridged over the comcast router and Pi-Hole was working fine as the DNS for awhile, until it started saying “Lost Connection to API” this morning on the Pi-hole Admin Console. Tried to find some answers and tried a few things but I’m stuck - can’t even get a proper debug token - help!

sudo service pihole-FTL restart
##Nothing happens

pihole-FTL version
##v4.3.1

pihole -d
##There was an error uploading your debug log.

  • Please try again or contact the Pi-hole team for assistance.

This will temporarily reset the nameserver on the Pi to bypass Pi-Hole DNS.

sudo nano /etc/resolv.conf

edit nameserver 127.0.0.1 to nameserver 9.9.9.9 or your preferred third party DNS service, save and exit

Run pihole -d and upload the debug log

I’m not sure what is going on. I did, however, follow your instructions:

[?] Would you like to upload the log? [y/N] y
* Using curl for transmission.

[✗] There was an error uploading your debug log.

  • Please try again or contact the Pi-hole team for assistance.
  • A local copy of the debug log can be found at: /var/log/pihole_debug.log

PM me the log.

Now I can’t even open the log! oh my…:

Could not allocate 2470296913 bytes to read file “/var/log/pihole.log”

What is the output of:

ls -lh /var/log/pihole*

-rw-r--r-- 1 root   pihole  29K Oct  8 10:59 /var/log/pihole_debug.log
-rw-r--r-- 1 pihole pihole 3.0M Oct  8 11:31 /var/log/pihole-FTL.log
-rw-r--r-- 1 pihole pihole  25K Oct  8 00:00 /var/log/pihole-FTL.log.1
-rw-r--r-- 1 pihole pihole  282 Oct  7 00:00 /var/log/pihole-FTL.log.2.gz
-rw-r--r-- 1 pihole pihole 1.3K Oct  5 00:00 /var/log/pihole-FTL.log.3.gz
-rw-r--r-- 1 pihole pihole 2.4G Oct  8 11:29 /var/log/pihole.log
-rw-r--r-- 1 pihole pihole  33M Oct  8 00:00 /var/log/pihole.log.1
-rw-r--r-- 1 pihole pihole 1.7K Oct  7 20:17 /var/log/pihole.log.2.gz
-rw-r--r-- 1 pihole pihole 3.2K Oct  7 00:00 /var/log/pihole.log.3.gz
-rw-r--r-- 1 pihole pihole 1.4K Oct  6 00:00 /var/log/pihole.log.4.gz
-rw-r--r-- 1 pihole pihole 1.8K Oct  5 00:00 /var/log/pihole.log.5.gz
-rw-r--r-- 1 root   root   6.2K Oct  6 03:55 /var/log/pihole_updateGravity.log

/var/log/pihole:
total 0

This is an abnormally large file. Something must have caused a very high number of queries today to make the log that large. Since there is a lot of data in that file, there should also be at least that much data in the long term database, and that is likely what is causing a problem with Pi-Hole working properly. The long term database is read each time Pi-Hole starts, to get the last 24 hours of data to populate the dashboard.

What is the output of these commands from the Pi terminal:

ls -lh /etc/pihole/pihole-FTL.db

echo ">stats" | nc localhost 4711

Note that this is not your debug log - it is the file where dnsmasq stores all the queries and replies for the day.

Your debug log is at /var/log/pihole_debug.log

pi@raspberrypi:~ $ ls -lh /etc/pihole/pihole-FTL.db
-rw-r–r-- 1 pihole pihole 863M Oct 8 05:30 /etc/pihole/pihole-FTL.db

pi@raspberrypi:~ $ echo “>stats” | nc localhost 4711
pi@raspberrypi:~ $

there was no output

And regarding the debug log, I’ve pm’d you the text of the file and thanks for clarifying where to find it.

Let’s see if we can see what’s filling up your pihole log:

head -n25 /var/log/pihole.log

tail -n25 /var/log/pihole.log.1

pi@raspberrypi:~ $ head -n25 /var/log/pihole.log
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 149.112.112.112
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 9.9.9.9
Oct 8 00:00:17 dnsmasq[4896]: query[SOA] local from 192.168.86.22
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 149.112.112.112
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 9.9.9.9
Oct 8 00:00:17 dnsmasq[4896]: query[SOA] local from 192.168.86.22
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 149.112.112.112
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 9.9.9.9
Oct 8 00:00:17 dnsmasq[4896]: query[SOA] local from 192.168.86.22
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 149.112.112.112
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 9.9.9.9
Oct 8 00:00:17 dnsmasq[4896]: query[SOA] local from 192.168.86.22
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 149.112.112.112
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 9.9.9.9
Oct 8 00:00:17 dnsmasq[4896]: query[SOA] local from 192.168.86.22
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 149.112.112.112
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 9.9.9.9
Oct 8 00:00:17 dnsmasq[4896]: query[SOA] local from 192.168.86.22
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 149.112.112.112
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 9.9.9.9
Oct 8 00:00:17 dnsmasq[4896]: query[SOA] local from 192.168.86.22
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 149.112.112.112
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 9.9.9.9
Oct 8 00:00:17 dnsmasq[4896]: query[SOA] local from 192.168.86.22
Oct 8 00:00:17 dnsmasq[4896]: forwarded local to 149.112.112.112
pi@raspberrypi:~ $

pi@raspberrypi:~ $ tail -n25 /var/log/pihole.log.1
Oct 7 23:59:56 dnsmasq[4896]: query[A] www.msftncsi.com from 192.168.86.22
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 149.112.112.112
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 9.9.9.9
Oct 7 23:59:56 dnsmasq[4896]: query[A] www.msftncsi.com from 192.168.86.22
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 149.112.112.112
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 9.9.9.9
Oct 7 23:59:56 dnsmasq[4896]: query[A] www.msftncsi.com from 192.168.86.22
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 149.112.112.112
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 9.9.9.9
Oct 7 23:59:56 dnsmasq[4896]: query[A] www.msftncsi.com from 192.168.86.22
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 149.112.112.112
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 9.9.9.9
Oct 7 23:59:56 dnsmasq[4896]: query[A] www.msftncsi.com from 192.168.86.22
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 149.112.112.112
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 9.9.9.9
Oct 7 23:59:56 dnsmasq[4896]: query[A] www.msftncsi.com from 192.168.86.22
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 149.112.112.112
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 9.9.9.9
Oct 7 23:59:56 dnsmasq[4896]: query[A] www.msftncsi.com from 192.168.86.22
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 149.112.112.112
Oct 7 23:59:56 dnsmasq[4896]: forwarded www.msftncsi.com to 9.9.9.9
Oct 7 23:59:56 dnsmasq[4896]: query[SOA] local from 192.168.86.22
Oct 7 23:59:56 dnsmasq[4896]: forwarded local to 149.112.112.112
Oct 7 23:59:56 dnsmasq[4896]: forwarded local to 9.9.9.9
Oct 8 00:00:01 dnsmasq[4896]: query[SOA] local from 192.168.86.22
pi@raspberrypi:~ $

This seems to be a recurring request. I would look at that client. Each of these requests is being forwarded to both of your upstream servers, but since local is not a valid Internet address, it’s just generating log entries.

That’s the IP address of the Raspberry Pi that has Pi hole on it, and also the IP address that I used for DNS.

I think I found the problem. After you said that the Pi hole was getting too much data, I realized that I may have manually added too many addresses to the ‘blacklist’ and ‘regex’. So I formatted, reinstalled Raspbian and reinstalled Pi-hole without the manual additions. No problems. Thanks for your insight.