# Report of blocked domains to be sent to you by email or download report

**URL:** <https://discourse.pi-hole.net/t/report-of-blocked-domains-to-be-sent-to-you-by-email-or-download-report/1767>\
**Category:** Feature Requests\
**Created:** [February 16, 2017, 10:38pm UTC](https://discourse.pi-hole.net/t/report-of-blocked-domains-to-be-sent-to-you-by-email-or-download-report/1767 "2017-02-16T22:38:06Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![sycnewton](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/7ea924/32.png) [@sycnewton](https://discourse.pi-hole.net/u/sycnewton)\
**Post date:** [February 16, 2017, 10:38pm UTC](https://discourse.pi-hole.net/t/report-of-blocked-domains-to-be-sent-to-you-by-email-or-download-report/1767/1 "2017-02-16T22:38:06Z")

</div>

I thought of an idea where PiHole could potentially integrate a reporting feature that will email you a scheduled report (daily, weekly, monthly, whatever) with all blocked queries or you can download the report from the PiHole admin page.

They don't have to be in a very long giant list. It could be, as example:

ipv4.microsoft.com 60 queries blocked  
ipv6.microsoft.com 100 queries blocked

Something like that. I know that some people use PiHole in a corporate environment and I feel that this could help serve IT staff in helping diagnose any potential malware issues or bad employee behavior.

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [February 17, 2017, 7:20am UTC](https://discourse.pi-hole.net/t/report-of-blocked-domains-to-be-sent-to-you-by-email-or-download-report/1767/2 "2017-02-17T07:20:42Z")

</div>

Maybe this will suit your needs.  
I've already explained [here](https://discourse.pi-hole.net/t/send-logs-before-flushing/1254/7) how to send yesterdays log (log rotation is available now, so use the instructions for pihole.log.1) to yourself.  
By processing this log with some simple grep and sed commands, you can get the detailed information, redirect the output to a different file and mail it to yourself.  
example for ipv4 wildcards (change the ip address to match your own):

```auto
grep 192.168.2.250 /var/log/pihole.log.1 | grep config | sed 's/^.*]:/]:/' | sed 's/^[^:]*://g' | sort | uniq

```

example for for ipv4 gravity list (change the ip address to match your own):

```auto
grep 192.168.2.250 /var/log/pihole.log.1 | grep gravity.list | sed 's/^.*]:/]:/' | sed 's/^[^:]*://g' | sort | uniq

```

I'm quite sure some people can come up with better grep/sed combinations, I'm not an expert.

---

<div class="post-metadata">

**Author:** ![sycnewton](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/7ea924/32.png) [@sycnewton](https://discourse.pi-hole.net/u/sycnewton)\
**Post date:** [February 17, 2017, 4:11pm UTC](https://discourse.pi-hole.net/t/report-of-blocked-domains-to-be-sent-to-you-by-email-or-download-report/1767/3 "2017-02-17T16:11:14Z")

</div>

This is incredibly useful, thank you!

I am nowhere near as advanced as you, but I could make this a cron job, right?

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [February 17, 2017, 7:32pm UTC](https://discourse.pi-hole.net/t/report-of-blocked-domains-to-be-sent-to-you-by-email-or-download-report/1767/4 "2017-02-17T19:32:37Z")

</div>

The method used to send the mail requires a script (sendlog.sh) and a cron job (/etc/cron.d/sendlog)

You could easely modify the script so that it:

- redirects the wildcard output to a file (just add **\> /home/pi/wildcard.log** )
- redirects the ipv4 gravity list output to a file (just add **\> /home/pi/exact.log** )
- now modify the send command into:

```auto
echo -e "to: <your_account_name>@gmail.com\nsubject: pihole wildcard log\n"| (cat - && uuencode /home/pi/wildcard.log wildcard.log) | /usr/sbin/ssmtp <your_account_name>@gmail.com

```

duplicate the line (still changing sendlog.sh)

```auto
echo -e "to: <your_account_name>@gmail.com\nsubject: pihole exact log\n"| (cat - && uuencode /home/pi/exact.log exact.log) | /usr/sbin/ssmtp <your_account_name>@gmail.com

```

and save the file. You'll be getting to mails.

If you only want a single mail:

```auto
grep 192.168.2.250 /var/log/pihole.log.1 | grep config | sed 's/^.*]:/]:/' | sed 's/^[^:]*://g' | sort | uniq > /home/pi/blocked.log
grep 192.168.2.250 /var/log/pihole.log.1 | grep gravity.list | sed 's/^.*]:/]:/' | sed 's/^[^:]*://g' | sort | uniq >> /home/pi/blocked.log
echo -e "to: <your_account_name>@gmail.com\nsubject: pihole exact log\n"| (cat - && uuencode /home/pi/blocked.log blocked.log) | /usr/sbin/ssmtp <your_account_name>@gmail.com

```

notice the `>>` on the second line, this means append.

Now create the crontab file as indicated, but change the time (it should be after midnight):  
The command should be:

```auto
00 05 * * * root PATH="$PATH:/home/pi" sendlog.sh

```

that will (hopefully - i haven't tested this) do the trick.

---

<div class="post-metadata">

**Author:** ![sycnewton](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/7ea924/32.png) [@sycnewton](https://discourse.pi-hole.net/u/sycnewton)\
**Post date:** [March 2, 2017, 9:29pm UTC](https://discourse.pi-hole.net/t/report-of-blocked-domains-to-be-sent-to-you-by-email-or-download-report/1767/5 "2017-03-02T21:29:42Z")

</div>

Wow thank you for all of this. My apologies in a late reply.

I will try this out tonight and will let you know how it worked out.

Cheers!

---

<div class="post-metadata">

**Author:** ![jacob.salmela](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jacob.salmela/32/8_2.png) [@jacob.salmela](https://discourse.pi-hole.net/u/jacob.salmela)\
**Post date:** [December 7, 2017, 4:32am UTC](https://discourse.pi-hole.net/t/report-of-blocked-domains-to-be-sent-to-you-by-email-or-download-report/1767/6 "2017-12-07T04:32:42Z")

</div>

This may be partially solved by the new Audit Log feature in 3.2.

[https://github.com/pi-hole/AdminLTE/pull/479](https://github.com/pi-hole/AdminLTE/pull/479)

---

<div class="post-metadata">

**Author:** ![RamSet](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/ramset/32/3497_2.png) [@RamSet](https://discourse.pi-hole.net/u/RamSet)\
**Post date:** [April 11, 2018, 11:28pm UTC](https://discourse.pi-hole.net/t/report-of-blocked-domains-to-be-sent-to-you-by-email-or-download-report/1767/7 "2018-04-11T23:28:12Z")

</div>

> [@jpgpi250](#):
>
> example for for ipv4 gravity list (change the ip address to match your own):
> 
> grep 192.168.2.250 /var/log/pihole.log.1 | grep gravity.list | sed 's/^._]:/]:/' | sed 's/\[1\]_://g' | sort | uniq
> 
> I’m quite sure some people can come up with better grep/sed combinations, I’m not an expert.

```
 grep 192.168.1.3 /var/log/pihole.log.1 | grep gravity.list | sed 's/^.*]:/]:/' | sed 's/^[^:]*://g' | sed 's/[^]* //' | sed 's/[^]* //' | sed -e 's/\/etc\/pihole\/gravity.list//g' | sed -e 's/is 192.168.1.3//g' | sed 's/\/[^/\]* / /g' | sort | uniq -c

```

Of course the IP needs to be changed to your host.

Output:

 ![image](https://discourse.pi-hole.net/uploads/default/original/2X/5/5c3e77b5ad25347f6ff47eac2d29d3cac84b02bb.png)

this should be what @sycnewton needs 🙂

* * *

1. ^:

---

<div class="post-metadata">

**Author:** ![RamSet](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/ramset/32/3497_2.png) [@RamSet](https://discourse.pi-hole.net/u/RamSet)\
**Post date:** [April 12, 2018, 6:42pm UTC](https://discourse.pi-hole.net/t/report-of-blocked-domains-to-be-sent-to-you-by-email-or-download-report/1767/8 "2018-04-12T18:42:16Z")

</div>

You can even use the bellow code to give the count for blocked hits only (no IPs)

```
grep 192.168.1.3 /var/log/pihole.log.1 | grep gravity.list | sed 's/^.*]:/]:/' | sed 's/^[^:]*://g' | sed 's/[^]* //' | sed 's/[^]* //' | sed -e 's/\/etc\/pihole\/gravity.list/ blocked hits for host/g' | sed -e 's/is 192.168.1.3//g' | sed 's/\/[^/\]* / /g' | cut --complement -d " " -f 1 | sort | uniq -c

```

Output:

 ![image](https://discourse.pi-hole.net/uploads/default/original/2X/7/746ec66f0ae68a63714e55e768a42a3b6b13cf31.png)