Top blocked domain not showing who was blocked

Not sure what happened but under Top blocked domain and clicking on the domain, I can see a large number of hits but nothing shows up at to what device is being blocked.

I am getting no data available.

Any way to fix this? I don't even know what I need to search for if others are/had this same issue.

image

Please run from command line

sqlite3 /etc/pihole/pihole-FTL.db --header --column "Select * from queries where domain is 'g.msn.com' limit 100;"

Well, in your screenshot, it would seem you've redacted the very part that would have shown which client IP / hostname submitted that query.

Bucking_Horn: I am not sure I understand, there wasn't anything showing so I didn't put a screen shot in. Did you want that screen shot that showed "no data available"? I didn't think that was showing anything of value so I didn't include that screen shot.

yubiuser: Thank you, that shows what should be showing.

Apologies, I indeed misinterpreted your screenshot, as it omits all context information, and it doesn't demonstrate your problem.
Maybe a screenshot of the actual Query Log (presumably showing "no data available" somewhere) would have made your issue clearer.

Does that mean the database shows relevant client information where the UI doesn't?

Correct:

Wow, the restrictions for new users is rather harsh.

sqlite3 /etc/pihole/pihole-FTL.db --header --column "Select * from queries where domain is 'g.msn.com' limit 100;"
id timestamp type status domain client forward additional_info


18333378 1571629232 1 1 g.msn.com 192.168.1.242
18341526 1571632820 1 1 g.msn.com 192.168.1.242

There are 3-4 more lines that I cannot include but they are the same.

(You may avoid hostnames being auto-converted to links by applying the </> Preformatted text menu option to them, and that would also allow you to avoid the max link limit) :wink:

Those queries sport rather old timestamps, e.g. 1571629232 decodes to 21 Oct 2019.
Did you adjust time information only recently?

EDIT:
Note that the dashboard only shows the data for the last 24 hours. Also, if your browser's time differs from your Pi-hole machine's time, that may produce unexpected results.

You should check your time settings on your Pi-hole machine:

timedatectl

Ah I might not have let that query run long enough. It just seems to be stuck after 6 lines. Well anyways the issue is still present, after I rebooted the pi, I now have 383 hits and click into that section shows no data available in table.

I have g.live.com also being listed, I click on that and I can see entries.

Is there a way to change that 24 hour value? As soon as I saw it show up in the dashboard, I clicked on it but didn't show me anything.

No, it's fixed.

Did you check your Pi-hole machine's time yet?

Here is the last few lines from that query, I let it sit for a while.

61854980    1596257250  1           1           g.msn.com   192.168.1.240
61883763    1596264388  1           1           g.msn.com   192.168.1.240
61883867    1596264420  1           1           g.msn.com   192.168.1.240

Yes I checked, its showing the right time for my region.

Use the following SQL query to list the most recent access by client:

sqlite3 /etc/pihole/pihole-FTL.db --header --column \
"SELECT max(timestamp), client, count(client) FROM queries \
WHERE domain is 'g.msn.com' GROUP BY client ORDER BY 1 DESC;"
1596264420      192.168.1.240  300
1595986394      192.168.1.190  83
1595976818      192.168.1.158  13
1571711525      192.168.1.242  6

Uptime shows 1 day, so I know its either 24 hours or less.

The most current date from that result is still August 1st 2020.
You should be able to retrieve it under Long-term data.

So the Query Log wouldn't show any entries, but then the dashboard also shouldn't show it under top domains.

Are you positive it's written in the exact same way?

Let's see if we can grep it from the recent logs:

grep -ni "g.msn.com" /var/log/pihole.log*
/var/log/pihole.log.1:621198:Oct  9 20:22:34 dnsmasq[951]: reply g.msn.com is blocked during CNAME inspection

Ah, it wasn't blocked directly, but rather as a CNAME.
(That would mean the domain that was blocked tried to hide the fact that it would indeed be g.msn.com by using CNAME cloaking)

But that is just one hit, or did you limit your output to show just one entry?

I just limited it, this list is very large.

The link from top lists to query log is "broken" for domains that have been blocked by CNAME inspection. This will be fixed in the next version of pihole.

https://github.com/pi-hole/FTL/issues/833

https://github.com/pi-hole/FTL/pull/878

https://github.com/pi-hole/FTL/pull/832

1 Like