Your debug log shows that 127.0.0.1
was repeatedly getting rate-limited:
-rw-r--r-- 1 pihole pihole 94K May 20 13:45 /var/log/pihole/FTL.log
-----head of FTL.log------
[2023-05-20 00:00:58.077 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:01:01.887 22331M] Rate-limiting 127.0.0.1 for at least 57 seconds
[2023-05-20 00:01:58.159 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:02:12.206 22331M] Rate-limiting 127.0.0.1 for at least 46 seconds
[2023-05-20 00:02:58.240 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:03:43.841 22331M] Rate-limiting 127.0.0.1 for at least 15 seconds
[2023-05-20 00:03:58.320 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:04:00.956 22331M] Rate-limiting 127.0.0.1 for at least 58 seconds
[2023-05-20 00:04:58.401 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:13:11.146 22331M] Rate-limiting 127.0.0.1 for at least 47 seconds
[2023-05-20 00:13:58.149 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:14:10.108 22331M] Rate-limiting 127.0.0.1 for at least 48 seconds
[2023-05-20 00:14:58.227 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:15:43.121 22331M] Rate-limiting 127.0.0.1 for at least 15 seconds
[2023-05-20 00:15:58.303 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:15:58.736 22331M] Rate-limiting 127.0.0.1 for at least 60 seconds
[2023-05-20 00:16:58.377 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:16:59.081 22331M] Rate-limiting 127.0.0.1 for at least 59 seconds
[2023-05-20 00:17:58.457 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:18:11.181 22331M] Rate-limiting 127.0.0.1 for at least 47 seconds
[2023-05-20 00:18:58.533 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:19:10.139 22331M] Rate-limiting 127.0.0.1 for at least 48 seconds
[2023-05-20 00:19:58.644 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:19:59.376 22331M] Rate-limiting 127.0.0.1 for at least 59 seconds
[2023-05-20 00:20:58.722 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:21:00.868 22331M] Resizing "FTL-dns-cache" from 8192 to (768 * 16) == 12288 (/dev/shm: 63.7MB used, 67.1MB total, FTL uses 63.7MB)
[2023-05-20 00:21:00.868 22331M] WARNING: RAM shortage (/dev/shm) ahead: 94% is used (/dev/shm: 63.7MB used, 67.1MB total, FTL uses 63.7MB)
[2023-05-20 00:21:01.074 22331M] Rate-limiting 127.0.0.1 for at least 57 seconds
[2023-05-20 00:21:58.802 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:22:36.346 22331M] Rate-limiting 127.0.0.1 for at least 22 seconds
[2023-05-20 00:22:58.883 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:22:59.533 22331M] Rate-limiting 127.0.0.1 for at least 59 seconds
[2023-05-20 00:23:58.965 22331/T22368] Ending rate-limitation of 127.0.0.1
[2023-05-20 00:24:00.957 22331M] Rate-limiting 127.0.0.1 for at least 58 seconds
[2023-05-20 00:24:58.038 22331/T22368] Ending rate-limitation of 127.0.0.1
127.0.0.1
is the localhost address.
As you are running Pi-hole in Docker, that means that the Docker conatiner itself is generating an excessive amount of DNS requests.
Some of those are also documented in excerpts from /var/log/pihole/pihole.log
:
-rw-r--r-- 1 pihole pihole 260M May 20 13:46 /var/log/pihole/pihole.log
-----head of pihole.log------
May 20 00:00:07 dnsmasq[22331]: query[SOA] 1.0.17.172.in-addr.arpa from 172.17.0.1
May 20 00:00:07 dnsmasq[22331]: forwarded 1.0.17.172.in-addr.arpa to 1.1.1.1
May 20 00:00:07 dnsmasq[22331]: reply 1.0.17.172.in-addr.arpa is NXDOMAIN
May 20 00:00:07 dnsmasq[22331]: query[ANY] 1.0.17.172.in-addr.arpa from 172.17.0.1
May 20 00:00:07 dnsmasq[22331]: config 172.17.0.1 is NXDOMAIN
May 20 00:00:09 dnsmasq[22331]: query[A] 1.0.17.172.in-addr.arpa from 172.17.0.1
May 20 00:00:09 dnsmasq[22331]: forwarded 1.0.17.172.in-addr.arpa to 127.17.0.1
May 20 00:00:09 dnsmasq[22331]: forwarded 1.0.17.172.in-addr.arpa to 1.1.1.1
May 20 00:00:09 dnsmasq[22331]: query[A] 1.0.17.172.in-addr.arpa from 127.0.0.1
May 20 00:00:09 dnsmasq[22331]: config error is REFUSED (EDE: blocked)
May 20 00:00:09 dnsmasq[22331]: Rate-limiting 1.0.17.172.in-addr.arpa is REFUSED (EDE: blocked)
Quite likely, those excessive requests also exhaust Pi-hole's shared memory:
*** [ DIAGNOSING ]: Pi-hole diagnosis messages
count last timestamp type message blob1 blob2 blob3 blob4 blob5
------ ------------------- -------------------- ------------------------------------------------------------ -------------------- -------------------- -------------------- -------------------- --------------------
1 2023-05-19 21:19:58 ADLIST https://raw.githubusercontent.com/StevenBlack/hosts/master/h 1
osts
1 2023-05-20 13:45:09 RATE_LIMIT 127.0.0.1 1000 60
1 2023-05-20 10:02:28 SHMEM /dev/shm 95 /dev/shm: 64.4MB used, 67.1MB total, FTL uses 64.4MB
I have no idea what could be causing this.
Do you run any other containers on the same Docker network as your Pi-hole?