Query Log Empty

[RichieB2B]

• I have read and understood the contributors guide.
• The issue I am reporting can be replicated
• The issue I'm reporting isn't a duplicate (see FAQs, closed issues, and open issues).

How familiar are you with the codebase?:
5

[BUG | ISSUE] Expected Behaviour:
I should see recent queries in the Query Log

[BUG | ISSUE] Actual Behaviour:
The Query Log view is empty, an error is shown instead:

An error occured while loading the data. Presumably your log is too large to be processed.

[BUG | ISSUE] Steps to reproduce:
Just click on the Query Log in the left menu.

(Optional) Debug token generated by pihole -d:

w9tp1fzp6a

Pihole seems up to date.

# pihole -up
::: Checking for updates...
::: Pi-hole Core:   up to date
::: Web Interface:  up to date
:::
::: Everything is up to date!

The log is 29M and does contain all the DNS queries.

# ls -lh /var/log/pihole.log 
-rw-r--r--    1 dnsmasq  root       29.6M Apr  6 18:54 /var/log/pihole.log

[DL6ER]

In your debug log, the pihole.log file is only 6MB and contains already 400,000 queries. That is simply too much for the current PHP API. You might want to read about and test our future backend FTL:

https://pi-hole.net/2017/03/28/the-pi-hole-swag-store-is-now-open/#more-9297

[DL6ER]

This has been reported extremely often here, so I close this issue as duplicate.

[RichieB2B]

I found exactly 1 similar issue #1097 on a system with low resources. I am running Pi-Hole on an E3-1230v5 with 64GB RAM that should not be able to handle processing the logs fast without any issues.

How do I increase the timeout for viewing the Query Log? Because even viewing a single client with http://pi.hole/admin/queries.php?client=192.168.1.229 shows the same errors while grep takes 0.6 seconds.

# time grep 192.168.1.229 /var/log/pihole.log > /dev/null

real    0m0.593s
user    0m0.556s
sys     0m0.036s

[DL6ER]

I found exactly 1 similar issue #1097 on a system with low resources.

Okay, so you really made me looking that up for you. Just search through the issues for something like "Query Log" and you will immediately find:

• Ajax Error After Update #375
• Error 500 on api.php?getAllQueries #465
• Query Log Ajax Error #561
• admin panel ajax error #638
• Query log broken in 2.9.4 #808
• Datatables Warning: Ajax Error [Bug] #892
• Data tables error when polling query list #1075
• Database issue #1159

and there are more. Keep in mind that this is the "core" repository, but the problem you are reporting is connected the the web frontend. Hence, you can find another dozens of issue reports there.

Furthermore, we have an FAQ here:

https://discourse.pi-hole.net/t/why-wont-the-web-interface-wont-load-datatables-warning-table-id-all-queries-ajax-error/1412

I am running Pi-Hole on an E3-1230v5 with 64GB RAM that should not be able to handle processing the logs fast without any issues.

Even on beefy hardware, it may just be PHP's soft-limits on the resources that bites you.

How do I increase the timeout for viewing the Query Log?

Have a look at your /var/log/lighttpd/error.log to idenitfy what caused the issue (run time exceeded, memory limit exceeded, etc.)

[AzureMarker]

Regarding the grep performance: dnsmasq logs actions such as the initial query and the result separately, and the result does not contain the requester's IP address. Therefore, we have to parse the whole log in order to find all the data the query log needs. The FTL backend speeds this up by parsing and storing the data as dnsmasq outputs the log, making it much quicker than the PHP backend which needs to parse it every time.

[RichieB2B]

@DL6ER thanks for looking that up, but none of those are my issue. I have no Ajax errors and the error message pops up within a second. The error.log does reveal the real issue:

PHP message: PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 76 bytes) in /var/www/html/admin/scripts/pi-hole/php/data.php on line 411

Increasing the memory_limit in php.ini fixed the issue for me. Thanks for making pi-hole and the support!

[DL6ER]

Thanks for looking that up, but none of those are my issue. I have no Ajax errors and the error message pops up within a second.

All of them are, but I have to admit that I changed the wording of the error lately, so it is just not obvious that it is in fact the same issue. And that you see it within a second only means that you have a much more powerful CPU in the box than the average user (-> Raspberry Pi).