Log analysis for problem solving

Key Log Files and Their Purpose

Primary Log Locations

• /var/log/pihole.log: Main DNS query tracking and resolution
• /var/log/pihole-FTL.log: FTL service status and operational issues
• /var/log/lighttpd/error.log: Web interface error tracking
• /var/log/syslog: System-level events and crashes

Essential Log Analysis Methods

DNS Query Investigation

Monitor and analyse DNS queries using these commands:

# View all DNS queries
cat /var/log/pihole.log | grep QUERY

# Check blocked domain access attempts
cat /var/log/pihole.log | grep "gravity blocked"

# Monitor real-time DNS activity
pihole -t

FTL Service Diagnostics

Investigate FTL service issues:

# Check for service errors
cat /var/log/pihole-FTL.log | grep "ERROR"

# Investigate database issues
cat /var/log/pihole-FTL.log | grep "database"

Web Interface Problem Resolution

Monitor web server issues:

# Check access denied errors
cat /var/log/lighttpd/error.log | grep "403"

# Investigate server errors
cat /var/log/lighttpd/error.log | grep "500"

System Status Analysis

Track system-level events:

# Monitor system shutdowns
cat /var/log/syslog | grep "shutdown"

Advanced Log Analysis Techniques

Domain Analysis

# Find most frequently blocked domains
grep "gravity blocked" /var/log/pihole.log | awk '{print $6}' | sort | uniq -c | sort -nr | head -10

# Monitor specific device activity
grep "<device_IP>" /var/log/pihole.log

# Analyse query frequency by domain
grep QUERY /var/log/pihole.log | awk '{print $6}' | sort | uniq -c | sort -nr | head -10

Common Troubleshooting Scenarios

DNS Resolution Issues

Check for resolution failures:

cat /var/log/pihole.log | grep "reply"

Performance Problems

• Review query patterns for excessive requests
• Monitor for query loops and repeated domain requests
• Check system resource usage

Web Interface Access Issues

• Review lighttpd error logs for startup problems
• Check FTL database initialisation in pihole-FTL.log

Service Stability

Monitor for service interruptions in pihole-FTL.log and syslog

Automated Monitoring

Scheduled Log Analysis

Set up automated monitoring:

# Add to crontab for hourly error checking
0 * * * * grep "ERROR" /var/log/pihole-FTL.log >> /home/pi/pihole_errors.log

Advanced Visualisation

Consider implementing monitoring solutions:

• Grafana for visual data representation
• InfluxDB for time-series log analysis
• Custom dashboards for specific metrics

Regular log analysis helps maintain optimal Pi-hole performance and quickly identify potential issues before they impact service availability.