My PiHole is being disabled


#1

All of a sudden I notice ads coming through, and sure enough when I login to the GUI PiHole shows the “Enable” button is on.

Is there a log that will show when and how PiHole was disabled?

I’m using an iPad, and I turn on airplane mode, close Safari, turn off airplane mode and log back into PiHole and the Enable button is on again. Every time.


#2

Sounds like someone in your household is pulling your leg :smiley:
Pressing the enable/disable button is logged in the lighttpd logs but it doesnt display origin:

 $ sudo grep disable /var/log/lighttpd/access.log
1521135569|pi.hole|GET /admin/api.php?disable=0&token=F6amELhcZJdpSmc0f2lRupvktso8MNqSbzS21wYsNP4%3D HTTP/1.1|200|32

EDIT: If want to log remote IP, alter below line in “/etc/lighttpd/lighttpd.conf”:

accesslog.format = "%{%s}t|%V|%r|%s|%b"

Into:

accesslog.format = "%{%s}t|%a|%V|%r|%s|%b"

And restart lighttpd to apply:

sudo service lighttpd restart

Owh and to convert those “UNIX Epoch time” stamps (first column in the logs):

https://www.unixtimestamp.com/index.php


#3

Would that show uses of the API to enable/disable?

http://example.com:1969/admin/api.php?disable=120&auth=

I have this URL in my bookmarks. I added one to enable PiHole, and then this unwanted behavior stopped. Note, I wasn’t actually opening either of these URLS, they are just in my bookmark lists.


#4

That posting of mine grepping the lighttpd log is me actually pressing the disable button.

If want to know when/who, check the logs!


#5

It could be your browser trying to be helpful and loading the page in the background.


#6

That might be it. I moved some bookmarks around and then this behavior stopped.