My PiHole is being disabled

All of a sudden I notice ads coming through, and sure enough when I login to the GUI PiHole shows the “Enable” button is on.

Is there a log that will show when and how PiHole was disabled?

I’m using an iPad, and I turn on airplane mode, close Safari, turn off airplane mode and log back into PiHole and the Enable button is on again. Every time.

Sounds like someone in your household is pulling your leg :smiley:
Pressing the enable/disable button is logged in the lighttpd logs but it doesnt display origin:

 $ sudo grep disable /var/log/lighttpd/access.log
1521135569|pi.hole|GET /admin/api.php?disable=0&token=F6amELhcZJdpSmc0f2lRupvktso8MNqSbzS21wYsNP4%3D HTTP/1.1|200|32

EDIT: If want to log remote IP, alter below line in "/etc/lighttpd/lighttpd.conf":

accesslog.format = "%{%s}t|%V|%r|%s|%b"

Into:

accesslog.format = "%{%s}t|%a|%V|%r|%s|%b"

And restart lighttpd to apply:

sudo service lighttpd restart

Owh and to convert those "UNIX Epoch time" stamps (first column in the logs):

Would that show uses of the API to enable/disable?

http://example.com:1969/admin/api.php?disable=120&auth=

I have this URL in my bookmarks. I added one to enable PiHole, and then this unwanted behavior stopped. Note, I wasn’t actually opening either of these URLS, they are just in my bookmark lists.

That posting of mine grepping the lighttpd log is me actually pressing the disable button.

If want to know when/who, check the logs!

It could be your browser trying to be helpful and loading the page in the background.

That might be it. I moved some bookmarks around and then this behavior stopped.

1 Like

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.