Skip to main content

📋 Logs

What you can do on this screen​

The Logs screen is where you inspect individual DNS queries handled by Pi-hole. You mainly use it to:

  • Find a specific query by domain, time, or client
  • Confirm whether a request was allowed or blocked
  • Add a domain to the Whitelist or Blacklist directly from a log entry

This screen is your primary tool when troubleshooting broken apps, websites, or unexpected blocking behavior.

Start by narrowing down what you are looking for​

Logs can grow quickly, so the first step is usually to reduce the list.

At the top of the screen, you have controls for search, filtering, sorting, and live updates. These tools work together, but not all of them should be used at the same time.

Monitor activity in real time​

Live mode lets you watch DNS queries as they happen. Use it when reproducing an issue and confirming which domains are queried in real time.

Logs live on stateLogs live off stateLogs live disabled state

Left: Live mode ON Live updates are active. A ● LIVE label appears under the screen title, clearly indicating that new log entries are being added automatically. The icon on the right changes to a pause symbol. Tap it to pause live updates.

Center: Live mode OFF (paused) Live updates are currently stopped. The icon on the right changes to a resume-style symbol. Tap it to resume live updates and return to real-time monitoring. By default, Live Log is enabled, but live updates start paused until you tap resume.

Right: Live mode disabled Live mode is currently disabled by app settings. This is a manual choice in App Settings.

When disabled, the icon on the right changes to a manual refresh button. Tap this button to fetch the latest logs once, without enabling continuous live updates.

You can re-enable Live mode from: Settings → App Settings → Advanced Settings → Live Log

After enabling it there, return to Logs to use real-time monitoring.

warning

Live mode is best used without filters while actively troubleshooting. Turn it off before applying filters or reviewing past log entries, as live updates can interfere with stable, filtered results.

Search for a domain or keyword​

Tap the search icon to open the search field. As soon as you start typing, the log list narrows down to matching entries.

Logs search

Use search when you know part of a domain name. Exit search using the back arrow if you want to return to the full list.

Avoid searching while the server is disconnected, as results may be incomplete.

Filter logs by time, status, or client​

Tap the filter icon to open the filter sheet. This is the most powerful way to focus on a specific situation.

Logs filter overview

Inside the filter sheet, you can refine the log list step by step.

Limit the time range​

Use the From and To fields to select a time window.

Logs filter date range

Choose a short range when investigating a recent issue. Very broad ranges can make it harder to spot relevant entries.

Filter by query status​

Select one or more statuses, such as Blocked or Allowed.

Logs filter status

Use Blocked when checking why something failed to load. Limit the number of selected statuses to keep results readable.

Focus on a specific client​

Select a client to show queries from a single device.

Logs filter clients

This is useful when one device behaves differently from the rest of the network. Skip client filtering if you want a complete network view.

Change the log order​

Tap the sort icon to switch between Latest first and Oldest first.

Logs sort options

Use Latest first when monitoring ongoing activity. Switch to Oldest first when reviewing past events in order.

The list order updates immediately when you change the sort option.

Inspect a log entry and take action​

Once you find a relevant entry, tap it to open the detail view.

Each detail view shows the domain, client, time, and status of the query, along with actions you can take.

Whitelist a domain​

Use Whitelist when a legitimate site or app is broken by blocking. This adds the domain to Pi-hole’s whitelist (allowlist), and future queries will be permitted.

Log detail deny action

Blacklist a domain​

Use Blacklist when you are confident the domain is unwanted.

Log detail allow action

Blocking adds the domain to Pi-hole’s blacklist (denylist). Future queries will be blocked according to this rule.

Typical ways to use Logs​

  • A website does not load: Open Logs, filter by Blocked, find the domain, and whitelist it if appropriate.

  • One device behaves strangely: Filter by client and inspect recent queries from that device.

  • Real-time troubleshooting: Enable live mode, reproduce the issue, and watch queries appear as they happen.

Important notes and limits​

  • Logs can be limited or anonymized by Pi-hole privacy settings.
  • Heavy filtering may take time on large datasets.
  • Whitelist and blacklist actions affect only the currently selected server.

Pi-hole concepts used on this screen​

Each log entry represents a DNS query processed by Pi-hole. The status indicates whether the query was allowed or blocked. Whitelisting or blacklisting a domain updates Pi-hole’s lists and affects future queries immediately.