This option is quick but has a few draw backs. Update /etc/dnsmasq.d/nf and have logs sent to syslog and update rsyslog to send logs to a remote server.There are three options that I identified So now I have to make a decision, is is more important to send logs to syslog or see the live tail.

Looking at the Tail pihole-FTL.log section tool, it looks like this change broke my live tail. The next logical step is to send those messages to Graylog, but before we do that, let’s check the pi-hole UI and see if we broke anything.

You will start to see syslog messages in the syslog file. $ sudo sed -i 's/log-facility=.*/log-facility=local5/' /etc/dnsmasq.d/nf

Quickly scanning through the pi-hole docs, the dnsmasq man page, and some posts other posts I decided to edit the file nf and update the log-facility to local5. There are copious amounts of documentation on both pi-hole as well as the underlying technology it relies on, specifically the use of dnsmasq. I have aspirations of sending all my log sources to Graylog to provide better visibility to events happening on my home network. In the beginning of the year I setup Graylog and wrote about the ease of installation.

This post should probably be about 10 words or less, but as I’ve learned over the years, it’s never easy. Graylog captureing dnsmasq from two pi-holes

Graylog convert mac address