topic Re: nslookup problems in Operating System - Linux

nslookup problems

Michael Warren Ogle — Wed, 21 Mar 2007 15:28:00 GMT

We have redhat (AS 3.0) linux servers. Three of the servers will not use /etc/hosts for lookups with nslookup (or dig or host). ping resolves the names without a problem. Before anyone states that nslookup will not use the /etc/hosts file, you should know that we have over ten servers that do use nslookup for /etc/hosts entries. I have checked the host.conf, nsswitch.conf, and hosts files in /etc for differences between the working and non working servers. All of the files are the same. I checked the libresolv, libnss_dns, and libnss_files shared libraries for differences between the working (dates on libraries are 2005) and the non working (dates on the libraries are 2006).

Re: nslookup problems

Ivan Ferreira — Wed, 21 Mar 2007 15:41:25 GMT

These are the files opened by ping (obtained with strace):

open("/etc/ld.so.cache", O_RDONLY) = 3
open("/lib/libresolv.so.2", O_RDONLY) = 3
open("/lib/libc.so.6", O_RDONLY) = 3
open("/etc/resolv.conf", O_RDONLY) = 4
open("/etc/nsswitch.conf", O_RDONLY) = 4
open("/etc/ld.so.cache", O_RDONLY) = 4
open("/lib/libnss_files.so.2", O_RDONLY) = 4
open("/etc/host.conf", O_RDONLY) = 4
open("/etc/hosts", O_RDONLY) = 4
open("/etc/hosts", O_RDONLY) = 4

You can see that the /etc/hosts is explicitly open.

These are the files opened with nslookup:

open("/etc/ld.so.cache", O_RDONLY) = 3
open("/usr/lib/liblwres.so.9", O_RDONLY) = 3
open("/usr/lib/libdns.so.21", O_RDONLY) = 3
open("/usr/lib/libbind9.so.0", O_RDONLY) = 3
open("/usr/lib/libisccfg.so.1", O_RDONLY) = 3
open("/usr/lib/libisc.so.11", O_RDONLY) = 3
open("/lib/libcrypto.so.6", O_RDONLY) = 3
open("/usr/lib/libisccc.so.0", O_RDONLY) = 3
open("/lib/libnsl.so.1", O_RDONLY) = 3
open("/lib/libpthread.so.0", O_RDONLY) = 3
open("/lib/libc.so.6", O_RDONLY) = 3
open("/lib/libdl.so.2", O_RDONLY) = 3
open("/usr/lib/libz.so.1", O_RDONLY) = 3
open("/etc/resolv.conf", O_RDONLY) = 5

It does not open /etc/hosts and that is why it won't work. Also dig and host commands.

Re: nslookup problems

Ivan Ferreira — Wed, 21 Mar 2007 15:46:46 GMT

You can do the same strace test to the servers that does works, there are different versions of nslookup that may be coded to use the /etc/hosts file.

strace -o strace.out nslookup yourhosts.domain

grep open strace.out

Re: nslookup problems

Matti_Kurkela — Wed, 21 Mar 2007 18:03:45 GMT

Be aware that there are at least two different implementations of "host" and "nslookup" commands available. Some Linux distributions have both available in their package collection. Which one you'll get depends on which packages you choose.

I don't have RedHat AS3's package listing available to me right now, but if there is a RPM package named something like "bind9-utils", that contains one version of those utilities. I don't recall how the package(s) for the other version(s) might be named.

You can use a command like "rpm -qf /usr/bin/nslookup" to find out which RPM package gave you this tool.

Check it out on your group of three servers, then in the other group. Odds are, you'll get a different answer... and the two answers will tell you how to get the behaviour changed to your preferred way.

Re: nslookup problems

Andrew Cowan — Thu, 22 Mar 2007 04:28:30 GMT

Are you sure that there are no syntax errors in either "hosts.conf" or "nsswitch.conf". I have seen strange behaviour from an OS when there are stray spaces or tabs between fields.

Re: nslookup problems

Michael Warren Ogle — Thu, 22 Mar 2007 07:41:36 GMT

There was a user created (we actually created, but forgot about it) a nslookup program to check the hosts file first. New program is working as designed.