/etc/resolv.conf file always be changed automatically

[diaoxin]

Hi experts,
The file /etc/resolv.conf in HPUX11.23 is always be changed automatically at 5:00am everyday . I fail to find which process or script does it .Who can give me any ideas about it ?or do you have any tools ?
Thank you!
BR
Diao

[vishnu.khandare]

Hi Diao,

Please check the crontab file is the any entry related to /etc/resolve.conf which updates or change that file, at particular file.
Please check the /var/adm/syslog/syslog.log for the particular time to find the reason behind this.

Hope this solves ur issue
Dont forget to assign points

Regards
Vishnu Khandare

[diaoxin]

Dear Vishnu Khandare,
I checked crontab but find nothing related to the file , and I run the command "find . -type f |xargs grep -l '150.236.34.24' " ,which try to find the files containing "150.236.34.24" ( 150.236.34.24 is the old setting that always overwrite the new setting ) . but find there is no one file in system that contains the old setting .
So I guess maybe there is some scripts will overwrite the file remotely, but I don't know how to get it .

Thank you!
DiaoXin

[vishnu.khandare]

Hi Diao,

Try to search the in syslog.
Search what are the scripts which are running on perticular 5:00AM.
Search is there any softlink by which this file is uesd at some other place.

Hope this solves ur issue.

Regards
Vishnu Khandare

[diaoxin]

Dear Vishnu Khandare,
I checked the syslog , but found nothing related to resolv.conf file .

Thanks.
BR
DiaoXin

[Viktor Balogh]

Hi,

This is a simple and ugly way to list all the crontabs on HP-UX, check which processes are running around 5am:

# cat /var/spool/cron/crontab.root /var/spool/cron/crontabs/* | grep -v -e ^# -e ^$ | sort -n

This is how to display only the commands without the time:

# for i in `cat /var/spool/cron/crontab.root /var/spool/cron/crontabs/* | awk '!/^#/ {print $6}'

Try the following oneliner, this searches between the crontabs:

# for i in `cat /var/spool/cron/crontab.root /var/spool/cron/crontabs/* | awk '!/^#/ {print $6}' | sort -u`;
do
grep resolv $i
done
#

Regards,
Viktor

[diaoxin]

Hi Viktor,
I tried the first and second commands you mentioned but show nothing .And I tried the third command it showed as below:

server:/tmp# ./dd1
cd /; egrep . etc/hosts etc/hostname* etc/resolv.conf 2>/dev/null ) \
echo "$0: Error: unable to resolve own hostname (\"$hostname\") to a fully qualified address. Please supply option --host." >&2
# resolved, withdrawn, and expired incidents


Can you give me any ideas ?
Thank you!
BR
DiaoXin

[Viktor Balogh]

Hi,

Are there any crontabs on the system at all? Post the outputs of the following:

# ll /var/spool/cron/crontab.root
# ll /var/spool/cron/crontabs/*

Regards,
Viktor

[TTr]

This could be happening from another server using ftp, remsh, rcp or scp. Not everything would be in the syslog. Check your other servers for something running at 5:00 am.

[diaoxin]

Hi Viktor,
There is no output of the 2 commands you mentioned above.

Thank you!
DiaoXin