System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

/etc/resolv.conf file always be changed automatically

 
Frequent Advisor

/etc/resolv.conf file always be changed automatically

Hi experts,
The file /etc/resolv.conf in HPUX11.23 is always be changed automatically at 5:00am everyday . I fail to find which process or script does it .Who can give me any ideas about it ?or do you have any tools ?
Thank you!
BR
Diao
76 REPLIES 76
Respected Contributor

Re: /etc/resolv.conf file always be changed automatically

Hi Diao,

Please check the crontab file is the any entry related to /etc/resolve.conf which updates or change that file, at particular file.
Please check the /var/adm/syslog/syslog.log for the particular time to find the reason behind this.

Hope this solves ur issue
Dont forget to assign points

Regards
Vishnu Khandare
You should deserve before U desire!!!!
Frequent Advisor

Re: /etc/resolv.conf file always be changed automatically

Dear Vishnu Khandare,
I checked crontab but find nothing related to the file , and I run the command "find . -type f |xargs grep -l '150.236.34.24' " ,which try to find the files containing "150.236.34.24" ( 150.236.34.24 is the old setting that always overwrite the new setting ) . but find there is no one file in system that contains the old setting .
So I guess maybe there is some scripts will overwrite the file remotely, but I don't know how to get it .

Thank you!
DiaoXin
Respected Contributor

Re: /etc/resolv.conf file always be changed automatically

Hi Diao,

Try to search the in syslog.
Search what are the scripts which are running on perticular 5:00AM.
Search is there any softlink by which this file is uesd at some other place.

Hope this solves ur issue.

Regards
Vishnu Khandare
You should deserve before U desire!!!!
Frequent Advisor

Re: /etc/resolv.conf file always be changed automatically

Dear Vishnu Khandare,
I checked the syslog , but found nothing related to resolv.conf file .

Thanks.
BR
DiaoXin
Honored Contributor

Re: /etc/resolv.conf file always be changed automatically

Hi,

This is a simple and ugly way to list all the crontabs on HP-UX, check which processes are running around 5am:

# cat /var/spool/cron/crontab.root /var/spool/cron/crontabs/* | grep -v -e ^# -e ^$ | sort -n

This is how to display only the commands without the time:

# for i in `cat /var/spool/cron/crontab.root /var/spool/cron/crontabs/* | awk '!/^#/ {print $6}'

Try the following oneliner, this searches between the crontabs:

# for i in `cat /var/spool/cron/crontab.root /var/spool/cron/crontabs/* | awk '!/^#/ {print $6}' | sort -u`;
do
grep resolv $i
done
#

Regards,
Viktor


****
Unix operates with beer.
Frequent Advisor

Re: /etc/resolv.conf file always be changed automatically

Hi Viktor,
I tried the first and second commands you mentioned but show nothing .And I tried the third command it showed as below:

server:/tmp# ./dd1
cd /; egrep . etc/hosts etc/hostname* etc/resolv.conf 2>/dev/null ) \
echo "$0: Error: unable to resolve own hostname (\"$hostname\") to a fully qualified address. Please supply option --host." >&2
# resolved, withdrawn, and expired incidents


Can you give me any ideas ?
Thank you!
BR
DiaoXin
Honored Contributor

Re: /etc/resolv.conf file always be changed automatically

Hi,

Are there any crontabs on the system at all? Post the outputs of the following:

# ll /var/spool/cron/crontab.root
# ll /var/spool/cron/crontabs/*

Regards,
Viktor
****
Unix operates with beer.
Honored Contributor

Re: /etc/resolv.conf file always be changed automatically

This could be happening from another server using ftp, remsh, rcp or scp. Not everything would be in the syslog. Check your other servers for something running at 5:00 am.
Frequent Advisor

Re: /etc/resolv.conf file always be changed automatically

Hi Viktor,
There is no output of the 2 commands you mentioned above.

Thank you!
DiaoXin