syslog: gethostbyaddr: localhost. != 127.0.0.1

[Geoff Wild]

syslog: gethostbyaddr: localhost. != 127.0.0.1



That appeared in my syslog - twice (9 minutes apart). I can't duplicate it and it has never happened before. I've checked sendmail and dns - all is working fine. I can telnet to localhost, and to localhost 25. localhost resolves both forward and reverse. I'm speculating that it may be an application (using perhaps a Perl routine) that may have caused it. nsswitch.conf has:



hosts: dns [NOTFOUND=CONTINUE] files







resolve.conf is correct....as is the entry for localhost in /etc/hosts.







any ideas?







Thanks...Geoff

[Jeff Schussele]

Hi Geoff,

Is it possible that an application or script is changing the localhost env parm on the fly?
Wouldn't care to speculate as to why, but I guess it's possible.

Rgds,
Jeff

[Pete Randall]

I've got one idea:
resolv.conf is spelled without the e in resolve, but other than that . . . .

Pete

[Geoff Wild]

Sorry about the multiple posts - using Opera on my Unix box :(

Yes, my thoughts are that it is an application causing it too.

[Stefan Farrelly]

Weve had this exact same problem on our servers before. Heres what caused it;

1. If you do an> nslookup localhost
whats the output ? It should be either nothing (if your resolv.conf file is set to look at the dns server only) or files 127.0.0.1 (which means its found it in your hosts file because you have resolv.con configured to dns and files).

Now, our problem was that we had resolv.conf set to dns files, and when this error ocurred if I did nslookup localhost it returned;
dns
localhost xxx.yyy.zzz.www (it wasnt 127.0.0.1)!

how did this happen you ask ? did someone make an erroneous entry in your dns server ? in our case someone on the internet broadcast localhost as a valid dns name and with an ip which was NOT 127.0.0.1 It propogated to our dns servers and caused our problem. Now, this should not happen, either you should have resolv.conf set to;
files dns
(in which case it will find localhost in /etc/hosts set to 127.0.01 first) or have an entry added to your dns server called localhost with an ip of 127.0.0.0 We did both, so it cant happen again! we never did find out who on the interent broadcast the erroneous localhost set to something other than 127.0.0.1

[Geoff Wild]

Stefan,



Here's the nslookup - we have DNS then files in nsswitch.conf (and yes - the correct spelling is resolv.conf - I typed it wrong in the original post).



nslookup

Default Name Server: dns1.internal.net

Address: 156.44.162.157



> localhost

Name Server: dns1.internal.net

Address: 156.44.162.157



Trying DNS

Name: localhost.internal.net

Address: 127.0.0.1



> 127.0.0.1

Name Server: dns1.internal.net

Address: 156.44.162.157



Trying DNS

Name: localhost

Address: 127.0.0.1

[Jeff Schussele]

Hi (again) Geoff,

Well, if the hosts file on the system is correct on the localhost entry, then I'd say some script or app is doing this.
Mext time it occurs, definitely check DNS to see if it changed there & if not, start looking at what is running or just ran.

Rgds,
Jeff

[Bill Thorsteinson]

If you dns server allows
dynamic updates then if
someone sets a systems name
to localhost, and then updates
DNS, then localhost will move.

Try a reverse lookup on the
IP that localhost resolves to.

Contact your DNS admin and
suggest they verfy they have
a static address for localhost
in there domain (127.0.0.1).

[Geoff Wild]

Good answer Bill - I'm the backup DNS admin and checked that (yes, we do have dynamic updates).

Rgds...Geoff