nslookup problems

[Michael Warren Ogle]

We have redhat (AS 3.0) linux servers. Three of the servers will not use /etc/hosts for lookups with nslookup (or dig or host). ping resolves the names without a problem. Before anyone states that nslookup will not use the /etc/hosts file, you should know that we have over ten servers that do use nslookup for /etc/hosts entries. I have checked the host.conf, nsswitch.conf, and hosts files in /etc for differences between the working and non working servers. All of the files are the same. I checked the libresolv, libnss_dns, and libnss_files shared libraries for differences between the working (dates on libraries are 2005) and the non working (dates on the libraries are 2006).

[Ivan Ferreira · Accepted solution]

These are the files opened by ping (obtained with strace):


open("/etc/ld.so.cache", O_RDONLY) = 3
open("/lib/libresolv.so.2", O_RDONLY) = 3
open("/lib/libc.so.6", O_RDONLY) = 3
open("/etc/resolv.conf", O_RDONLY) = 4
open("/etc/nsswitch.conf", O_RDONLY) = 4
open("/etc/ld.so.cache", O_RDONLY) = 4
open("/lib/libnss_files.so.2", O_RDONLY) = 4
open("/etc/host.conf", O_RDONLY) = 4
open("/etc/hosts", O_RDONLY) = 4
open("/etc/hosts", O_RDONLY) = 4

You can see that the /etc/hosts is explicitly open.

These are the files opened with nslookup:

open("/etc/ld.so.cache", O_RDONLY) = 3
open("/usr/lib/liblwres.so.9", O_RDONLY) = 3
open("/usr/lib/libdns.so.21", O_RDONLY) = 3
open("/usr/lib/libbind9.so.0", O_RDONLY) = 3
open("/usr/lib/libisccfg.so.1", O_RDONLY) = 3
open("/usr/lib/libisc.so.11", O_RDONLY) = 3
open("/lib/libcrypto.so.6", O_RDONLY) = 3
open("/usr/lib/libisccc.so.0", O_RDONLY) = 3
open("/lib/libnsl.so.1", O_RDONLY) = 3
open("/lib/libpthread.so.0", O_RDONLY) = 3
open("/lib/libc.so.6", O_RDONLY) = 3
open("/lib/libdl.so.2", O_RDONLY) = 3
open("/usr/lib/libz.so.1", O_RDONLY) = 3
open("/etc/resolv.conf", O_RDONLY) = 5

It does not open /etc/hosts and that is why it won't work. Also dig and host commands.

[Ivan Ferreira]

You can do the same strace test to the servers that does works, there are different versions of nslookup that may be coded to use the /etc/hosts file.

strace -o strace.out nslookup yourhosts.domain

grep open strace.out

[Matti_Kurkela]

Be aware that there are at least two different implementations of "host" and "nslookup" commands available. Some Linux distributions have both available in their package collection. Which one you'll get depends on which packages you choose.

I don't have RedHat AS3's package listing available to me right now, but if there is a RPM package named something like "bind9-utils", that contains one version of those utilities. I don't recall how the package(s) for the other version(s) might be named.

You can use a command like "rpm -qf /usr/bin/nslookup" to find out which RPM package gave you this tool.

Check it out on your group of three servers, then in the other group. Odds are, you'll get a different answer... and the two answers will tell you how to get the behaviour changed to your preferred way.

[Andrew Cowan]

Are you sure that there are no syntax errors in either "hosts.conf" or "nsswitch.conf". I have seen strange behaviour from an OS when there are stray spaces or tabs between fields.

[Michael Warren Ogle]

There was a user created (we actually created, but forgot about it) a nslookup program to check the hosts file first. New program is working as designed.