resolv.conf overwritten instantly

Question

In Scientific Linux 5.5, /etc/resolv.conf is continually overwritten and so DNS is broken. If I delete or change it, it instantly reverts to its former state. Writing over it with: cp /etc/NEWresolve.conf /etc/resolv.conf && chattr +i /etc/resolv.conf just results in an immutable copy of the original resolv.conf with no changes. I'm running as root (not sudo) and Avahi and NetworkManager are not running.

Any ideas? There's no DHCP anywhere on this machine, and even if there were, I can't imagine it'd overwrite the file so quickly.

Thanks

Some ancillary info: uname -a Linux localhost.localdomain 2.6.18-238.12.1.el5 #1 SMP Tue May 31 13:12:32 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux Intel I340 (82580) NIC

If you are at the console, try rebooting into single user mode and editing the file. If you still have the same problem, I suspect there may be a kernel module on your server that is doint this. — Corey Henderson, Jul 10 '11 at 02:18
Single user mode worked. I made it immutable and the file remains untouched after reboot. Thanks a lot! Just for curiosity is there something specific you had in mind when you suggested that? — , Jul 10 '11 at 02:51
Check for a configuration management tool running like puppet, chef, or cfengine. — Shane Madden, Jul 10 '11 at 03:50
A kernel module that modifies resolv.conf? Incredibly unlikely. — womble, Jul 10 '11 at 05:19
I was thinking inotify, but was on my mobile at the time and couldn't think of the right word :) — Corey Henderson, Jul 10 '11 at 17:40
I had the same problem with NetworkManager(NetworkMangler) rewriting it with crap from /etc/resolve.conf.d I ended up doing the chattr +i trick too. — Tom O'Connor, Jul 13 '11 at 09:44

score 2 · Answer 1 · answered Jul 14 '11 at 15:44

NetworkManager is a likely culprit. NetworkManager will overwrite /etc/resolv.conf, and could explain the behavior you are seeing. However, I think NetworkManager typically adds a warning to the file like # Managed by NetworkManager, do not edit.

From the GUI, you can configure NetworkManager to not overwrite /etc/resolve.conf .

NetworkManager is considered harmful on many systems (Servers, virtualization hosts) because it overwrites your manual settings without warning you, and it doesn't support advanced networking features. You might want to to just shut down the service and prevent it from starting at next reboot.

If you really need NM you can mark interfaces as NM_CONTROLLED=no in their respective /etc/sysconfig/network-scripts/ifcfg-* files. You can also set the nameservers there. — AndreasM, Jul 15 '11 at 20:00

score 0 · Answer 2 · answered Jul 14 '11 at 15:26

0

find /etc -inum `ls -i /etc/resolv.conf | awk '{print $1}'`

and see how modifies the other files

answered Jul 14 '11 at 15:26

Adrian Sevcenco

66
6

resolv.conf overwritten *instantly*

2 Answers2

resolv.conf overwritten instantly