RHEL servers with no access to Internet constantly polling DNS for xmlrpc.rhn.redhat.com

Question

We have several servers, all RHEL6 (x86_64), that are constantly querying our DNS server for xmlrpc.rhn.redhat.com. We have nscd installed and configured on each of those servers and hosts caching is enabled, but doesn't seem to apply to this. Even adding the entry in the hosts file of the servers doesn't stop the DNS queries. Those servers are in a VLAN that doesn't have Internet access, and we are not using a RHN Satellite either.

I thought it was because of the services rhnsd and rhsmcertd, but the queries continue even if they are stopped and disabled.

Would anyone have an idea where this query is coming from and why it's not observing the local hosts caching in place?

yum-updatesd is not installed. That said, it seems to have stopped when rebooted the server. Still testing a few things to make sure. — Yanick Girouard, Jul 16 '14 at 16:47
could be 'cause you `chkconfig` service without actually stopping it and now it's not appearing as it didn't start after reboot. — alexus, Jul 16 '14 at 17:01
no I stopped it, and confirmed it was stopped, then did same with chkconfig. It was stopped and nothing was running either, checked with ps -ef... — Yanick Girouard, Jul 16 '14 at 18:04

alexus · Answer 1 · 2014-07-16T17:00:10.813

2

I'd try checking for following:

# chkconfig --list | grep :on | grep rh
rhnsd           0:off   1:off   2:on    3:on    4:on    5:on    6:off
rhsmcertd       0:off   1:off   2:off   3:on    4:on    5:on    6:off
#

Check to see if it's REALLY stopped & disabled, also try to check crons, possibly to correlate it with job.

You could also try: lsof -i UDP:domain.

edited Jul 16 '14 at 17:00

answered Jul 16 '14 at 16:32

alexus

12,342
27
115
173

It was really stopped and disabled, but somehow it was still sending dns queries. Could they have been queued somehow? – Yanick Girouard Jul 16 '14 at 16:43
Your lsof arguments are better than mine. Salute. – dmourati Jul 16 '14 at 17:30

score 1 · Answer 2 · edited Jul 16 '14 at 17:04

1

Try something like this.

while true; do echo "COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME" ; sudo lsof -i -P -n | grep ":53"; done

This should reveal the PID of the command(s) issuing outbound port 53 requests.

edited Jul 16 '14 at 17:04

alexus

12,342
27
115
173

answered Jul 16 '14 at 16:40

dmourati

24,720
2
40
69

score 0 · Accepted Answer · answered Jul 16 '14 at 18:16

Turns out the rhnsd service simply kept retrying to connect to RHN because it couldn't connect. When the service was stopped, there was several DNS queries that were "queued" up, and they kept on going for a few more minutes after the service was stopped, which is why it seemed like it didn't have any effect. I waited 1 hour after the service was stopped and after a while the queries stopped completely and didn't come back.

So bottom line, all I had to do was to stop and disable the rhnsd and rhsmcertd services and wait a few minutes.

RHEL servers with no access to Internet constantly polling DNS for xmlrpc.rhn.redhat.com

3 Answers3