From owner-freebsd-hackers Thu Dec 16 23:24:17 1999 Delivered-To: freebsd-hackers@freebsd.org Received: from jason.argos.org (a1-3b058.neo.rr.com [24.93.181.58]) by hub.freebsd.org (Postfix) with ESMTP id 4D0B515712; Thu, 16 Dec 1999 23:24:15 -0800 (PST) (envelope-from mike@argos.org) Received: from localhost (mike@localhost) by jason.argos.org (8.9.1/8.9.1) with ESMTP id CAA02698; Fri, 17 Dec 1999 02:23:46 -0500 Date: Fri, 17 Dec 1999 02:23:46 -0500 (EST) From: Mike Nowlin To: Jim Durham Cc: Mike Smith , freebsd hackers Subject: Re: Resolv.conf question In-Reply-To: <3859C580.A4B9FAD8@w2xo.pgh.pa.us> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG > > > Just for the sake of my curiosity, what was modifiying > > > resolv.conf? Is this a security feature? Ran into a similar "what's changing this file?" problem a while ago -- fstat(1) is your friend... #!/bin/sh while true do fstat /etc/resolv.conf >> /fstatlogfile done Throw that into your crontab to start at 1:58 AM (right before the modification takes place), and be there to kill it at 2:00 (after the modification). It's ugly, it's far from perfect, and it might not catch really fast transitions, but it's been known to work... mike To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message