From owner-freebsd-questions@freebsd.org Fri Dec 28 16:56:01 2018 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 31CE41419BDF for ; Fri, 28 Dec 2018 16:56:01 +0000 (UTC) (envelope-from byrnejb@harte-lyne.ca) Received: from mx32.harte-lyne.ca (mx32.harte-lyne.ca [216.185.71.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mx32.harte-lyne.ca", Issuer "CA_HLL_ISSUER_2016" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 633039187F for ; Fri, 28 Dec 2018 16:56:00 +0000 (UTC) (envelope-from byrnejb@harte-lyne.ca) Received: from mx32.harte-lyne.ca (unknown [127.0.32.1]) by mx32.harte-lyne.ca (Postfix) with ESMTP id C9ACE18BBE for ; Fri, 28 Dec 2018 11:55:59 -0500 (EST) X-Virus-Scanned: amavisd-new at harte-lyne.ca Received: from mx32.harte-lyne.ca ([127.0.32.1]) by mx32.harte-lyne.ca (mx32.harte-lyne.ca [127.0.32.1]) (amavisd-new, port 10024) with ESMTP id ZC56n3HbvPOH for ; Fri, 28 Dec 2018 11:55:57 -0500 (EST) Received: from webmail.harte-lyne.ca (mx32.harte-lyne.ca [216.185.71.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx32.harte-lyne.ca (Postfix) with ESMTPSA id 4D59818BB3 for ; Fri, 28 Dec 2018 11:55:57 -0500 (EST) Received: from 216.185.71.44 (SquirrelMail authenticated user byrnejb_hll) by webmail.harte-lyne.ca with HTTP; Fri, 28 Dec 2018 11:55:57 -0500 Message-ID: <0e5fda84f78303a95dc5bd177a45bb7e.squirrel@webmail.harte-lyne.ca> In-Reply-To: <20181228103934.1e3dd752@yandex.com> References: <961dc39c14de8d519801ca9fe3b2cdd9.squirrel@webmail.harte-lyne.ca> <20181228103934.1e3dd752@yandex.com> Date: Fri, 28 Dec 2018 11:55:57 -0500 Subject: Re: /etc/resolv.conf overwritten by what? From: "James B. Byrne" To: freebsd-questions@freebsd.org Reply-To: byrnejb@harte-lyne.ca User-Agent: SquirrelMail/1.4.23 [SVN] MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Rspamd-Queue-Id: 633039187F X-Spamd-Bar: ------- X-Spamd-Result: default: False [-7.48 / 15.00]; RCVD_VIA_SMTP_AUTH(0.00)[]; HAS_REPLYTO(0.00)[byrnejb@harte-lyne.ca]; RBL_COMPOSITE_RCVD_IN_DNSWL_MED_DWL_DNSWL_LOW(0.00)[]; R_SPF_ALLOW(-0.20)[+ip4:216.185.71.0/26]; TO_DN_NONE(0.00)[]; RCVD_DKIM_ARC_DNSWL_MED(-0.50)[]; REPLYTO_ADDR_EQ_FROM(0.00)[]; DKIM_TRACE(0.00)[harte-lyne.ca:+]; MX_GOOD(-0.01)[cached: mx32.harte-lyne.ca]; HAS_X_PRIO_THREE(0.00)[3]; RCVD_IN_DNSWL_MED(-0.20)[32.71.185.216.list.dnswl.org : 127.0.4.2]; DMARC_POLICY_ALLOW(-0.50)[harte-lyne.ca,quarantine]; NEURAL_HAM_SHORT(-0.99)[-0.985,0]; FROM_EQ_ENVFROM(0.00)[]; SUBJECT_ENDS_QUESTION(1.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:12021, ipnet:216.185.64.0/20, country:CA]; RCVD_TLS_LAST(0.00)[]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; R_DKIM_ALLOW(-0.20)[harte-lyne.ca:s=dkim_hll]; RCVD_COUNT_FIVE(0.00)[5]; FROM_HAS_DN(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; MIME_GOOD(-0.10)[text/plain]; PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org]; RCPT_COUNT_ONE(0.00)[1]; DWL_DNSWL_LOW(0.00)[harte-lyne.ca.dwl.dnswl.org : 127.0.4.1]; IP_SCORE(-3.78)[ip: (-9.91), ipnet: 216.185.64.0/20(-4.95), asn: 12021(-3.96), country: CA(-0.09)] X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Dec 2018 16:56:01 -0000 On Fri, December 28, 2018 10:33, Ruben wrote: > Hi, > > Did you look in the other crontab places > > - /etc/crontab > - /etc/crontab.d/* > - /var/cron/tabs/ (for the non-root users but perhaps with sudo > breakouts) > > There should be a lot of default cronjobs running from /etc/crontab at > least. Perhaps a recently installed piece of software placed an > additional job in one of those locations? > # ll /var/cron/tabs /etc/crontab /etc/cron.d /usr/local/etc/cron.d ls: /usr/local/etc/cron.d: No such file or directory -rw-r--r-- 1 root wheel 730 Oct 24 12:42 /etc/crontab /etc/cron.d: total 0 /var/cron/tabs: total 0 # cat /etc/crontab # /etc/crontab - root's crontab for FreeBSD # # $FreeBSD: releng/11.2/etc/crontab 194170 2009-06-14 06:37:19Z brian $ # SHELL=/bin/sh PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin # #minute hour mday month wday who command # */5 * * * * root /usr/libexec/atrun # # Save some entropy so that /dev/random can re-seed on boot. */11 * * * * operator /usr/libexec/save-entropy # # Rotate log files every hour, if necessary. 0 * * * * root newsyslog # # Perform daily/weekly/monthly maintenance. 1 3 * * * root periodic daily 15 4 * * 6 root periodic weekly 30 5 1 * * root periodic monthly # # Adjust the time zone if the CMOS clock keeps local time, as opposed to # UTC time. See adjkerntz(8) for details. 1,31 0-5 * * * root adjkerntz -a #EOF The only custom pkg periodic script is /usr/local/etc/periodic/daily/111.clean-squirrelmail and that is disabled. On Fri, December 28, 2018 10:39, starikarp@yandex.com wrote: > > I have in /etc/ file dhclient-enter-hooks which has: > add_new_resolv_conf() { > # We don't want /etc/resolv.conf changed > # So this is an empty function > return 0 > } > > and I do not have problems. > dhcp is not enabled on this host. All addresses are static. This happened at precisely 09:12:51 which does not seem to me to be a 'cron'ish time. # stat resolv.conf* 2838222034 189421 -rw-r--r-- 1 root wheel 4294967295 46 "Jul 11 12:05:07 2018" "Dec 28 09:12:51 2018" "Dec 28 09:35:54 2018" "Jul 11 12:05:07 2018" 4096 1 0x800 resolv.conf_empty_problem I am baffled by this and there seems to have been no other activity on that host at that time. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3