Re: Why does resolv.conf keep changing?

[Roberto C. Sánchez <roberto@debian.org>]

On Mon, Oct 23, 2017 at 11:05:03PM -0400, Roberto C. Sánchez wrote:
> On Mon, Oct 23, 2017 at 07:26:38PM -0500, David Wright wrote:
> > 
> > So if you:
> > $ ls -l --full-time /etc/resolv.conf
> > and then look at what happened at that precise time in /var/log/syslog
> > or wherever your logs are being written. What took place?
> > 
> Most recently the problem happened at 22:29:16.419070807.  Looking in
> all of my logs (not just syslog), the only thing that happened near that
> time was that a host on my LAN sent a DHCPREQUEST at 22:29:07 (which the
> DHCP server answered with a DHCPACK) and then at 22:29:58 Shorewall
> dropped an attempt to connect to port 2433 from a host on the Internet.
> 
> I have already changed resolv.conf back to my preferred configuration
> and I will check again for correlated log entries when it is changed
> again.
> 
So, it happened again at 03:02:26 that resolv.conf was changed.  I
looked in the logs and found nothing that appeared to be a close
correlation.  There were several DHCPREQUEST/DHCPACK exchanges before
and after, but my network has a near constant stream of such exchanges
with no more than 3 or 4 minutes between exchanges.  It seems unlikely
to me that the DHCPREQUEST/DHCPACK exchange could be the cuplrit.

I am fairly out of ideas at this point.  Anyone?

Regards,

-Roberto

-- 
Roberto C. Sánchez