On Mon, Oct 23, 2017 at 11:05:03PM -0400, Roberto C. Sánchez wrote: > On Mon, Oct 23, 2017 at 07:26:38PM -0500, David Wright wrote: > > > > So if you: > > $ ls -l --full-time /etc/resolv.conf > > and then look at what happened at that precise time in /var/log/syslog > > or wherever your logs are being written. What took place? > > > Most recently the problem happened at 22:29:16.419070807. Looking in > all of my logs (not just syslog), the only thing that happened near that > time was that a host on my LAN sent a DHCPREQUEST at 22:29:07 (which the > DHCP server answered with a DHCPACK) and then at 22:29:58 Shorewall > dropped an attempt to connect to port 2433 from a host on the Internet. > > I have already changed resolv.conf back to my preferred configuration > and I will check again for correlated log entries when it is changed > again. > So, it happened again at 03:02:26 that resolv.conf was changed. I looked in the logs and found nothing that appeared to be a close correlation. There were several DHCPREQUEST/DHCPACK exchanges before and after, but my network has a near constant stream of such exchanges with no more than 3 or 4 minutes between exchanges. It seems unlikely to me that the DHCPREQUEST/DHCPACK exchange could be the cuplrit.
I am fairly out of ideas at this point. Anyone? Regards, -Roberto -- Roberto C. Sánchez
