Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have several servers, all RHEL6 (x86_64), that are constantly querying our DNS server for xmlrpc.rhn.redhat.com. We have nscd installed and configured on each of those servers and hosts caching is enabled, but doesn't seem to apply to this. Even adding the entry in the hosts file of the servers doesn't stop the DNS queries. Those servers are in a VLAN that doesn't have Internet access, and we are not using a RHN Satellite either.

I thought it was because of the services rhnsd and rhsmcertd, but the queries continue even if they are stopped and disabled.

Would anyone have an idea where this query is coming from and why it's not observing the local hosts caching in place?

share|improve this question
    
Is yum-updatesd running with yum-rhn-plugin? –  Aaron Copley Jul 16 at 16:21
    
yum-updatesd is not installed. That said, it seems to have stopped when rebooted the server. Still testing a few things to make sure. –  Yanick Girouard Jul 16 at 16:47
    
could be 'cause you chkconfig service without actually stopping it and now it's not appearing as it didn't start after reboot. –  alexus Jul 16 at 17:01
    
no I stopped it, and confirmed it was stopped, then did same with chkconfig. It was stopped and nothing was running either, checked with ps -ef... –  Yanick Girouard Jul 16 at 18:04

3 Answers 3

I'd try checking for following:

# chkconfig --list | grep :on | grep rh
rhnsd           0:off   1:off   2:on    3:on    4:on    5:on    6:off
rhsmcertd       0:off   1:off   2:off   3:on    4:on    5:on    6:off
# 

Check to see if it's REALLY stopped & disabled, also try to check crons, possibly to correlate it with job.

You could also try: lsof -i UDP:domain.

share|improve this answer
    
It was really stopped and disabled, but somehow it was still sending dns queries. Could they have been queued somehow? –  Yanick Girouard Jul 16 at 16:43
    
Your lsof arguments are better than mine. Salute. –  dmourati Jul 16 at 17:30

Try something like this.

while true; do echo "COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME" ; sudo lsof -i -P -n | grep ":53"; done

This should reveal the PID of the command(s) issuing outbound port 53 requests.

share|improve this answer
up vote 0 down vote accepted

Turns out the rhnsd service simply kept retrying to connect to RHN because it couldn't connect. When the service was stopped, there was several DNS queries that were "queued" up, and they kept on going for a few more minutes after the service was stopped, which is why it seemed like it didn't have any effect. I waited 1 hour after the service was stopped and after a while the queries stopped completely and didn't come back.

So bottom line, all I had to do was to stop and disable the rhnsd and rhsmcertd services and wait a few minutes.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.