Boston Linux & Unix (BLU) Home | Calendar | Mail Lists | List Archives | Desktop SIG | Hardware Hacking SIG
Wiki | Flickr | PicasaWeb | Video | Maps & Directions | Installfests | Keysignings
Linux Cafe | Meeting Notes | Blog | Linux Links | Bling | About BLU

BLU Discuss list archive


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

SUMMARY:find the PID doing DNS queries?



I asked about this a while back and then it got backburnered until yesterday.

PROBLEM:
  How to determine which PIDs on a RHEL3 (2.4 kernel) system were doing lookups against our legacy DNS server.  resolv.conf was being ignored.

SOLUTION:
 1) Set up iptables logging rules on a per-PID basis for traffic destined for the legacy DNS server:

ps -ef | awk '{print $2}' |grep -v PID | xargs -iXX iptables -A OUTPUT -d $LEGACY_DNS_IP -j LOG --log-prefix pid-XX -m owner --pid-owner XX

 2) Monitor /var/log/messages for iptables logs and parse out PIDs and process names:

awk '/pid-/ {print $6}' /var/log/messages | sort | uniq | sed -e 's/IN=//' | cut -f2 -d- | xargs ps -p

Caveats:
 1) We had no existing iptables rules, so removing the pid logging when I was done was as easy as "/etc/init.d/iptables stop".  This may be more involved with pre-existing rules.
 2) PID matching was apparently taken out in 2.6.24 due to it being "unfixable broken and stands in the way of locking changes to tasklist_lock." (from changelog)

Thanks to all for their suggestions and to Ben Eisenbraun for the iptables idea.

-Dan



      






BLU is a member of BostonUserGroups
BLU is a member of BostonUserGroups
We also thank MIT for the use of their facilities.

Valid HTML 4.01! Valid CSS!



Boston Linux & Unix / webmaster@blu.org