Is there a way to check when the hostname was changed?

TheEzekielProject · 06-02-2019, 12:07 AM

Hello all,

Basically title. I tried googling but could only find results on how to change the hostname, which I know how to do. But somehow my hostname has been changed (since last reboot, during the current session. I have one terminal showing my expected hostname, and the one I just opened showing as "new-host-2"). I'd like to know when and how it happened. I am the only user of this computer

Any help is appreciated.

ondoho · 06-02-2019, 01:57 AM

wouldn't this be sufficient?

Code:

ls -al /etc/hostname 
-rw-r--r-- 1 root root 5 Oct 15  2014 /etc/hostname

TheEzekielProject · 06-02-2019, 02:02 AM

Quote:

Originally Posted by ondoho

wouldn't this be sufficient?

Code:

ls -al /etc/hostname 
-rw-r--r-- 1 root root 5 Oct 15  2014 /etc/hostname

that gives me

Code:

-rw-r--r-- 1 root root 7 Feb 18 23:34 /etc/hostname

but it has to have been after that as my uptime is definitely shorter.

Code:

 00:00:35 up 4 days,  3:36,  0 users,  load average: 1.14, 1.07, 0.97

ondoho · 06-02-2019, 02:10 AM

I think it's possible to change this dynamically via environment variable.
Have you checked? as always, more detail is required.
Can you reboot the server to see if the stray hostname goes away? does every new terminal now have the new hostname?

scasey · 06-02-2019, 12:55 PM

From man hostname (emphasis added)

Code:

   SET NAME
       When called with one argument or with the --file option, the commands set the host name or the NIS/YP domain name.  hostname uses the sethostname(2) function, while all of the three domainname, ypdomainname and nisdomainname
       use setdomainname(2).  Note, that this is effective only until the next reboot.  Edit /etc/hostname for permanent change.

       Note, that only the super-user can change the names.

So it appears that a reboot will put it back, or you can just do

Code:

hostname -F /etc/hostname

to change it back

MadeInGermany · 06-02-2019, 02:05 PM

Any hints in /var/log/messages?

WideOpenSkies · 06-02-2019, 02:22 PM

Can't you directly edit the hostname file?

TheEzekielProject · 06-02-2019, 02:49 PM

Quote:

Originally Posted by ondoho

I think it's possible to change this dynamically via environment variable.
Have you checked? as always, more detail is required.
Can you reboot the server to see if the stray hostname goes away? does every new terminal now have the new hostname?

So looking through the various /var/log/messages* files the change happened between /var/log/messages.1 and /var/log/messages.2.gz. The expected hostname last appears at the end of /var/log/messages.2.gz on May 28 20:44:28 and the changed name appears at the start of /var/log/messages.1 on May 28 21:52:09. I didn't see the change specifically mentioned in the logs, though I'm not sure if that would even appear here.

I have not recently edited anything that should affect environment variables though I am not sure where all they can be set from. I have checked /etc/environment, .bashrc, and .profile.

Yes every new terminal showed the new hostname.

I did reboot and now the expected hostname is shown. I just thought it strange to have changed, I haven't had it changed unexpectedly before.

scasey · 06-02-2019, 02:52 PM

Quote:

Originally Posted by TheEzekielProject

I have one terminal showing my expected hostname, and the one I just opened showing as "new-host-2"). I'd like to know when and how it happened. I am the only user of this computer
.

By “showing” are you talking about what the terminal displays on its widow title?
What does the host name command return in that terminal?

TheEzekielProject · 06-02-2019, 03:57 PM

Quote:

Originally Posted by scasey

By “showing” are you talking about what the terminal displays on its widow title?
What does the host name command return in that terminal?

I am talking about how it shows username@hostname, hostname was showing new-host-2 rather than my usual hostname. Not in the window title, (though it did show there as well) but the terminal itself. The hostname command showed new-host-2 in that terminal. But a reboot has made this go away. Still curious as to how it happened though

MadeInGermany · 06-03-2019, 08:39 AM

Likely a command "hostname new-host-2" was run.
If it happened between two logfiles then check the rotation scripts in /etc/logrotate.d/ or any script that runs at the same time, e.g. in /etc/cron.daily/.
Last but not least, check /var/log/secure!

TheEzekielProject · 06-03-2019, 05:31 PM

Quote:

Originally Posted by MadeInGermany

Likely a command "hostname new-host-2" was run.
If it happened between two logfiles then check the rotation scripts in /etc/logrotate.d/ or any script that runs at the same time, e.g. in /etc/cron.daily/.
Last but not least, check /var/log/secure!

I checked my .bash_history and no such command was run. I also ran a grep -rnw for "hostname" on /etc/logrotate.d/, /etc/cron.daily/, /etc/cron.weekly/, and /etc/cron.monthly which turned up no results. And /var/log/secure does not exist on my system

ondoho · 06-04-2019, 01:19 AM

Quote:

Originally Posted by TheEzekielProject

I did reboot and now the expected hostname is shown. I just thought it strange to have changed, I haven't had it changed unexpectedly before.

if it happens again, investigate again.
you know a little more already.
btw, the current shell's environment can be checked with

Code:

env

you should also have checked the actual content of /etc/hostname of course.

evo2 · 06-04-2019, 01:30 AM

Hi,

Quote:

Originally Posted by TheEzekielProject

I checked my .bash_history and no such command was run. I also ran a grep -rnw for "hostname" on /etc/logrotate.d/, /etc/cron.daily/, /etc/cron.weekly/, and /etc/cron.monthly which turned up no results.

The hostname can sometimes be provided by dhcp a server. Has your machine been on a new network?

Quote:

Originally Posted by TheEzekielProject

And /var/log/secure does not exist on my system

On Debian based machines /var/log/auth.log is similar to /var/log/secure in RHEL land.

Evo2.