I am most familiar with Linux, which generally leaves /etc/hosts alone, but is there some legitimate reason why /etc/hosts would be altered at boot? We made some changes to /etc/hosts on an off site server (which I unfortunately don't know a ton of details about) and for some reason those changes disappear when the machine is rebooted. It comes up and down quite a bit due to unreliable power, so this is a problem.

This kind of thing makes me think of hackers and rootkits, but I don't even know where to start looking for what might be doing this whether it is legitimate or not. Any thoughts?

How is it changing?

DCHP or static IP?

No, I don't know of anything that will change /etc/hosts.

We are trying to add a line giving a name to one of the interfaces to make our software happy and that line disappears after rebooting. Oracle seems to want the machine to have a fully qualified domain name. There is DNS info in /etc/resolv.conf but no domain name.

There is an empty dhcp.blah file where blah is the interface that we are interested in. So I assume it is using DNS.
The machine knows the short (unqualified) name and that points to the right place, but that doesn't seem to make oracle happy.

I'm not aware of the OS modifying /etc/hosts on its own. Even dhcp doesn't do anything on it as far as I know. That would be a good job for dtrace to investigate ...