Good Afternoon everyone,
I just wanted to say hello, and see if anyone here can help me with a problem I am experiencing in my production environment.

Breakdown -
Slackware 11
kernel-2.6.20.2
Scp process updating /etc/hosts & /etc/services files anytime we need to make a change within our environments.

The general problem is that when our reboot schedule kicks off and our servers reboot the /etc/hosts and /etc/services files are being reverted back 9 months to original /etc/hosts and /etc/services we put i place at the time of the system build-out.

Now we do keep copies of our backups within the /etc/ directory for both hosts.MMDDYY and services.MMDDYY. We have not seen these issues in the past on our older 2.4 kernel/ Slackware 9.1 systems only on our newer Slackware 11/2.6.20.2 kernel systems.

Any ideas what would be reverting the system back to a way earlier /etc/hosts and /etc/services file. I have tried digging through /etc/rc.d and looking in /etc for any references to /etc/hosts or /etc/services and trying to figure out how and why the revert would be occurring.

Please any help would be much appreciated.

Thank you

Honestly, I have no idea why this could be happening, but it shouldn't happen at all AFAIK. You should double-check your systems if this is a nontrivial environment as something could be wrong in something _external_ to the Slackware base system itself, like a backup or remote synching mechanism interfering in the process, just to give you a couple of ideas. My /etc/hosts and /etc/services are never ever reverted to old versions after a reboot.

Hi,

You should check your logs. The '/etc/hosts' should not revert to previous version. Possibly someone else setting this up? Do you have 'tripwire' or 'chkrootkit' on your system?

Do you happen to have a script that would copy the files?

First thank you for the replies, much appreciated.

I am starting to think if it could be the remote overwrite policy we use for updating the /etc/hosts and /etc/services file. Both files are controlled by our network group whom update them regularly using a simple bash script that simply pushes a new file out and overwrites the existing. I am curious if modifying the bash script to still scp the file into place but then ssh to the host and mv the new version over the old version would fix the problem. perhaps its an issue with the system not keeping the new information beyond the existing run level and it throwing the data out when run level 6 is initiated.

This is just such a strange issue and as I said before does not appear in our lower regions or lower kernel/slack versions.

Thank you onebuck, I will check out the links you posted.