Hi,

please see my host command output,
its getting the correct IP then its failing.
never seen like this before.

[root@171-SYSLOG ~]# host 171-xymon
171-xymon.fosiul.acc has address 10.254.228.223
Host 171-xymon.fosiul.acc not found: 3(NXDOMAIN)
Host 171-xymon.fosiul.acc not found: 3(NXDOMAIN)
[root@171-SYSLOG ~]#

[root@171-SYSLOG ~]# host -v 171-xymon
Trying "171-xymon.fosiul.acc"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59574
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;171-xymon.fosiul.acc. IN A

;; ANSWER SECTION:
171-xymon.fosiul.acc. 0 IN A 10.254.228.223

Received 55 bytes from 10.254.228.226#53 in 1 ms
Trying "171-xymon.fosiul.acc"
Host 171-xymon.fosiul.acc not found: 3(NXDOMAIN)
Received 39 bytes from 10.254.228.226#53 in 1 ms
Trying "171-xymon.fosiul.acc"
Host 171-xymon.fosiul.acc not found: 3(NXDOMAIN)
Received 39 bytes from 10.254.228.226#53 in 0 ms
[root@171-SYSLOG ~]#

[root@171-SYSLOG ~]# cat /etc/resolv.conf
domain fosiul.acc
search fosiul.acc
nameserver 10.254.228.226
[root@171-SYSLOG ~]#

[root@171-SYSLOG ~]# nslookup 171-xymon.fosiul.acc
Server: 10.254.228.226
Address: 10.254.228.226#53

Name: 171-xymon.fosiul.acc
Address: 10.254.228.223

[root@171-SYSLOG ~]#


Why host command is trying 3 times any ideas ?? ??
any help will be really appreciable please
thanks

Do you have multiple entries for this host on your DNS server 10.254.228.226 apart from default A record. Also share the output from nslookup as described below:

1. Run nslookup
2. Once in nslookup prompt type: set debug
3. Type in the hostname and share the output

Also, share the output of dig <hostname>

Hi thanks for response
Lookup output

[root@171-SYSLOG ~]# nslookup
> set debug
> 171-xymon
Server: 10.254.228.226
Address: 10.254.228.226#53

------------
QUESTIONS:
171-xymon.fosiul.acc, type = A, class = IN
ANSWERS:
-> 171-xymon.fosiul.acc
internet address = 10.254.228.223
ttl = 0
AUTHORITY RECORDS:
ADDITIONAL RECORDS:
------------
Name: 171-xymon.fosiul.acc
Address: 10.254.228.223
>


dig output :-

[root@171-SYSLOG ~]# dig 171-xymon

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6 <<>> 171-xymon
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 35381
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;171-xymon. IN A

;; Query time: 0 msec
;; SERVER: 10.254.228.226#53(10.254.228.226)
;; WHEN: Tue Apr 8 21:15:28 2014
;; MSG SIZE rcvd: 27




[root@171-SYSLOG ~]# dig 171-xymon.fosiul.acc

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6 <<>> 171-xymon.fosiul.acc
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36361
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;171-xymon.fosiul.acc. IN A

;; ANSWER SECTION:
171-xymon.fosiul.acc. 0 IN A 10.254.228.223

;; Query time: 1 msec
;; SERVER: 10.254.228.226#53(10.254.228.226)
;; WHEN: Tue Apr 8 21:12:44 2014
;; MSG SIZE rcvd: 55

[root@171-SYSLOG ~]#


this dns server has 2 IP address
10.254.228.226
10.254.225.45

both can resolve the query .

And, thanks for your help.

tcpdump -i eth0 udp port 53

Shows it does 3 requests: for A, AAAA and MX. Looks like you only have IPv4 address configured, no IPv6 or email.

Thanks!! I was thinking that.. but was not 100% sure.
here is the output

[root@171-SYSLOG ~]# tcpdump -i eth0 udp port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
21:30:02.479189 IP Syslog.46178 > 10.254.228.226.domain: 47406+ A? 171-xymon.fosiul.acc. (39)
21:30:02.480509 IP 10.254.228.226.domain > Syslog.46178: 47406*- 1/0/0 A 10.254.228.223 (55)
21:30:02.480983 IP Syslog.56451 > 10.254.228.226.domain: 6076+ PTR? 226.228.254.10.in-addr.arpa. (45)
21:30:02.481210 IP Syslog.48341 > 10.254.228.226.domain: 9062+ AAAA? 171-xymon.fosiul.acc. (39)
21:30:02.481646 IP 10.254.228.226.domain > Syslog.56451: 6076 NXDomain- 0/0/0 (45)
21:30:02.482050 IP 10.254.228.226.domain > Syslog.48341: 9062 NXDomain- 0/0/0 (39)
21:30:02.482423 IP Syslog.59026 > 10.254.228.226.domain: 21832+ MX? 171-xymon.fosiul.acc. (39)
21:30:02.483193 IP 10.254.228.226.domain > Syslog.59026: 21832 NXDomain- 0/0/0 (39)


does it try to look AAAA and MX by default ??
i never seen that before ...
Do i need to change anything on network for it not to look at AAAA and MX by default ??

Default operation for host command is to only look for A record. It appears that some environment variable / alias (not sure) has been set to make it behave this way.

If host -t A <hostname> gives you the proper output then you should be looking at environment variable and aliases.

Check man host.conf if that helps

Hi,
Thanks
yes, i have created MX record for 171-xymon, and one error less

[root@171-SYSLOG ~]# host 171-xymon
171-xymon.fosiul.acc has address 10.254.228.223
Host 171-xymon.fosiul.acc not found: 3(NXDOMAIN)
171-xymon.fosiul.acc mail is handled by 20 171-PROXY-A.fosiul.acc

now I need to find out how to CReate AAAA
but the question is :-

i also thought default behavior of host is just too look at A record
and its works fine,

host -t A 171-xymon, give correct answer.

but we have more then 20 Redhat 6 server,
and all of them has same behavior

any idea what environment variable could do this ??

To be honest I am not sure why / how it is querying for AAAA (ipv6) address when you run the host command. I tried enabling IPv6 on my test RHEL6 machine but do not see any behavior change in host command output.

To answer your query related to creating AAAA record, in DNS there is option to create AAAA (IPv6 record). Method to create AAAA record depends on which platform your are running your DNS server. AAAA record is similar to what A record for IPv4.