MacOS – How to log edits to the hosts file

hostslogsmacmacosSecurity

A guy I'm helping fix his Mac and he's got some process on there editing his host file to redirect queries to the Minecraft authentication servers (authserver.mojang.com and sessionserver.mojang.com) to it's own servers, basically it's a piracy program that he unknowingly installed and now we can't get rid of it. The only thing we know it's doing is editing the hosts file so if there is a way to log host file edits that would be great.

Any other recommendations for fixes would be nice too, of course.

Best Answer

Open terminal and run this command.

sudo fs_usage | grep hosts

Files that read / write / modify that should be logged clearly. Look at the last entry on the right for the program name. If you see nothing, in another window try these two commands. An edit implies a write to that file.

tail -2 /etc/hosts
cat /etc/hosts

As commented very clearly, if you can’t catch the change, you may have to set up a script to save the contents of the file periodically and then narrow down what can run during the time when it’s being messed with.

Related Solutions

MacOS – How to limit log file size in /var/log/DiagnosticMessages

While I suspect that this is not what you want to do, you could always do something like schedule a maintenance task to run to limit the size of the file.

Something like this in a shell script that you schedule:

tail -n 10000 /var/log/DiagnosticMessages > /var/log/DiagnosticMessages

Or if you want to keep a history of the contents, something like this:

mv /var/log/DiagnosticMessages /var/log/DiagnosticMessages_$(date +%y%m%d)

If you want to get fancy, you could:

cat /var/log/DiagnosticMessages | wc -l

and then only rename the file if > 10K. As usual it all depends on how much effort you want to put into it, and whether or not you want a history of this file.

And as you said....this doesn't actually resolve the root cause.

MacOS – Lion “hosts” File Bug

All additional entries to the HOSTS file must be above the:

fe80::1%lo0

Make sure there is at least one line break after the last entry. Like so:

127.0.0.1 LLL.localhost
127.0.0.1 LLL.localhost
#

Although you probably can't tell, there is another line following the # symbol. One more thing to mention, using Space instead of Tab between 127.0.0.1 and localhost might help too.

Best Answer

Related Solutions

MacOS – How to limit log file size in /var/log/DiagnosticMessages

MacOS – Lion “hosts” File Bug

Related Question