We have noticed that on some of our Macs the computer's name is getting added to /etc/hosts. This isn't having any negative effect on the operation of the Mac, but it does cause an issue with Tanium which queries the computer name as part of its data gathering tasks. These Macs display in Tanium as "localhost", not the name that is actually set for the Mac. We use the Mac's serial number for computer names. During initial setup, a policy runs "jamf setComputerName -useSerialNumber" I created an extension attribute that reads the contents of the hosts file and reports if the computer name is present. There have only been about 30 out of 1500. I created a script to remove the computer name, but on some of the Macs, the computer name has reappeared in the hosts file. Since this doesn't happen on all Macs, I'm not sure what could be doing this. Does anyone have ideas on what might be doing this?
Computer names getting added to /etc/hosts file.
+23
+25@howie_isaacks Can you correlate the timestamp of the /etc/hosts file being changed with any action from Jamf Pro or some app being run? I haven't seen it add a Mac's name to the /etc/hosts file, but Docker will add things to it
+23@howie_isaacks Can you correlate the timestamp of the /etc/hosts file being changed with any action from Jamf Pro or some app being run? I haven't seen it add a Mac's name to the /etc/hosts file, but Docker will add things to it
I have not yet done that, but I did notice that when I tested my policy to remove the computer name from the hosts file on my own Mac, I saw another hosts file named "hosts '" that was created at the same time my policy ran which remove the computer name from the hosts file. I read this file and it did have my computer name in it. I don't think (yet) that a policy in Jamf Pro is doing this but my investigation just started.
Reply
Most helpful members this week
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.