Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the correct way of editing /etc/hosts? I want to add some IP addresses and host names to it. It works for a while (a few hours) and then it gets reverted back to the original version. Is there any process checking the status of /etc/hosts and reverting it back?

I'm on my MBA with Mountain Lion.

share|improve this question
FWIW, this does not happen to me. I have an entry in /etc/hosts to a computer in my private network (address which has never been removed by the system. But perhaps it leaves addresses in local networks (10/8, 172.16/12 and 192.168/16 – see RFC 1918) alone, and removes addresses pointing to global IPv4 addresses? </speculation> – Harald Hanche-Olsen Jul 18 '13 at 18:43
Actually, I have added some entries a while back and they stayed. The new ones are getting removed. Both are in similar subnets. – Mohammad Moghimi Jul 18 '13 at 18:52
Have you been able to determine which process is changing the file? A tool like fseventer might help you understand what's editing the file. Since it's normally owned by root:wheel - the list of programs that can edit the file should be quite small. You could also just set the immutable flag on the file and avoid needing to revert changes. – bmike Jul 18 '13 at 19:36
up vote 9 down vote accepted

As a tool to help you find the culprit, here is a dtrace oneliner which prints the pid and name of any process which opens a file for writing, together with the filename:

dtrace -qn 'syscall::open*:entry /arg1&3/ { printf("%d %s %s\n", pid, execname, copyinstr(arg0)); }'

It needs to be run as root (e.g., with sudo). Pipe it into grep hosts to avoid drowning in output and missing what you are looking for:

sudo dtrace -qn 'syscall::open*:entry /arg1&3/ { printf("%d %s %s\n", pid, execname, copyinstr(arg0)); }' | grep hosts

Hopefully, this will tell you what process is overwriting the file. Just let it run in a terminal window until it triggers.

share|improve this answer

Do you use Cisco's AnyConnect VPN client? If so, you need to edit /etc/ instead, and let it copy that to the live file. See this MacOSXHints article, and these previous questions.

EDIT: I can't find anything specifically about Janos Pulse, but Juniper's Network Connect messes with /etc/hosts, and I suspect Pulse may do the same thing. According to this blog post, if you make changes while connected they'll be reverted when you disconnect, but changes made while disconnected will stick.

share|improve this answer
No I'm not using AnyConnect, there's no /etc/ either. However, I'm using another proxy software: Junos Pulse – Mohammad Moghimi Jul 20 '13 at 1:07
I can confirm this behavior with Junos Pulse 5.1.8. Changes to /etc/hosts must be made while disconnected or you'll lose them. – MisterEd Apr 20 at 18:34

If you are using Juno Pulse VPN client, /etc/hosts gets over-written by /etc/jnpr-pulse-hosts.bak

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.