0

I'm searching the right way to identify which pid/process ask to mDNSResponder to resolve dns query.

In other terms I want do identify which process do which dns query through mDNSResponder and in some way correlate it.

In another term again I want to know the pid of every dns query made through mDNSResponder.

Is there a system administrator approach to do it or I have only a programmer way and so I need to patch mDNSResponder ?

|improve this question
1

To enable mDNSResponder logging, run

sudo killall -USR1 mDNSResponder  # enable Warning and Notice log level
sudo syslog -c mDNSResponder -w   # enable syslog logging for warning messages

followed by grep DNSServiceQueryRecord /var/log/system.log to see all DNS queries:

Aug 28 19:20:11 Fourecks.local mDNSResponder[53]:  25: DNSServiceQueryRecord(api.droplr.com., AAAA) STOP PID[18](configd)

The pid at the end (18 in the above example) is the pid for configd who requested address resolution in this case.

Turning on logging generates a lot of entries into system.log so it's probably a good idea to only use it if needed. To turn it off again, just rerun sudo killall -USR1 mDNSResponder.

|improve this answer
  • I know that but in the verbose log message there isn't the pid of the process that made the call but only the numeric user id that make that. anyway, thank you. – boos Aug 29 '12 at 8:26
  • I'm quite sure there is, I'll check tonight when I'm back home. Which OS X version are you running? – nohillside♦ Aug 29 '12 at 8:32
  • I'm using Mac OS X 10.7.2 – boos Sep 3 '12 at 14:21
  • Ah, output might be different there (I'm on 10.8). How does the result of the grep in my answer look in 10.7? – nohillside♦ Sep 3 '12 at 15:19
  • No PID information ! pastebin.com/pzxr5n59 – boos Sep 4 '12 at 11:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .