What is the correct way of editing /etc/hosts? I want to add some IP addresses and host names to it. It works for a while (a few hours) and then it gets reverted back to the original version. Is there any process checking the status of /etc/hosts and reverting it back?

I'm on my MBA with Mountain Lion.

  • FWIW, this does not happen to me. I have an entry in /etc/hosts to a computer in my private network (address which has never been removed by the system. But perhaps it leaves addresses in local networks (10/8, 172.16/12 and 192.168/16 – see RFC 1918) alone, and removes addresses pointing to global IPv4 addresses? </speculation> Commented Jul 18, 2013 at 18:43
  • Actually, I have added some entries a while back and they stayed. The new ones are getting removed. Both are in similar subnets. Commented Jul 18, 2013 at 18:52
  • Have you been able to determine which process is changing the file? A tool like fseventer might help you understand what's editing the file. Since it's normally owned by root:wheel - the list of programs that can edit the file should be quite small. You could also just set the immutable flag on the file and avoid needing to revert changes.
    – bmike
    Commented Jul 18, 2013 at 19:36

7 Answers 7


As a tool to help you find the culprit, here is a dtrace oneliner which prints the pid and name of any process which opens a file for writing, together with the filename:

dtrace -qn 'syscall::open*:entry /arg1&3/ { printf("%d %s %s\n", pid, execname, copyinstr(arg0)); }'

It needs to be run as root (e.g., with sudo). Pipe it into grep hosts to avoid drowning in output and missing what you are looking for:

sudo dtrace -qn 'syscall::open*:entry /arg1&3/ { printf("%d %s %s\n", pid, execname, copyinstr(arg0)); }' | grep hosts

Hopefully, this will tell you what process is overwriting the file. Just let it run in a terminal window until it triggers.


For me it's in the file


You have to edit this file to customize your hosts directives

When you are going to reconnect/connect using the Pulse Secure VPN, it's going to merge the directives from the


with the content from Pulse directives and creates the


2018 Update

With the newer version of Pulse Secure you have to exit the program first (check your active process).

Modify your host (/etc/hosts) and then restart Pulse Secure.


If you are using Juno Pulse VPN client, /etc/hosts gets over-written by /etc/jnpr-pulse-hosts.bak


Do you use Cisco's AnyConnect VPN client? If so, you need to edit /etc/hosts.ac instead, and let it copy that to the live file. See this MacOSXHints article, and these previous questions.

EDIT: I can't find anything specifically about Janos Pulse, but Juniper's Network Connect messes with /etc/hosts, and I suspect Pulse may do the same thing. According to this blog post, if you make changes while connected they'll be reverted when you disconnect, but changes made while disconnected will stick.

  • No I'm not using AnyConnect, there's no /etc/hosts.ac either. However, I'm using another proxy software: Junos Pulse Commented Jul 20, 2013 at 1:07
  • 1
    I can confirm this behavior with Junos Pulse 5.1.8. Changes to /etc/hosts must be made while disconnected or you'll lose them.
    – MisterEd
    Commented Apr 20, 2016 at 18:34

When changing the /etc/hosts file, make sure you are NOT connected to the VPN (at least if you are using Network Connect by Juniper Networks.)

As described in https://mcphersonz.wordpress.com/2009/11/12/etchosts-file-is-reverting-to-a-previous-state-in-os-x/

  • 1
    This question has an accepted answer from six years ago. The original post does not mention a VPN in use. Although your question may be helpful for other users who experience this problem whilst using a VPN (especially one from Jupiter Networks) it has little relevance to the original post.
    – IconDaemon
    Commented Dec 18, 2019 at 18:37
  • 2
    @IconDaemon Thank you for your warm welcome. That it was 6 years ago is irrelevant, because the page is still the first hit in the search engine. Also, 4 other answers already mention that a VPN can cause exactly the same problem (as in my own case), even if the accepted answer seemed to have solved the problem for the OP. However, even he acknowledges in a comment to Gordon that he used a VPN (Junos Pulse). Maybe you were right to vote my answer down, because disabling the VPN was already mentioned in the update of Stanislas' answer (but that's not what you say).
    – Michel
    Commented Dec 19, 2019 at 21:15

If you landed here because your Mac hosts file is being overwritten after you edit it, try editing the hosts file before you connect to a VPN. That resolved a problem I encountered.


I was unable to use quickstart cloudera VM after entering into VPN. To resolve this issue i followed below steps.

Step-1 : Add entry in /private/etc/hosts for e.g. quickstart.cloudera

Step-2 : Enter into VPN for e.g. I am using F5 VPN

Step-3 : Verify above mentioned entry in /etc/hosts using below command

cat /etc/hosts

I hope that it will be useful.

  • How does this address the problem described in the question, namely "something" overwriting /etc/hosts?
    – nohillside
    Commented Jul 8, 2019 at 7:00
  • Hi @nohillside, I added quickstart.cloudera entry in my /etc/hosts file but it got erased/overridden when i was connecting to VPN. To add quickstart.cloudera entry permanently, i added it in /private/etc/hosts file. Internally whenever you try to connect to VPN, it copies all entries from /private/etc/hosts to /etc/hosts. I hope that it make sense now. Commented Jul 9, 2019 at 4:07
  • Hi @nohillside, Just FYI... i am using F5 Big-IP Edge client and i have mac OS. Commented Jul 9, 2019 at 4:13
  • On macOS /etc is a symlink to private/etc so /etc/hosts and /private/etc/hosts are actually the same file (run ls -li /etc/hosts /private/etc/hosts to check).
    – nohillside
    Commented Jul 9, 2019 at 4:25
  • 1
    You are right @nohillside, but after adding entry in /private/etc/hosts my problem got resolved and after connecting to VPN as well my entry is not getting erased/overridden. Commented Jul 9, 2019 at 5:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .