/etc/resolv.conf overwritten by what?

[James B. Byrne]

At 09:12EST this morning:

ls -l resolv*
-rw-r--r--  1 root  wheel  46 Dec 28 09:12 resolv.conf_empty_problem


Something changed the contents of /etc/resolv.conf from this:

search hamilton.harte-lyne.ca harte-lyne.ca
# nameserver ::216:33
# nameserver ::216:34
# nameserver 127.0.0.1
nameserver 216.185.71.33
nameserver 216.185.71.34
options edns0 timeout:5 attempts:3

to this:

# Generated by resolvconf
search localdomain

Now /sbin/resolvconf says that it has not been accessed recently:

# ls -lu /sbin/resolvconf
-r-xr-xr-x  1 root  wheel  21803 Apr  3  2018 /sbin/resolvconf

And this change was immediately noticed at ~19:13EST by people
accessing that host when all of their dns queries stopped resolving. 
So, I am reasonably certain that whatever overwrote the existing file
did so at 09:12 as shown on the mtime-stamp.

There are no crontab entries for root on this system:

# crontab -l
crontab: no crontab for root

I have never encountered this problem before.  Has anyone any idea of
why this happened?

-- 
***          e-Mail is NOT a SECURE channel          ***
        Do NOT transmit sensitive data via e-Mail
 Do NOT open attachments nor follow links sent by e-Mail

James B. Byrne                mailto:ByrneJB at Harte-Lyne.ca
Harte & Lyne Limited          http://www.harte-lyne.ca
9 Brockley Drive              vox: +1 905 561 1241
Hamilton, Ontario             fax: +1 905 561 0757
Canada  L8E 3C3