Flush DNS cache changed in Lion

[HenryAZ]

After a bit of beating my head against the wall yesterday, trying to flush out the local resolver cache, I finally learned it has changed a bit under Lion.

In 10.6, and prior, the method was to issue

dscachutil -flushcache

from a Terminal prompt.

This no longer works, as I learned trying to flush an Address record I knew had changed (because I changed it myself on one of my domains). The new record had propagated on the Internet, and dig was getting the proper response from various external servers. But anything using the local resolver cache kept getting the old IP address, even after "flushing" with the old command.

I tracked it down by doing a dump of the local cache into system.log

sudo killall -INFO mDNSResponder

before and after using the old flush command. The old record remained in the cache, along with lots of others.

I dragged out my 10.6.8 external disk and booted from it. When you issue the old command (dscacheutil -flushcache) under 10.6, the following line is logged to system.log:
Oct 16 10:37:54 helios mDNSResponder[12]: SIGHUP: Purge cache

and of course the cache is flushed.

Using the old command under 10.7, there is no "Purge cache" being logged, and the cache remains intact.

What works under 10.7 is:
sudo killall -HUP mDNSResponder

That logs the purge, and flushes the cache.

[kbmb]

Originally Posted by HenryAZ

After a bit of beating my head against the wall yesterday, trying to flush out the local resolver cache, I finally learned it has changed a bit under Lion.

In 10.6, and prior, the method was to issue

dscachutil -flushcache

from a Terminal prompt.

This no longer works, as I learned trying to flush an Address record I knew had changed (because I changed it myself on one of my domains). The new record had propagated on the Internet, and dig was getting the proper response from various external servers. But anything using the local resolver cache kept getting the old IP address, even after "flushing" with the old command.

I tracked it down by doing a dump of the local cache into system.log

sudo killall -INFO mDNSResponder

before and after using the old flush command. The old record remained in the cache, along with lots of others.

I dragged out my 10.6.8 external disk and booted from it. When you issue the old command (dscacheutil -flushcache) under 10.6, the following line is logged to system.log:
Oct 16 10:37:54 helios mDNSResponder[12]: SIGHUP: Purge cache

and of course the cache is flushed.

Using the old command under 10.7, there is no "Purge cache" being logged, and the cache remains intact.

What works under 10.7 is:
sudo killall -HUP mDNSResponder

That logs the purge, and flushes the cache.

Thanks for this. Was wondering if the old method worked or not.

-Kevin

[Crismj]

Hello,

I've used this command before as you said and it worked fine, now I am trying to do the same in another computer (Mac 10.7 Lion as well) and it isn't working. I keep getting the old results. Can you help me???

Thank you so much

[HenryAZ]

Originally Posted by Crismj

Hello,

I've used this command before as you said and it worked fine, now I am trying to do the same in another computer (Mac 10.7 Lion as well) and it isn't working. I keep getting the old results. Can you help me???

Thank you so much

I just tried my two systems again (updated to 10.7.2 now), and this Terminal command still works here:

sudo killall -HUP mDNSResponder

The easiest way to see if it worked (easier than examining the cache contents), is to open Console, look at system.log, and look for a line similar to this resulting from the command:

Nov 13 15:12:48 helios mDNSResponder[12]: SIGHUP: Purge cache


You might really be flushing the local resolver (on that workstation), but perhaps your router is also caching records in its name server? I don't know if home routers do that as normal procedure, as I don't regularly use their (the routers') DNS services.

[Crismj]

Thank you for the quick answer. Well, I did what you said and it appears as you mentioned. Actually, it worked but as soon as I went online it went back to the old numbers again.

I am not really an expert...:-)

[vikinge]

I was searching for a reason why Lion flushdns did not work. THANK YOU!

[srogers1]

Strangely, I had to use the killall command on Snow Leopard (10.6.8) to get the cache to flush - the dscacacheutil command wouldn't work. I've used that command plenty of times in Snow Leopard, but probably with earlier versions. Could it be that Snow Leopard and Lion both use the new command now? Or is there something else about system configuration that requires one vs. the other?

[HenryAZ]

It appears the dscacheutil command is simply a shortcut to the killall -HUP method. The giveaway is what is logged on a successful flush, identical by either method:
Oct 16 10:37:54 helios mDNSResponder[12]: SIGHUP: Purge cache

I am unsure why it (dscacheutil) doesn't work for you on Snow Leapord; it does for me, and does not on Lion. Perhaps there is another reason besides simply OS version? I am wondering if dscacheutil -flushcache works for anyone on Lion? I tried it on two Lion installs, but though they are different hardware, they are both set up identically to my liking, and maybe that has something to do with it?

At any rate, it is hardly ever super-useful, as the records can be cached several places.

[srogers1]

I wonder if dscachutil fails silently if you don't use sudo? I'll have to try that next time I get a chance.

[Lane Roathe]

In my testing under 10.7.3 'sudo dscachutil -flushcache' doesn't work (no pause while cache is flushed, no log of purge as when the killall method is used) but the killall method does.

Just as an aside, I also found that MainMenu v2.1.2 (1412)'s Flush DNS option works under 10.6 and 10.7

[adt]

Anytime you'd like to spell it correctly, there is the option of typing:

dscacheutil -flushcache

[sidewinder]

Originally Posted by adt

Anytime you'd like to spell it correctly, there is the option of typing:

dscacheutil -flushcache

Spelled correctly, it still doesn't work. You need to use:

sudo killall -HUP mDNSResponder

As HenryAZ stated...

Also, that command works as stated on my Mac Pro (Early 2008) running Mac OS X 10.7.3. Here is the output to "/var/log/system.log":

May 9 01:13:10 Mac-Pro mDNSResponder[36]: SIGHUP: Purge cache

S-

[sidewinder]

Originally Posted by sidewinder

Spelled correctly, it still doesn't work. You need to use:

sudo killall -HUP mDNSResponder

As HenryAZ stated...

Also, that command works as stated on my Mac Pro (Early 2008) running Mac OS X 10.7.3. Here is the output to "/var/log/system.log":

May 9 01:13:10 Mac-Pro mDNSResponder[36]: SIGHUP: Purge cache

S-

Just tested Mac OS X 10.7.4 and you still need to use:

sudo killall -HUP mDNSResponder

S-

[distre1]

When I entered the "sudo.." command I receive the following warning...

WARNING: Improper use of the sudo command could lead to data loss
or the deletion of important system files. Please double-check your
typing when using sudo. Type "man sudo" for more information.

To proceed, enter your password, or type Ctrl-C to abort.

I'm currently a novice at all of this, so just want to make sure I'm not doing something wrong before I enter my password and ruin my system!

[madmin]

Originally Posted by distre1

When I entered the "sudo.." command I receive the following warning...

WARNING: Improper use of the sudo command could lead to data loss
or the deletion of important system files. Please double-check your
typing when using sudo. Type "man sudo" for more information.

To proceed, enter your password, or type Ctrl-C to abort.

I'm currently a novice at all of this, so just want to make sure I'm not doing something wrong before I enter my password and ruin my system!

Everyone gets that message the first time they run sudo, it's normal and not in itself something to worry about. However, running sudo is dangerous if you're not sure what you're doing.

[srogers1]

Originally Posted by madmin

Everyone gets that message the first time they run sudo, it's normal and not in itself something to worry about. However, running sudo is dangerous if you're not sure what you're doing.

Right - it's a legacy message that's been around much longer than the Mac. For most average users, you can muck things up much worse without sudo. In the worst case, you have to reinstall the OS, but say, you drag your iPhoto lib to the trash and you're not backed up - you're really hosed then.