Sample Header Ad - 728x90

How did my hostname change? Where can I see this change being made/what time it changed?

0 votes
1 answer
1428 views
today I logged into my mac and opened zsh and had a big shock! Normally my terminal prompt is something like: sidharthghoshal@macbook-pro But today I found it was : sidharthghoshal@HaeLims-Air I don't know what HaeLims-Air is and my first assumption is I had been hacked. Exploring a bit I came across this post: https://apple.stackexchange.com/questions/125411/how-do-i-stop-my-computer-name-from-automatically-and-incorrectly-changing/301258#301258 . Inspired by it I went to the terminal and ran print -P '%m' and it printed out HaeLims-Air so it my hostname %m has legitimately changed. enter image description here Now when I check my system preferences and sharing the name of the macbook is still the same as it has ever been. It is Sidharth’s MacBook Pro which is what I thought it should be. enter image description here So now I want to ask. How can I find out 1. which files actually contain the string HaeLims-Air that has changed. 2. When did this file change? I would like to understand exactly when that hostname in the zsh would have been modified. Since this is the first time in my entire life I have encountered this and still feel quite uneasy. In a weak attempt I tried to run grep -iR "HaeLim" . from the \etc folder but nothing came up. It is possible this is benign. I looked up my hostname history and indeed there I see that only MOST recently did the host name change:
sidharthghoshal@HaeLims-Air ~ % log show --style syslog --info --last 30d | grep 'setting hostname' 

2024-01-28 16:34:51.391348-0500  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-01-28 16:34:54.493552-0500  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.lan"
2024-01-28 17:39:07.272782-0500  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-01-28 17:39:09.392589-0500  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.lan"
2024-01-31 11:10:27.564345-0500  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-01-31 11:10:37.515435-0500  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.lan"
1969-12-31 19:06:20.379707-0500  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-02-02 19:00:06.481011-0800  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.attlocal.net"
2024-02-02 19:06:23.604979-0800  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-02-02 19:06:27.296765-0800  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.attlocal.net"
1969-12-31 20:03:50.582148-0800  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-02-06 15:50:00.336584-0800  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.attlocal.net"
1969-12-31 16:08:31.806416-0800  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-02-06 22:00:14.072212-0800  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "HaeLims-Air"
I suspect that the February 06 entry given as
-02-06 22:00:14.072212-0800  localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "HaeLims-Air"
Actually comes from my Macbook not being turned on since February 06. And thus when it turned on, before the Macbook KNEW what the correct date was it already was attempting to set the hostname. This makes a lot of sense because until the Macbook connects to WIFI I do not believe it has any way of being aware of what the time is. In order to connet to WIFI it will get a hostname assigned.
Asked by Sidharth Ghoshal (121 rep)
Feb 27, 2024, 08:14 PM
Last activity: Apr 10, 2024, 04:14 AM