How did my hostname change? Where can I see this change being made/what time it changed?
0
votes
1
answer
1428
views
today I logged into my mac and opened zsh and had a big shock!
Normally my terminal prompt is something like:
Now when I check my system preferences and sharing the name of the macbook is still the same as it has ever been. It is
So now I want to ask. How can I find out
1. which files actually contain the string
sidharthghoshal@macbook-pro
But today I found it was :
sidharthghoshal@HaeLims-Air
I don't know what HaeLims-Air
is and my first assumption is I had been hacked. Exploring a bit I came across this post: https://apple.stackexchange.com/questions/125411/how-do-i-stop-my-computer-name-from-automatically-and-incorrectly-changing/301258#301258 .
Inspired by it I went to the terminal and ran print -P '%m'
and it printed out HaeLims-Air
so it my hostname %m
has legitimately changed.

Sidharth’s MacBook Pro
which is what I thought it should be.

HaeLims-Air
that has changed.
2. When did this file change?
I would like to understand exactly when that hostname in the zsh would have been modified. Since this is the first time in my entire life I have encountered this and still feel quite uneasy.
In a weak attempt I tried to run grep -iR "HaeLim" .
from the \etc
folder but nothing came up.
It is possible this is benign. I looked up my hostname history and indeed there I see that only MOST recently did the host name change:
sidharthghoshal@HaeLims-Air ~ % log show --style syslog --info --last 30d | grep 'setting hostname'
2024-01-28 16:34:51.391348-0500 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-01-28 16:34:54.493552-0500 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.lan"
2024-01-28 17:39:07.272782-0500 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-01-28 17:39:09.392589-0500 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.lan"
2024-01-31 11:10:27.564345-0500 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-01-31 11:10:37.515435-0500 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.lan"
1969-12-31 19:06:20.379707-0500 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-02-02 19:00:06.481011-0800 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.attlocal.net"
2024-02-02 19:06:23.604979-0800 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-02-02 19:06:27.296765-0800 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.attlocal.net"
1969-12-31 20:03:50.582148-0800 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-02-06 15:50:00.336584-0800 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.attlocal.net"
1969-12-31 16:08:31.806416-0800 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-02-06 22:00:14.072212-0800 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "HaeLims-Air"
I suspect that the February 06 entry given as
-02-06 22:00:14.072212-0800 localhost configd: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "HaeLims-Air"
Actually comes from my Macbook not being turned on since February 06. And thus when it turned on, before the Macbook KNEW what the correct date was it already was attempting to set the hostname. This makes a lot of sense because until the Macbook connects to WIFI I do not believe it has any way of being aware of what the time is. In order to connet to WIFI it will get a hostname assigned.
Asked by Sidharth Ghoshal
(121 rep)
Feb 27, 2024, 08:14 PM
Last activity: Apr 10, 2024, 04:14 AM
Last activity: Apr 10, 2024, 04:14 AM