Could not resolve host: mirrorlist.centos.org

[advsp]

I am getting the above error message mentioned INTERMITTENTLY and am unable to update. "dnf update" will work for a few 1/10ths of a second and then stop, wait...., then go, stop, etc. I have to retype the command like 30 times to get through the update of the 4 repos. It will start to download a repo, then timeout, then fail completely on the next try, then succeed and move on to the next repo, etc. It appears to only be functioning a small fraction of the time. The length of time in between when it functions and how long it chooses to stay functional seems random.

This is happening on 2 installs of CentOS 8.1 and was happening on the original install of 8.0 of 1 server.

This does NOT appear to be a DNS problem. Both of my nameservers are listed in resolv.conf. Plus:

Code: Select all

[~]$ dig mirrorlist.centos.org

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el8 <<>> mirrorlist.centos.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63356
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;mirrorlist.centos.org.         IN      A

;; ANSWER SECTION:
mirrorlist.centos.org.  60      IN      A       18.225.36.18
mirrorlist.centos.org.  60      IN      A       35.180.43.213
mirrorlist.centos.org.  60      IN      A       67.219.148.138
mirrorlist.centos.org.  60      IN      A       85.236.43.108
mirrorlist.centos.org.  60      IN      A       212.69.166.138
mirrorlist.centos.org.  60      IN      A       216.176.179.218

;; Query time: 97 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Mon Feb 10 19:29:43 EST 2020
;; MSG SIZE  rcvd: 146
[~]$

208.67.222.222 is my primary name server. And:

Code: Select all

[~]$ nslookup mirrorlist.centos.org
Server:         208.67.222.222
Address:        208.67.222.222#53

Non-authoritative answer:
Name:   mirrorlist.centos.org
Address: 18.225.36.18
Name:   mirrorlist.centos.org
Address: 35.180.43.213
Name:   mirrorlist.centos.org
Address: 67.219.148.138
Name:   mirrorlist.centos.org
Address: 85.236.43.108
Name:   mirrorlist.centos.org
Address: 212.69.166.138
Name:   mirrorlist.centos.org
Address: 216.176.179.218
Name:   mirrorlist.centos.org
Address: 2001:4178:5:200::10
Name:   mirrorlist.centos.org
Address: 2600:1f16:c1:5e01:4180:6610:5482:c1c0
Name:   mirrorlist.centos.org
Address: 2604:1580:fe02:2::10
Name:   mirrorlist.centos.org
Address: 2607:f8f8:700:12::10
Name:   mirrorlist.centos.org
Address: 2a05:d012:8b5:6503:9efb:5cad:348f:e826
Name:   mirrorlist.centos.org
Address: 2001:1b48:203::4:10
[~]$

But then 1 minute later:

Code: Select all

[~]$ nslookup mirrorlist.centos.org
Server:         208.67.222.222
Address:        208.67.222.222#53

Non-authoritative answer:
Name:   mirrorlist.centos.org
Address: 85.236.43.108
Name:   mirrorlist.centos.org
Address: 212.69.166.138
Name:   mirrorlist.centos.org
Address: 216.176.179.218
Name:   mirrorlist.centos.org
Address: 18.225.36.18
Name:   mirrorlist.centos.org
Address: 35.180.43.213
Name:   mirrorlist.centos.org
Address: 67.219.148.138
;; connection timed out; no servers could be reached

[~]$

And this usually happens......but every once in 10-20 tries it works and finds the list:

Code: Select all

[~]$ curl -v http://mirrorlist.centos.org/?release=8&arch=x86_64&repo=BaseOS&infra=stock
[1] 14388
[2] 14389
[3] 14390
[2]-  Done                    arch=x86_64
[~]$ * Could not resolve host: mirrorlist.centos.org
* Closing connection 0
curl: (6) Could not resolve host: mirrorlist.centos.org

[1]-  Exit 6                  curl -v http://mirrorlist.centos.org/?release=8
[3]+  Done                    repo=BaseOS
[~]$

Anyone have any ideas?

[TrevorH]

Well for a start you need to quote any url that contains & characters or it treats that as a command in itself hence all that rubbish it spat out. Otherwise it looks like you you're using opendns servers and I'd suggest trying someone else's since it appears you're not getting decent info from theirs.

[advsp]

Thanks for the help TrevorH.

Using the quotes around the URL seemed to help. Due to it processing correctly it reduces the time ti takes to run so improves the % of success. But I still get the "Could not resolv host" error 1 out of 3 or 4 attempts on the curl command.

Not sure it helped at all in trying to get through uploading my repos. It still takes me 10 or 20 tries to update 4 repos. And it takes several tries to get 1 package downloaded for install too.

I changed to Googles' nameservers to check and it does not seem to matter.

This has been haunting me and seems very strange, right?

My resolv.conf right now looks like this:

Code: Select all

# Generated by NetworkManager
search as.lan
nameserver 8.8.8.8
nameserver 8.8.4.4

[TrevorH]

Then I'd look at your network connection, maybe firewall blocking the ports and/or responses. Are you behind a cisco firewall by any chance? They used to have a parameter that controlled the maximum size of a DNS packet that could be received in response to a query and it defaulted to 512 bytes. A DNS response that contains multiple ip addresses can easily exceed this size and a better value is to reconfigure the firewall to use 4096. It's been about 10 years since I used a cisco so I don't remember the exact parameter now.

[advsp]

My "router" is a Netgear SRX5308 VPN Firewall. It has something called "Enable DNS Proxy" checked off. Could that be a cause?

[TrevorH]

If it's off then I think that means it's not getting in the way and it's unlikely. The problem I referred to before was a specific Cisco thing though others could have a similar problem (but I have no knowledge of).

[advsp]

It was checked off, meaning it was activated. Could that be it?

I contemplated much but have no idea what could be causing this.

BTW, my Windows machines have no problems with web connectivity on this network, just the Linux boxes.

[TrevorH]

You do not want to use a DNS proxy. It should be off.

[advsp]

I actually do not know what it even is used for. So, no, I want it off.

I turned it off and it does not seem to help as of yet. Any other ideas?