On Wed, Jun 21, 2017 at 08:34:43AM -1000, Dave Burns wrote: > This looks like NIS (DNS?) error output, but what could be invoking > anything that uses NIS or DNS in that command? ls, ci, and while don't need > it unless they are applied to some NFS mounted file, but this is executed > as root with a *local* home directory on *local* files, no need for YP. The > only hypotheses I can think of are "my copies of bash or ci have been > compromised" or "I am stupid". Do you have any 'nis' entries in /etc/nsswitch.conf for passwd or group? It might be using NIS to try to look up user/group information on files that have uid/gid numbers that aren't in the local passwd/group files. -- Jonathan Billings <billings at negate.org>