Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having trouble with sudo on some systems. It is taking anywhere from 15-30 seconds to complete a sudo command or to even login to the system.

I ran an strace and can see where the delay is happening, but I'm not sure what's wrong. It seems it's waiting on a write request to /dev/log maybe? But that doesn't tell me much info, nor does it tell me why it's taking so long. Are there any strace experts out there that can explain this better?

12:08:21 munmap(0x7f5ccef9d000, 4096)   = 0
12:08:21 socket(PF_NETLINK, SOCK_RAW, 9) = 4
12:08:21 fcntl(4, F_SETFD, FD_CLOEXEC)  = 0
12:08:21 readlink("/proc/self/exe", "/usr/bin/sudo", 4096) = 13
12:08:21 sendto(4, "t\0\0\0M\4\5\0\2\0\0\0\0\0\0\0op=PAM:accountin"..., 116, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 116
12:08:21 poll([{fd=4, events=POLLIN}], 1, 500) = 1 ([{fd=4, revents=POLLIN}])
12:08:21 recvfrom(4, "$\0\0\0\2\0\0\0\2\0\0\0b3\0\0\0\0\0\0t\0\0\0M\4\5\0\2\0\0\0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
12:08:21 recvfrom(4, "$\0\0\0\2\0\0\0\2\0\0\0b3\0\0\0\0\0\0t\0\0\0M\4\5\0\2\0\0\0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
12:08:21 close(4)                       = 0
12:08:21 rt_sigaction(SIGTSTP, {SIG_IGN, [], SA_RESTORER|SA_RESTART, 0x7f5cce1de920}, NULL, 8) = 0
12:08:21 open("/var/db/sudo/matt/0", O_WRONLY|O_CREAT, 0600) = 4
12:08:21 fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_CUR, start=0, len=0}) = 0
12:08:21 write(4, "\v\0\0\0\0\0\0\0\0\210\0\0\0\0\0\0\3\0\0\0\0\0\0\0`\206\212Q\0\0\0\0"..., 40) = 40
12:08:21 close(4)                       = 0
12:08:21 socket(PF_FILE, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
12:08:21 connect(4, {sa_family=AF_FILE, path="/dev/log"}, 110) = 0
12:08:21 sendto(4, "<85>May  8 12:08:21 sudo:     ma"..., 95, MSG_NOSIGNAL, NULL, 0) = 95
12:08:34 close(4)                       = 0
12:08:34 close(3)                       = 0
12:08:34 munmap(0x7f5ccef9e000, 4096)   = 0
12:08:34 umask(022)                     = 02
12:08:34 umask(02)                      = 022
12:08:34 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f5cce1de920}, NULL, 8) = 0
12:08:34 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f5cce1de920}, NULL, 8) = 0
12:08:34 rt_sigaction(SIGTSTP, {SIG_DFL, [], SA_RESTORER, 0x7f5cce1de920}, NULL, 8) = 0
12:08:34 socket(PF_NETLINK, SOCK_RAW, 9) = 3
12:08:34 fcntl(3, F_SETFD, FD_CLOEXEC)  = 0
12:08:34 fcntl(3, F_SETFD, FD_CLOEXEC)  = 0
12:08:34 ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
12:08:34 readlink("/proc/self/fd/0", "/dev/pts/0"..., 31) = 10
12:08:34 lstat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
12:08:34 getcwd("/home/matt", 4096)     = 11
share|improve this question
    
Well the big delay seems to be related to the sendto() which Google explains is a function for writing to a socket. The socket appears to be /dev/log which is normally syslog. Your syslog seems to be slow for some reason. Are you using a network-based syslog? –  Zoredache May 8 '13 at 17:36
    
Yep...tracked it down to rsyslog. I'm logging to a remote server and that remote server had gone offline causing rsyslog to delay everything. I thought rsyslog would handle that better. It's supposed to queue log messages to /var/spool/rsyslog I think and then send them when it sees the remote come back online. I'll have to do some more research on that. –  Matt May 8 '13 at 17:56
1  
When diagnosing slowness with strace, the -T and -tt options are indispensible. Microsecond timestamp at the start of every line and deltas at the end of each line. –  Ladadadada May 8 '13 at 19:09
add comment

2 Answers

Rsyslog remote was down. See my comment above.

share|improve this answer
add comment

syslog-ng has a lot of useful options for mitigating problems with dead remote logging servers. Have a look under "Failover Logging to Remote Host" at https://wiki.archlinux.org/index.php/Syslog-ng

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.