2

I can run the command last (and last -i) in a fraction of a second, but when I run last -d, according to my tests, it takes a whopping 5 minutes and 22 seconds.

Just for reference, this is what adding the -d flag does:

   -d     For non-local logins, Linux stores not only the host name of the
          remote host but its IP number as well.  This  option  translates
          the IP number back into a hostname.

There is no indication in the man pages that it should take that much extra amount of time. As it says, Linux stores the IP already, so it shouldn't have to do any sort of slow reverse-lookup of the IP based on the hostname on the spot. In addition, it is slow even when it is "looking up" that the hostname value of :0 (a local login) should return the "IP address" value of 0.0.0.0.

Is the -d flag slow on all computers, or just mine? Could this indicate a corrupted file somewhere which may be inaccessible or difficult to read?

For reference, I am running 32-bit Ubuntu 13.10 (haven't upgraded yet).

IQAndreas
  • 10,145
  • 21
  • 59
  • 79
  • My tests are with `-d` `real, user, time (0m0.282s, 0m0.010s, 0m0.039s)` vs without `real, user, time (0m0.005s, 0m0.000s, 0m0.008s)`. So it's not affecting my pc. – polym Jun 24 '14 at 17:08
  • @polym Thanks for checking. What distribution are you running? – IQAndreas Jun 24 '14 at 17:09
  • I am running Ubuntu 13.10 (Saucy) 64 bit – polym Jun 24 '14 at 17:12
  • How long does `last -i` take? – Ramesh Jun 24 '14 at 17:17
  • And btw, in my system also there is no time lag. It displays the results as soon as I issue the command. – Ramesh Jun 24 '14 at 17:17
  • @Ramesh `last -i` takes `0.007s` (virtually instant). – IQAndreas Jun 24 '14 at 17:19
  • @IQAndreas, try pinging the IP of one of the output from `last -i` command and check if the host is reachable. I suspect it should be something related to `nslookup`. – Ramesh Jun 24 '14 at 17:23
  • @Ramesh All four hosts in the list (`0.0.0.0`, `127.0.0.1`, my home IP, and my work IP) are reachable via `ping` (though my work IP takes about 47ms to reach). – IQAndreas Jun 24 '14 at 17:40
  • can you get the source of `last` command ( via `apt-get source sysvinit-utils` ), write some test debug prints and look, where its taking forever? I guess it's taking forever at the `getnameinfo` call, but I might be wrong. – polym Jun 24 '14 at 17:44
  • `strace last -d` – Creek Jun 24 '14 at 18:40
  • 1
    @Creek https://gist.github.com/IQAndreas/ed534b0ef97631b0c136 It "hangs" right at that `read(4,` part. If I wait, it continues after a few seconds and writes a bit of data, then hangs at a `read(4` again. Let me know if you want the full output, instead of just up until the part where it hangs. – IQAndreas Jun 24 '14 at 18:45
  • @IQAndreas there's a `connect` to `8.8.8.8` then `/var/run/avahi-daemon/socket` then `write(4, "RESOLVE-ADDRESS 0.0.0.0\n", 24)` then the pause. Looks like @garethTheRed is on the right track, DNS resolution is getting stuck on 0.0.0.0 – Creek Jun 24 '14 at 19:08

1 Answers1

3

What's the DNS search order in /etc/nsswitch.conf? It should have files as the first option:-

hosts:      files mdns4_minimal [NOTFOUND=return] dns myhostname

It might be worth confirming the search order in your system.

I carried out the same test and had a result of 47 seconds for last -d.

I then added 0.0.0.0 localhost to /etc/hosts and it now take a mere 0.031s to run last -d.

Note - I've removed the 0.0.0.0 since, as according to Wikipedia, it's not valid to have it there.

IQAndreas
  • 10,145
  • 21
  • 59
  • 79
garethTheRed
  • 33,289
  • 4
  • 92
  • 101
  • I haven't modified the `/etc/nsswitch.conf` file, so the `hosts` setting is using the Ubuntu default value of `files mdns4_minimal [NOTFOUND=return] dns mdns4`. Although I have modified `/etc/hosts`, the line `0.0.0.0 localhost` is still there as per the defaults. – IQAndreas Jun 24 '14 at 18:49
  • What are you getting in the third column of the output of `last -d`? Is it `0.0.0.0` or `localhost`? – garethTheRed Jun 24 '14 at 19:05
  • I'm an idiot, I glanced and I could have sworn I saw `0.0.0.0` in the hosts file, but I checked again _properly_, and it wasn't there. – IQAndreas Jun 24 '14 at 19:10
  • You are correct, adding the line to `/etc/hosts` speeds `last -d` up to a whopping `0.018s`! Could you add a link to what you mean by "according to Wikipedia"? – IQAndreas Jun 24 '14 at 19:12
  • I was going by the first sentence of http://en.wikipedia.org/wiki/0.0.0.0 – garethTheRed Jun 24 '14 at 19:14
  • I did think it was odd that you said that the line `0.0.0.0 localhost` is still there **as per the defaults**. But as I'm not running Ubuntu, I couldn't argue! – garethTheRed Jun 24 '14 at 19:16