1

Some time ago sudo started to behave very slow on our server. Some times we have to wait even a few minutes until it executes.

I've checked all hostname and dns causes that forums all full of, but the problem still persists. I can confirm, that server names are resolved properly on this server.

Debugging sudo with strace gives this interesting results:

 0.000080 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
 0.000153 lseek(3, 0, SEEK_CUR)     = 0
 0.000044 fstat(3, {st_mode=S_IFREG|0644, st_size=1809, ...}) = 0
 0.000060 mmap(NULL, 1809, PROT_READ, MAP_SHARED, 3, 0) = 0x7f91b3dd3000
 0.000042 lseek(3, 1809, SEEK_SET)  = 1809
 0.000057 munmap(0x7f91b3dd3000, 1809) = 0
 0.000038 close(3)                  = 0
 0.000077 getgroups(0, NULL)        = 1
 0.000039 getgroups(1, [0])         = 1
 0.000045 getcwd("/home/myself", 4096) = 12
 0.000053 ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
 0.000184 fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 6), ...}) = 0
 0.000111 readlink("/proc/self/fd/0", "/dev/pts/6", 4095) = 10
 0.000095 stat("/dev/pts/6", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 6), ...}) = 0
 0.000079 uname({sys="Linux", node="OUR-SERVER", ...}) = 0
 0.000072 ioctl(2, TIOCGWINSZ, {ws_row=65, ws_col=205, ws_xpixel=0, ws_ypixel=0}) = 0
 0.000055 socket(PF_NETLINK, SOCK_RAW, 0) = 3
 0.000044 bind(3, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 0
 0.000042 getsockname(3, {sa_family=AF_NETLINK, pid=43381, groups=00000000}, [12]) = 0
 0.000042 sendto(3, "\24\0\0\0\22\0\1\3T\373\206S\0\0\0\0\0\0\0\0", 20, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 20
 0.418298 recvmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"$\2\0\0\20\0\2\0T\373\206Su\251\0\0\0\0\0\3\0\3339\0\321\0\1\0\0\0\0\0"..., 4096}], msg_controllen=0, ms
 0.000160 recvmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\340\3\0\0\20\0\2\0T\373\206Su\251\0\0\0\0\376\377\0\2639\0\321\20\1\0\0\0\0\0"..., 4096}], msg_controll
 ...

And the last 2 recvmsg lines a repeated about 4000 times!!! This 4000 socket receives are responsible for this slow down (notice the time on the first call - and these are only the first 2...).

Our server is ubuntu 12.04 with sudo 1.8.3p1.

I've even examined the sources of this sudo version, and these socket calls are not there... Please help :)

  • Have you looked in the system logs? – goldilocks May 29 '14 at 10:43
  • yes, nothing interesting there – er453r May 29 '14 at 12:17
  • This is shortly after reading /etc/passwd, so it's probably reading some other user database. What do you have in /etc/nsswitch.conf? – Gilles May 30 '14 at 2:03
  • standard stuff, with file only dns resolving: passwd: compat group: compat shadow: compat hosts: files networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis – er453r May 30 '14 at 6:27
  • did an experiment - replaced every source in nsswitch.conf with files - still the same... – er453r May 30 '14 at 9:28
0

This was the problem: https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/1272414

There are many ipip tunnels on our server, so sudo tried to probe all of the interfaces.

Newer version with proper ignores solved the problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.