Login Process takes longer

[panchpan]

Hello.

Since Yesterday, I notice that after giving telnet IP or SSH IP - it takes long time to display login: , I mean earlier after entering Server name It used to immediately ask for login ID and then password. But, now it takes min of 2-3 minute to ask for login ID.

Where can I check, whats going wrong?

[Rita C Workman · Accepted solution]

Check /etc/hosts
Check nsswitch.conf
Check DNS

Sounds like 'resolution' is what is choking.

Rgrds,
Rita

[tkc]

if you try telnet or ssh to ip and not hostname and still it is slow, compare it with logging in from the console. if that is slow too, system could be having other issue like bottleneck, hard disk hang, etc.

[Kevin Wright]

This is usually always a name resolution issue. When you ssh in, check syslog to see where the connection is coming from (nat?) and then try to resolve via nslookup, it'll probably fail. You can turn off DNS resolution in sshd_config, most likely your DNS servers are not providing valid PTR records for the source IP.

[Tim Nelson]

As mentioned most delayed login prompts are caused due to DNS delays ( system attempts to lookup IP/Hostname for use in logging.

Try a direct telnet from the server back to itself. Should get an immediate prompt. If not then you have system performance issues and need to start looking at CPU, MEM, DISK, etc..

Best of luck.

[panchpan]

How to turn off DNS resolutions - First of all what is DNS, and why is it coming in picture here on UNIX? Direct telnet from server back to itself is also slow. I mean, it shows connected to server but login: prompt comes delayed only. Performance, how do i check - coz the applications running on box are not having performance issues as such.

Please advice.

[Hein van den Heuvel]

Did it ever work right, or is this the first time connecting to that server?
Did it suddenly go bad, or did it get slowly worse?
What changed? Re-boot? Patches? Security settings? Auditing?

As the others suggest, most times when I experienced delays with 'login:' prompts it has been due to network name resolution.
Make sure that works BOTH ways.

How about 'ping' response times?
By name? By number? 1st one versus the rest?

Anyway, if you experiences delays with a local login as you now indicatee (console port, telnet 0) then one must check for system overload, to rule that out (or not).

Just use 'vmstat'.
Specificaly check the free, po, sy, and id columns.
free should be several thousands, po should be 0 or low, sy less than 30, id gt 20.

If that's not the case, then it si time to whip out 'glance', 'top', swapinfo and such for futher analysis.

Share those details here when in doubt about their meaning.



Hope this helps some,
Hein van den Heuvel (at gmail dot com)
HvdH Performance Consulting

[panchpan]

what is DNS? and How does it impact to login process? What solutions are there to follow IF the issue is caused by DNS ? Where do we have DNS settings made in UNIX?

[panchpan]

Sorry I missed to answer for asked i/p:

Did it ever work right - Yes. I am facing this problem of login slower nothing else since few days.
What changed? Re-boot? Patches? Security settings? Auditing? - Nothing is changed

As the others suggest, most times when I experienced delays with 'login:' prompts it has been due to network name resolution. --> Where are these settings? and How to verify/fix them?

How about 'ping' response times? - ping works perfect - No loss
By name? By number? 1st one versus the rest? - All ways.

Anyway, if you experiences delays with a local login as you now indicatee (console port, telnet 0) then one must check for system overload, to rule that out (or not). --> No load on system

Just use 'vmstat'. --> Here is the output, I dont understand much:

System configuration: lcpu=4 mem=15936MB

kthr memory page faults cpu
----- ----------- ------------------------ ------------ -----------
r b avm fre re pi po fr sr cy in sy cs us sy id wa
1 1 472314 428943 0 0 0 219 449 0 64 632 403 1 0 98 1


Please advice your comments and I got some info from google that such problem happens due to DNS. What is DNS? and how to verify/where/fix them?

[panchpan]

Here is the output:

prodipas@ssydpapp007 /data/ipas/d2/ipsmk2 $ nslookup 10.68.129.57
prodipas@ssydpapp007 /data/ipas/d2/ipsmk2 $ nslookup 10.68.129.57
*** Can't find server name for address 10.68.128.1:No response from server
*** Can't find server name for address 10.72.128.1:No response from server
*** Default servers are not available
prodipas@ssydpapp007 /data/ipas/d2/ipsmk2 $

It took 75 seconds to display first line. and then 75 seconds again to display remaining output. Earlier it used to display different output , dont remember very quickly. The IP address for server , users generally connect or I used to connect is 10.68.129.57 I am not sure what is 10.68.128.1 ? Something looks to be changed as nslookup output is differnt now.

I dont see any changes made recently in this file too:

prodipas@ssydpapp007 /etc $ more resolv.conf
nameserver 10.68.128.1
nameserver 10.72.128.1
domain au.challenger.net
prodipas@ssydpapp007 /etc $ ls -lt resolv.conf
-rw-r--r-- 1 root system 71 Apr 17 2007 resolv.conf
prodipas@ssydpapp007 /etc $

Please advice ... whats going on? and whats the command to bring up DNS Servers?

[panchpan]

I have learnt that few days back the DNS team has removed the DNS Servers. And the IP mentioned in /etc/resolv.conf does not exist anymore.

Do you think, that has caused the issue?
Which all places do you suggest to modify DNS new IP on UNIX?
After modification, does a server reboot require or any command to be supplied after modifications to have new DNS activated on each UNIX box?

[whiteknight]

panchalp,

this is a probable cause, due to DNS issue.

in /etc/nsswitch.conf

hosts: file dns

WK

[panchpan]

Thank you very much :-)

Last question... What happens except the delay in login IF we keep old DNS entry. As there are no complains from users about performance or connectivity since the users are connecting to direct server IP.

[Jollyjet]

There is no impact it will keep on search the dns server to connect it will affect ur performance of the server and show in hung status.

[panchpan]

Resolved as DNS Server was upgraded.

Thanks to all :-)

[Bill Hassell]

As you have seen, DNS is a critical resource and can seriously impact your system if it is the primary method to validate IP addresses and hostnames. The reason that telnet and ssh (and mayn other network tasks) are so slow is that HP-UX will try to validate each new connection by checking that there is a hostname and IP address, either in the DNS server or in /etc/hosts. The reason that people suggested checking resolv.conf and nsswitch.conf is that these files control DNS behavior.

The best way to avoid DNS issues is to only use DNS as a last resort. To do this, you change the file /etc/nsswitch.conf to read like this:

passwd: files
group: files
hosts: files [NOTFOUND=continue UNAVAIL=continue] dns
ipnodes: files [NOTFOUND=return] dns
networks: files
protocols: files
rpc: files
publickey: files
netgroup: files
automount: files
aliases: files
services: files

Now, DNS will not be used unless the connection IP address/hostname is not found in the /etc/hosts file. Be sure to put the IP addresses/hostnames of your production servers and any other standard connections in /etc/hosts. These should not change very often so they can be stored in this file. If you see a slowdown in the future, add the address of the user trying to connect to the /etc/hosts file and the problem will go away (and notify your DNS administrators that DNS is not working again).