‘last -d’ is REALLY slow

last

I can run the command last (and last -i) in a fraction of a second, but when I run last -d, according to my tests, it takes a whopping 5 minutes and 22 seconds.

Just for reference, this is what adding the -d flag does:

   -d     For non-local logins, Linux stores not only the host name of the
          remote host but its IP number as well.  This  option  translates
          the IP number back into a hostname.

There is no indication in the man pages that it should take that much extra amount of time. As it says, Linux stores the IP already, so it shouldn't have to do any sort of slow reverse-lookup of the IP based on the hostname on the spot. In addition, it is slow even when it is "looking up" that the hostname value of :0 (a local login) should return the "IP address" value of 0.0.0.0.

Is the -d flag slow on all computers, or just mine? Could this indicate a corrupted file somewhere which may be inaccessible or difficult to read?

For reference, I am running 32-bit Ubuntu 13.10 (haven't upgraded yet).

Best Answer

What's the DNS search order in /etc/nsswitch.conf? It should have files as the first option:-

hosts:      files mdns4_minimal [NOTFOUND=return] dns myhostname

It might be worth confirming the search order in your system.

I carried out the same test and had a result of 47 seconds for last -d.

I then added 0.0.0.0 localhost to /etc/hosts and it now take a mere 0.031s to run last -d.

Note - I've removed the 0.0.0.0 since, as according to Wikipedia, it's not valid to have it there.

Related Solutions

Logs – Understanding the Output of the ‘Last’ Command

reboot and shutdown are pseudo-users for system reboot and shutdown, respectively. That's the mechanism for logging that information, with kernel versions to same place, without creating any special formats for the wtmp binary file.

Quote from man wtmp:

The wtmp file records all logins and logouts. Its format is exactly like utmp except that a null username indicates a logout on the associated terminal. Furthermore, the terminal name ~ with username shutdown or reboot indicates a system shutdown or reboot and the pair of terminal names | / } logs the old/new system time when date(1) changes it.

wtmp binary file do not save other than timestamp for events. For example, last calculates additional things, such as login times.

reboot   system boot  2.6.32-28-generi Mon Feb 21 17:02 - 18:09  (01:07)    
...
user     pts/0        :0.0             Sat Feb 12 18:52 - 18:52  (00:00)    
user     tty7         :0               Sat Feb 12 18:52 - 20:53  (02:01)    
reboot   system boot  2.6.32-28-generi Sat Feb 12 08:31 - 18:09 (9+09:37)

The last column (in parentheses) is the length of event. For the user reboot, it's uptime.

After the latest reboot, time is current uptime. For earlier reboots, time is uptime after that reboot (so in the last line of my example it's uptime until the first line; there were no reboots in between). Number(s) before + means number of days. In the last line, it's 9 days, 9 hours and 37 minutes, and in the first line current uptime is 1 hour and 7 minutes.

Note, however, that this time is not always accurate — for example, after a system crash and unusual restart sequence. last calculates it as the time between it and next reboot/shutdown.

Where does ‘last’ store user hostnames

According to man last, my Arch Linux system stores login info in /var/log/wtmp. It looks to be in a binary format - that is, the usual text tools will only show you parts of it.

This command: xxd /var/log/wtmp | more shows me both text-format dotted-quad IP addresses, and fully-qualified DNS names.

I wrote the following little program to show me what was in /var/log/utmp. It appears that not every entry has a hostname/IP address, and that the binary format only has a small, fixed amount of room for the hostname.

#include <stdio.h>
#include <utmp.h>

int
main(int ac, char **av)
{
        struct utmp *utmpp;
        utmpname("/var/log/wtmp");
        while (NULL != (utmpp = getutent())) {
                printf("%s\n", utmpp->ut_host);
        }
        endutent();
        return 0;
}

Best Answer

Related Solutions

Logs – Understanding the Output of the ‘Last’ Command

Where does ‘last’ store user hostnames

Related Question