Hi all,

I have faced with the problem of login process to the Redhat server.
The login is still successful but it takes long time to log into the system.

My system is RedHat 6.7. As I check, Oracle database is installed on it.

How can we track what's happening at login process and which process causes the delay in this?

Regards,
Phat

Without knowing what you're talking about, there's little we can guess at. How are you logging in?? Over the network or at the console? Have there been any changes recently? Any updates? New server or old? Have you done ANY troubleshooting at all? Checked ANY logs?

Since you're using RHEL 6.7, have you contacted Red Hat support? You are PAYING for RHEL, right???

Hi,

I login using the putty to the server over the network. With console, it's ok.
We using Redhat but no payment. no log file or hint found

Why are you not paying for RHEL?? Without paying, you **DO NOT** get patches/bug fixes/updates/security updates, and are doing nothing but causing yourself more problems. Pay for RHEL or load CentOS instead. And sorry, but there are MANY log files on RHEL; have you looked at NONE of them? Looked in /var/log yet? Do you get ANY messages via putty when logging in?

Without SOME sort of hint, there's no way of even guessing. Which is exactly why you pay for RHEL, so when such things occur, you call them and they walk you through things. And you were asked several questions in the first reply...which you have not answered. Again, without details, there is no way we can help you. You were asked:

• Have there been any changes recently?
• Any updates?
• New server or old?
• Have you done ANY troubleshooting at all?
• Is this a new issue or has it been ongoing?

After login, do a
That does the 2nd half of a login.
If this is fast then the problem is in the first half of the login.
--
After login, run
Then do a 2nd putty/ssh login. You'll see all the system calls that happen during the login.
You can pause the output (and the login) with Ctrl-s, and resume with Ctrl-q

Hello,

Regarding the payment, it's policy of company.
In this case, which log file we should take a look? as I have checked /var/log/message, no useful info there.

Please advise something else that I can check.

Have there been any changes recently? --> no changes recently
Any updates? --> no update
New server or old? --> this quite old, not new one.
Have you done ANY troubleshooting at all? --> I check log files in /var/log
Is this a new issue or has it been ongoing? --> I just experience with long delay when login. --> How can we trace the login process?

What 'policy' is that?? Not to pay for what you use??? Sorry, very bad excuse.
No idea, since at this point you really haven't checked ANYTHING yet. There are LOTS of log files, messages is just one. Did you look at auth.log? And AGAIN, are there any messages that come up when logging in? Have you looked at running Putty with any options to enable logging?
https://www.ssh.com/ssh/putty/putty-.../Chapter3.html
So your post is very confusing. If there have been no changes or updates, and this server has been in place a good while, then we can only assume that this has been an issue for a long time, right? Because if it hasn't, then there obviously **HAVE** been some changes recently.

The solution is here:
https://access.redhat.com/solutions/741883

seeing as this is 6.7 and missing 1+ YEARS worth of security updates

and missing 1+ years worth of KNOWN security patches


i can take a GUESS


see what your intrusion detection software has to say ( if using any )
i BET there is code that is not yours on the machine

1 members found this post helpful.

Learning strace will help one understand Unix; here, the Unix login process.
The best way is what I call: the 'soft skill' of 'web-researching':
As a start, Put these 3 words into a Google.com search box: strace ssh login
Look at the -f -o strace switches, in: man strace
'wiki' is a good keyword to add to www-searches, like: wiki linux login process

(I'll refrain from OT wasted commentary on CEO/CIO/etc ethics&skills here.)

Without knowing anything about your network, ssh slow login are sometimes due to either useDNS or GSSAPI options being enabled.

Exactly, and that's what's outlined in that RHEL document I looked up for the user. But as JohnVV pointed out, without a Red Hat subscription, they won't be able to access the article and the patches needed to make this work.

True statement.

I also agree it is bad policy but then we know nothing about your company.

Check your DNS resolving in /etc/resolv.conf
It is preferable empty /etc/resolv.conf than wrong servers in it.

Can you try login via ssh ? Make sure you pass -vvv to display debugging message. It can give some hint if its related to network