Re: slow prelude-lml startup

LC Bruzenak <[email protected]> Tue, 25 May 2010 06:02:01 -0500
Newsgroups gmane.comp.security.ids.prelude.user
Message-ID <1274785321.14659.70.camel@lcb>
On Tue, 2010-05-04 at 16:49 +0200, Yoann Vandoorselaere wrote:
> Hi,
> 
> Le mercredi 28 avril 2010 à 18:54 -0500, LC Bruzenak a écrit :
> > Any clues as to why the prelude-lml (0.9.14-2.fc10.x86_64)) can take
> > minutes to start? It is only set to listen on port 514 (no file reads).
> > I am not certain how to debug really...I see no clues in the message
> > log. I've commented out all unused rulesets. 
> 

I apologize for the slow reply - have been away on travel.

> Did you check whether LML slow start is tied to the binding of the
> listening address? 
> 
> If you are providing an hostname as the UDP server address, you might be
> experiencing a delay because of a DNS resolution issue. Does commenting
> out the UDP server section help?
> 
> Regards,
> 
I am only using the IP addresses I am listening on; no hostnames.

I have 4 listen addresses - 3 NICs connected to 3 routers + localhost.
If I disconnect the routers prior to boot, the prelude-lml starts
quickly. Otherwise it takes minutes to start the service. I am unable to
access this machine again but may be able to recreate the issue on a
smaller scale soon.

It appears that the router connections are all timing out linearly.
Because the machine was not all the way up, I could not look at the
socket states and was only guessing really. No diagnostics were in the
message log.

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
[email protected]

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user