> It's 26 pages gzipped ascii. It's attached to this mail unless the
> list shakes it off. Some lists remove all attachments - can be a good
> policy at times...
Here's a guess:
> 0.000193 connect(6, {sun_family=AF_UNIX, sun_path="/dev/log"},
> 16) = 0
> 0.000378 send(6, "<83>Feb 4 02:12:52 pam_xauth[94"..., 66, 0) =
> 66
> 0.000247 SYS_174(0xd, 0xbffff720, 0, 0x8, 0xd) = 0
> 0.000196 close(6) = 0
> 0.000371 umask(02) = 077
> 0.000269 fork() = 9455
> 0.001840 SYS_175(0, 0xbffffc2c, 0, 0x8, 0) = 0
> 0.000315 SYS_174(0xf, 0xbffffac4, 0, 0x8, 0xf) = 0
> 0.000202 SYS_175(0x1, 0xbffffc2c, 0, 0x8, 0x1) = 0
> 0.000249 wait4(-1, [WIFEXITED(s) && WEXITSTATUS(s) == 0],
> WUNTRACED, NULL) = 9455
> 536.348655 open("/etc/pwdb.conf", O_RDONLY) = 6
I can't tell for sure from this trace, but from the logging in lines 1 and 2,
and the fork that follows that takes almost 9 minutes (if those numbers are
seconds) to finish, that pam_xauth is the culprit. This is consistent with it
only happening with su to root, since I think that's the only time that
pam_xauth is used.
pam_xauth is only a shared library and I don't know what process was forked
there (adding -f to the strace would be useful...), but if you want to
experiment, try moving your .Xauthority file someplace and try the su (and if
you're doing this under X, put it back afterwards or you won't be able to run
X apps any more).
Jeff
************
[EMAIL PROTECTED] http://www.linuxchix.org
