Understanding the system log (boot time 2 minutes)

Question

Understanding the system log (boot time 2 minutes)

Dear Apple Discussion,

I am trying to read the system.log correctly - mainly because my boot time is 2 minutes.

I have read that the beginning of the boot up is indicated by the line:

localhost kernel[0]: standard timeslicing quantum is 10000 us

is this correct?

Next, does the line:

loginwindow[165]: Login Window Started Security Agent

indicate that the login window has come up?

If both of these are correct then my boot time should be 18s (according to the time stamps in the log) - it defefinitely is not that.

Does the boot process start instead at this line:

shutdown: reboot by root:

If this were the case, the boot time would be closer to 2 minutes according to the log (which is what it actually is).

This then brings up the next problem: the two minutes basically come from the following line:

Nov 29 17:30:24 Purrfekt shutdown: reboot by root:
Nov 29 17:30:24 Purrfekt SystemStarter[177]: authentication service (194) did not complete successfully
Nov 29 17:30:24 Purrfekt kernel[0]: CiscoVPN : unloading cisco ipsec kernel module.
Nov 29 17:30:24 Purrfekt kernel[0]: CiscoVPN : detaching from interface: en1.
Nov 29 17:30:24 Purrfekt kernel[0]: CiscoVPN : interface en1, filter has been safely detached.
Nov 29 17:30:24 Purrfekt kernel[0]: CiscoVPN : detaching from interface: en0.
Nov 29 17:30:24 Purrfekt kernel[0]: CiscoVPN : interface en0, filter has been safely detached.
Nov 29 17:32:12 localhost kernel[0]: standard timeslicing quantum is 10000 us

ending line of the boot process occurs at (if my above assumption is correct):

Nov 29 17:32:31 Purrfekt loginwindow[165]: Login Window Started Security Agent

So why does it hang for so long at this one process? Am I reading the log incorrectly? I have searched around here and also on google ("slow boot time", "cisco vpn tiger", etc..) but haven't found anything relating to my problem.

Thanks for any help.

MonkeyApple

v.1 PowerBook G4 15'' Mac OS X (10.4.3)

Posted on Dec 2, 2005 3:19 PM

Reply

Answer 1

Dec 2, 2005 3:50 PM in response to Bertrand Biritz

Are you considering booting to be when you select Restart, which may involve going through a lot of shutdown and other tasks, or from when you power on the machine? If system.log denotes "shutdown" that's the beginning of shutting down, not restarting. OTOH, be aware that not everything that happens during booting makes a system.log entry...when I boot, I see lots of messages flash by on the login window about services starting before I get a login prompt.

Reply

Answer 2

Dec 2, 2005 6:07 PM in response to Daniel Macks

I would consider booting up when the machin powers back on, not when I press the restart button.

So if the log doesn't list all of the processes how can I find out what is eating into my boot up time?

Reply

Answer 3

Dec 2, 2005 7:58 PM in response to Bertrand Biritz

I am trying to read the system.log correctly - mainly because my boot time is 2 minutes.

It appears to be that a restart or shutdown process delays nearly 2 minutes rather than a startup process, presumably due to one of WindowServer children or a bug stays in Mac OS X 10.4.3 Update-- Mine delays approximately 30 - 40 minutes on PowerMac G5 2.7 Ghz on every shutdown or restart process. Your computer is PowerMac G4 so that make sense. I found a suspect application which is a security related. Although I am still investigating further because the issue does not occur on the lower drive bay where I install another Mac OS X 10.4.3 Update (but no third-party software) as a test facility.

localhost kernel[0]: standard timeslicing quantum is 10000 us

This is correct and the first line to display sequential events in a boot process.

loginwindow[165]: Login Window Started Security Agent

This is also a normal behavior.

SystemStarter[xxx]: authentication service (xxx) did not complete successfully

This can be displayed depending on a computer configuration.

A sequential event from CiscoVPN: unloading cisco ipsec kernel module to CiscoVPN: interface en0, filter has been safely detached seems to be all right if you PROPERLY configure VPN policy and IPsec (Internet Protocol Security) authenticate, etc for your Cisco device. IPsec is a framework for a set of protocols for security at the network or packet processing layer of network communication.

I suggest to check all related settings with Netwrok/Sharing panes and the router configurations for VPN (IPsec), IPv6, security, etc. Also check routing table and all socket connections after you launch Network Utility or via Terminal commands.

FYI: interface en0 is a wired connection and interface en1 is a wireless connection such as AirPort. IPsec kernel module is a unit of kernel program or componet for IPsec.

Hope this helps.

G5 Dual 2.7GHz, Dell XPS 3.2GHz, G3B&W, Sony LTop Mac OS X (10.4.3) Tiger10.4.2, MacOS 9.2.2, WinXP Pro, Win ME, Linux

Reply

Answer 4

Dec 2, 2005 8:12 PM in response to Fumiaki Kawashima

Thanks for the detailed response.

You are right, the shut down process also takes some time (sorry to hear yours takes 30-40 minutes!). But the boot up time is at around 2 minutes, so there is also something there which eats up time.

Is there some page to look up what is normal for the VPN and IPv6? VPN came pre-configured from my university so I am assuming they hopefully know how to set it up 😉

As for Network/Sharing panes, what exactly am I looking for?

Thanks.

Reply

Answer 5

Dec 2, 2005 10:48 PM in response to Bertrand Biritz

(sorry to hear yours takes 30-40 minutes!)

It's my typo error. I though I wrote 30-40 seconds.

Is there some page to look up what is normal for the VPN and IPv6?

I recommend to review the manual that came with the device. Here is my experience. There was no manual about VPN security configurations in the box I purchased an advanced router. So I phoned the vendor and they told me a hidden Web site that I could download a comprehensive technical manual with other security information. Actually, I disable VPN and IPv6 features now.

Another odd story; one day I accidentally press a setting button after opening the configuration table over a Web browser which I did not configure anything, but a bug contained program wrote an unnecessary syntax on the router device. This makes a number of fake DoS attacks to the router as if it comes from my ISP's DNS server. The device vendor told me they will fix it.

As for Network/Sharing panes, what exactly am I looking for?

Normally, you do not need to modify if the device does not require anything to do so. Check the device's instructions whether you need to change something on System Preferences.

If you have no delay when you disconnect the device and driver (if any), then you'll need to find out what item makes your computer delay.

Reply

Answer 6

Dec 2, 2005 11:19 PM in response to Fumiaki Kawashima

Oh, 30-40 seconds - I wish!

I am not quit following your post: what device are you talking about? I don't really have anything external connected to my machine, just a mouse.

Is there some log which shows me what is causing the slow down? What about verbose mode, or is just the same as the system.log file (guessing it is). How else would I find out what is causing the boot up delay?

Reply

Answer 7

Dec 2, 2005 11:56 PM in response to Bertrand Biritz

It is a router that implements VPN with IPsec feature.

Don't you even use a Cisco VPN client? If so, it puzzles me why that message are displayed.

You can see all Logs list on console application by clicking Logs icon.

As I guessed in my first article, the cause could be from the Mac OS X 10.4.3 Update. If you want to verify it, you need to test the followings.

1. Erase and Install the computer to reconfigure as exactly the same as Apple shipped from its factory.

2. Check the recurrence with no network connection, no third-party software installed.

3. If the issue stops, then update to Mac OS X 10.4.3 without connecting any network and installing third-party software.

4. If the issue recurs, then you may want to feed back to Apple as a bug report. You need to attach a copy of System Profiler.

Reply

Answer 8

Dec 3, 2005 12:03 AM in response to Fumiaki Kawashima

Yes I do. My university requires it to connect to their wireless network - other than that I don't use VPN.

As for your suggestion, that woud take some time and to be honest I am not that hard core about it.

Although, I will be getting a new machine on which I will be installing 10.4.3 eventually (after I do a clean install from the Tiger DVD). So I can follow your instructions then (will get it on 16/12/05 - and doing a clean install a little later).

Thanks for all of the advice.

Reply

Answer 9

Dec 3, 2005 12:31 AM in response to Bertrand Biritz

I think the cause is a version of Cisco client software that does not deal with Mac OS X 10.4.3 runtime environment including recent security updates, or some resource file could be corrupted when or after 10.4.3 update.

Although, I will be getting a new machine on which I will be installing 10.4.3

You are smart! This is also a good idea.

Have a nice weekend!

Reply

Answer 10

Dec 3, 2005 8:55 AM in response to Fumiaki Kawashima

One quick question as I am still not getting something.

According to the time stamps:

Nov 29 17:32:12 localhost kernel[0]: standard timeslicing quantum is 10000 us

Nov 29 17:32:31 Purrfekt loginwindow[165]: Login Window Started Security Agent

I should have a boot up time of 19 seconds, yet it is more like two minutes. Even if there are processes starting up which don't write to the system log wouldn't I still see a 2 minute delay between these two events?

Reply

Answer 11

Dec 7, 2005 1:40 AM in response to Bertrand Biritz

If you mean the sequential time from standard timeslicing quantum is 10000 us to Login Window Started Security Agent is more than 2 minutes but not 19 seconds, it takes too much. Are there any odd events in the whole sequential events from standard timeslicing quantum is 10000 us to a shutdown flag that suggest a system problem?

Also, if you mean it takes a 2 minutes until the system.log starts to be written after powering on, it takes too much as well. If this is the case, the cause is most likely somewhere on a network layer (there are 7 layers in OSI model).

FYI: Cisco released a security notice on OpenSSL vulnerability on last Friday which Apple Computer had patched this vulnerability with Security Update 2005-009.

Reply

Answer 12

Dec 7, 2005 7:27 AM in response to Fumiaki Kawashima

I meant, the time stamps (from "time slice" to "login window") would suggest a boot time of only 19 seconds. While in reality it is more like 2 minutes.

I haven't written down the starting and stopping times for the boot process so I can't say if the writting of the log is delayed.

Right now I am checking some RAM which I bought a while ago, I want to see if it still causes system instabilities - which I see in my uptime. That is the reason I am not restarting right now.

At the latest come next weekend (17/12) I will find out.

Reply

Answer 13

Dec 17, 2005 4:41 PM in response to Bertrand Biritz

Okay, so I got a hold of my new PowerBook G4 (1.67GHz, 2GB RAM, 100GB HD).

The boot up time with the OS pre-installed was around 37 seconds.

I tried doing a clean install with my Tiger DVD (10.4.0, bought April 29th) and it would not boot off of it. Similarly with my 10.3 CD's. Apparently Apple decided to disallow installing "older" OS's on the new computer (can anyone officially confirm this?).

So what I ended up doing was using the recovery DVD, which thankfully acts pretty much like an OS installer. I deselected what I wanted to and then did a clean install of 10.4.2.

Boot time remaind at around 37 seconds.

I then tried to upgrade to 10.4.3 via a dmg instead of connecting to the internet - no luck. Apparently the server is down. In the end I did connect to the internet and installed 10.4.3 that way. The boot time is still around 37 second (might be up to 40 seconds).

So on my previous PB the 2 minute boot time was not caused by 10.4.3.

I looked again at the boot up process (verbose mode) on my "old" machine and discovered that it hangs on the IPv6 process. As I am going to downgrade this machine to 10.3 anyway, hopefully the slow boot time will go away.

Thanks again for all of the assistance.

Have a wonderful holiday!

Reply

Answer 14

Dec 17, 2005 5:45 PM in response to Bertrand Biritz

If I understand correctly, PowerBook G4 (15-inch 1.67/1.5GHz) introduced in Jan 2005 has shipped with Mac OS X 10.3.7 or 10.4 installed.

You cannot normally use a Mac OS X version earlier than the one included with the computer. Also see " Don't install older versions of Mac OS than what comes with your computer." -- A retail version of the Tiger install disc vs your computer came with Mac OS X 10.4.

If that is not the case and though a boot up time obliviously so slow, I would suggest to report AppleCare or technical support for further assistance about the incident with a full troubleshooting you've done.

Best wishes to your holiday season!

Reply

Answer 15

Dec 21, 2005 4:08 AM in response to Bertrand Biritz

Cisco VPN Client 4.8 update has released about a week ago.

Check it out if you're using an earlier version.

Reply