OK I have a similar conclusion to Darren, though slightly different profiling mechanism (NB slow login can still occur in Yosemite).
Here's a way to tell what is actually running when you start a new login window, using the OS X sample profiler command.
Find out what command a normal login executs
$ ps -ef | grep login
You'll seee something like login -pfl username /bin/bash -c exec -la bash /bin/bash
Create a script file name profile_login.sh
with the following contents by adding a
-c ""
to the end of the discovered command to request that bash return immediately, with contents like this:
login -pfl username /bin/bash -c exec -la bash /bin/bash -c "" &
sudo sample $! -mayDie # sample the above command
Make it executable
$ chmod u+x profile_login.sh
and run it using sudo (sample
command requires it)
$ sudo ./profile_login.sh
OK so go ahead and run it. For instance by executing the purge
command first. On my box, I got a large output graph. Looking for the "biggest numbered branches" (typically at the top) I saw the following two biggest offenders:
One from something called pam_start
which appears to opening pam auth lib images
+ ! 1068 pam_start (in libpam.2.dylib) + 132 [0x7fff97295ab0]
+ ! : 1066 openpam_dynamic (in libpam.2.dylib) + 120 [0x7fff97293d14]
+ ! : | + ! 1042 coresymbolication_load_image(CSCppDyldSharedMemoryPage*, ImageLoader const*, unsigned long long) (in dyld) + 143 [0x7fff66725411]
+ ! : | + ! : 1042 mach_msg_trap (in dyld) + 10 [0x7fff6674a472]
and that is sometimes followed by another offender getlastlogxbyname
+ ! 583 getlastlogxbyname (in libsystem_c.dylib) + 212 [0x7fff92b3ef7a]
+ ! : 566 asl_file_open_read (in libsystem_asl.dylib) + 143 [0x7fff8c27030d]
+ ! : | 566 __open_nocancel (in libsystem_kernel.dylib) + 10 [0x7fff97b39012] + ! : | 566 __open_nocancel (in libsystem_kernel.dylib) + 10 [0x7fff97b39012]
So basically, there are two offenders. One is pam
(some type of authentication system) and the other it the asl
"detect your latest login" stuff. So apparently just deleting your /private/var/log/asl/*.asl
files is not enough. The pam loading is much more expensive on my machine, anyway [SSD]. Feel free to run the above script and see if your system is the same. Interestingly, the source code for these method calls seems to also be available online, for instance openpam_dynamic
If I follow Darren's answer, and replace my "shells open with" preference to something other than /bin/bash, I then see the following lines used to start new terminal tabs:
$ ps -ef | grep login
... login -pfql packrd /bin/bash -c exec -la bash /usr/bin/bash
So if I now use the same sample
trick on the new login command
login -pfql username /bin/bash -c exec -la bash /usr/bin/bash -c "" &
sudo sample $! -mayDie
a much smaller stacktrace is generated, the biggest offender being:
+ 8 pam_end (in libpam.2.dylib) + 190 [0x7fff97294ebb]
+ ! 6 coresymbolication_unload_image(CSCppDyldSharedMemoryPage*, ImageLoader const*) (in dyld) + 143 [0x7fff6e0f634f]
I think this is because the login "-q" parameter is now being used. Apparently this parameter skips both loading the pam modules and looking up the last login time (both offenders). According to the docs of the login
command, touching the ~/.hushlogin
file should do the same thing, but apparently this no longer works [at least for me with 10.10].
So, in summary, removing /private/var/log/asl/*.asl is not enough (in my experiment, it only accounted for at most 1/3 of the actual slowdown, though if you had mores files there it could account for a greater percentage I'm sure).
Anyway using similar scripts, you should be able to tell what's causing your local machine to bog down, and see if the above fix applies to you. Feel free to comment here.
UPDATE: seems that coresymbolication_load_image
can still take tons of time, even when login -pfql
is invoked (presumably some pam authentication module or other is having to "dial out" to a central login server or some odd, so has to wait for a response from a 3rd party). So the only real workaround I have found is to use iTerm2, and change the preferences -> profiles -> general -> Command to /bin/bash
instead.
.bash_profile
(also check~/.profile
by the way). Also: note you can start typing while bash is loading, and usually what you type will be copied to the command prompt once it's ready.$(brew --prefix coreutils)
to append to the $PATH. This normally takes a second or so, but quite often would take up to 30 seconds for no apparent reason. I replaced this bit with a manually resolved path (/usr/local/opt/coreutils/libexec/gnubin
) and have not had a problem since