Ubuntu启动任何应用慢(2~4秒)排查和分析

Ubuntu 24.04在IT刚安装完成的时候，启动应用的速度还是很快的，但是不久之后（中间有几次重启），打开一个网络链接居然要2 ~ 3秒后才会在浏览器打开标签页，不仅如此，打开VS Code、甚至文件应用居然也会卡个几秒！

通过htop、iotop等性能工具检查发现资源使用正常，未有异常的情况发生。头几天我还忍受着它继续使用，但是后面打开JIRA速度实在太慢了，而且点击链接后不立刻打开，我还以为没点到呢。

后面决定从打开应用这个过程入手。

调查VS Code耗时情况

strace -T -tt -o app_start.log code

在终端里执行在终端里执行这个指令后，发现在wait4和后面流程中介隔了1.5秒，可能一开始觉得是不是wait这里的问题，但是这里无法继续进一步分析了，没有子线程信息。加上-f后虽然有子线程信息，但是什么都分析不出来，时间分布都很均匀。

16:05:43.705640 rt_sigprocmask(SIG_SETMASK, [], ~[KILL STOP RTMIN RT_1], 8) = 0 <0.000111>
16:05:43.705946 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 8158 <1.666915>
16:05:45.372907 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=8158, si_uid=1000, si_status=0, si_utime=10 /* 0.10 s */, si_stime=2 /* 0.02 s */} ---
16:05:45.372928 rt_sigreturn({mask=[]}) = 8158 <0.000004>

调查文件应用(nautilus)耗时情况

strace -T -tt -o app_start.log nautilus

16:23:00.733757 execve("/usr/bin/nautilus", ["nautilus"], 0x7ffc22136850 /* 64 vars */) = 0 <0.015157>
16:23:00.749211 brk(NULL)               = 0x58c3c2f93000 <0.000007>
16:23:00.749272 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x700ff818f000 <0.000009>
16:23:00.749310 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (没有那个文件或目录) <0.000008>
16:23:00.750031 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 <0.000139>
16:23:00.750205 fstat(3, {st_mode=S_IFREG|0644, st_size=67811, ...}) = 0 <0.000006>
16:23:00.750243 mmap(NULL, 67811, PROT_READ, MAP_PRIVATE, 3, 0) = 0x700ff817e000 <0.000009>
16:23:00.750271 close(3)                = 0 <0.000007>
16:23:00.750304 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libnautilus-extension.so.4", O_RDONLY|O_CLOEXEC) = 3 <0.000663>
16:23:00.750989 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000007>
16:23:00.751018 fstat(3, {st_mode=S_IFREG|0644, st_size=43080, ...}) = 0 <0.000007>
16:23:00.751047 mmap(NULL, 45256, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x700ff8172000 <0.000009>
16:23:00.751075 mmap(0x700ff8175000, 16384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x700ff8175000 <0.000653>
16:23:00.751748 mmap(0x700ff8179000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x700ff8179000 <0.000010>
16:23:00.751778 mmap(0x700ff817c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9000) = 0x700ff817c000 <0.000009>
16:23:00.751855 close(3)                = 0 <0.000060>
16:23:00.751941 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libglib-2.0.so.0", O_RDONLY|O_CLOEXEC) = 3 <0.011707>
16:23:00.763739 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000066>
16:23:00.763878 fstat(3, {st_mode=S_IFREG|0644, st_size=1343056, ...}) = 0 <0.000074>
16:23:00.764038 mmap(NULL, 1343960, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x700ff8029000 <0.000067>
16:23:00.764125 mmap(0x700ff8047000, 655360, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e000) = 0x700ff8047000 <0.012345>
16:23:00.776499 mmap(0x700ff80e7000, 557056, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xbe000) = 0x700ff80e7000 <0.000011>
16:23:00.776535 mmap(0x700ff816f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x146000) = 0x700ff816f000 <0.000011>
16:23:00.776571 mmap(0x700ff8171000, 472, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x700ff8171000 <0.000008>
16:23:00.776604 close(3)                = 0 <0.000008>
16:23:00.776633 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgtk-4.so.1", O_RDONLY|O_CLOEXEC) = 3 <0.103462>
16:23:00.880148 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000008>
16:23:00.880221 fstat(3, {st_mode=S_IFREG|0644, st_size=11789432, ...}) = 0 <0.000006>
16:23:00.880259 mmap(NULL, 11823696, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x700ff7400000 <0.000017>
 16:23:00.880298 mmap(0x700ff74b0000, 4825088, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb0000) = 0x700ff74b0000 <0.107914>
16:23:00.988278 mmap(0x700ff794a000, 4374528, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x54a000) = 0x700ff794a000 <0.000069>
16:23:00.988518 mmap(0x700ff7d76000, 1871872, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x975000) = 0x700ff7d76000 <0.000079>
16:23:00.988685 mmap(0x700ff7f3f000, 31312, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x700ff7f3f000 <0.000011>
16:23:00.988781 close(3)                = 0 <0.000011>
16:23:00.988894 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpango-1.0.so.0", O_RDONLY|O_CLOEXEC) = 3 <0.004662>
16:23:00.993596 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000007>
16:23:00.993630 fstat(3, {st_mode=S_IFREG|0644, st_size=433912, ...}) = 0 <0.000006>
16:23:00.993659 mmap(NULL, 436800, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x700ff7fbe000 <0.000011>
16:23:00.993689 mmap(0x700ff7fd1000, 233472, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x13000) = 0x700ff7fd1000 <0.004579>
16:23:00.998308 mmap(0x700ff800a000, 106496, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4c000) = 0x700ff800a000 <0.000011>
16:23:00.998342 mmap(0x700ff8024000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x65000) = 0x700ff8024000 <0.000010>
16:23:00.998381 close(3)                = 0 <0.000008>
16:23:00.998410 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0", O_RDONLY|O_CLOEXEC) = 3 <0.002237>
16:23:01.000739 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000059>
16:23:01.000877 fstat(3, {st_mode=S_IFREG|0644, st_size=186744, ...}) = 0 <0.000064>
16:23:01.000963 mmap(NULL, 184808, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x700ff7f90000 <0.000013>
16:23:01.000996 mmap(0x700ff7f98000, 110592, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8000) = 0x700ff7f98000 <0.002262>
16:23:01.003279 mmap(0x700ff7fb3000, 36864, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x23000) = 0x700ff7fb3000 <0.000011>
16:23:01.003313 mmap(0x700ff7fbc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2c000) = 0x700ff7fbc000 <0.000021>
16:23:01.003366 close(3)                = 0 <0.000008>
16:23:01.003396 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libcairo.so.2", O_RDONLY|O_CLOEXEC) = 3 <0.010916>
16:23:01.014341 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000008>
16:23:01.014371 fstat(3, {st_mode=S_IFREG|0644, st_size=1321832, ...}) = 0 <0.000009>
16:23:01.014402 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x700ff7f8e000 <0.000010>
16:23:01.014435 mmap(NULL, 1325864, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x700ff72bc000 <0.000012>
16:23:01.014466 mmap(0x700ff72d0000, 987136, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14000) = 0x700ff72d0000 <0.011395>
16:23:01.025884 mmap(0x700ff73c1000, 229376, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x105000) = 0x700ff73c1000 <0.000012>
16:23:01.025917 mmap(0x700ff73f9000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x13d000) = 0x700ff73f9000 <0.000010>
16:23:01.025952 mmap(0x700ff73ff000, 2856, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x700ff73ff000 <0.000008>
16:23:01.025987 close(3)                = 0 <0.000008>
16:23:01.026016 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgraphene-1.0.so.0", O_RDONLY|O_CLOEXEC) = 3 <0.001234>
16:23:01.027273 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000007>
16:23:01.027303 fstat(3, {st_mode=S_IFREG|0644, st_size=116728, ...}) = 0 <0.000007>
16:23:01.027332 mmap(NULL, 119528, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x700ff7f70000 <0.000009>
16:23:01.027359 mmap(0x700ff7f78000, 61440, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8000) = 0x700ff7f78000 <0.001267>
16:23:01.028645 mmap(0x700ff7f87000, 20480, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17000) = 0x700ff7f87000 <0.000010>
16:23:01.028674 mmap(0x700ff7f8c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b000) = 0x700ff7f8c000 <0.000009>
16:23:01.028710 close(3)                = 0 <0.000007>
16:23:01.028736 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgio-2.0.so.0", O_RDONLY|O_CLOEXEC) = 3 <0.018699>
16:23:01.047474 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000009>
16:23:01.047511 fstat(3, {st_mode=S_IFREG|0644, st_size=1887792, ...}) = 0 <0.000009>
16:23:01.047546 mmap(NULL, 1897376, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x700ff70ec000 <0.000063>
16:23:01.047636 mmap(0x700ff7125000, 1142784, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x39000) = 0x700ff7125000 <0.019681>
16:23:01.067367 mmap(0x700ff723c000, 479232, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x150000) = 0x700ff723c000 <0.000012>
16:23:01.067406 mmap(0x700ff72b1000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1c4000) = 0x700ff72b1000 <0.000011>
16:23:01.067535 mmap(0x700ff72ba000, 5024, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x700ff72ba000 <0.000009>
16:23:01.067583 close(3)                = 0 <0.000008>
16:23:01.067616 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgobject-2.0.so.0", O_RDONLY|O_CLOEXEC) = 3 <0.003906>
16:23:01.071555 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000007>
16:23:01.071590 fstat(3, {st_mode=S_IFREG|0644, st_size=399752, ...}) = 0 <0.000007>
16:23:01.071623 mmap(NULL, 404536, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x700ff7089000 <0.000012>
16:23:01.071654 mmap(0x700ff7098000, 225280, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf000) = 0x700ff7098000 <0.004280>
16:23:01.075957 mmap(0x700ff70cf000, 102400, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x46000) = 0x700ff70cf000 <0.000010>
16:23:01.075986 mmap(0x700ff70e8000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5e000) = 0x700ff70e8000 <0.000009>
16:23:01.076030 close(3)                = 0 <0.000007>
...
16:23:01.901236 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libicudata.so.74", O_RDONLY|O_CLOEXEC) = 3 <0.250986>
16:23:02.152390 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000107>
...

可以看到加载so库（libicudata.so.74）的时候，时间都比正常要长很多（250 毫秒），其他的库也加载了有几十毫秒，着显然是不正常的！

从日志看，有什么东西让整个系统和openat相关的操作都变慢了！

后来突然想起htop的时候有注意到一个奇怪的程序可能和会影响到这块（就像Windows自带的杀毒软件一样） ------ eset。

eset是一个杀毒软件，它在Windows上不至于造成这么严重的性能衰退，至少比Windows自带的杀毒软件每次都要扫描所有相关文件的内容好很多，所以也只是怀疑而已，于是我们现在就来开始试试关闭eset后看看效果如何。

找到罪魁祸首 ESET

执行下面的指令后，在打开文件应用、VS Code和其他各种应用，全部都秒开了... 我连strace都不需要再使用了，也不需要继续排查了。原来罪魁祸首是ESET... 没想到它和Windows上的完全不一样，它居然在Linux上也要扫描所有的文件......

sudo systemctl stop efs.service