Web lists-archives.com

Re: [Samba] Troubleshooting high CPU load

Hi Mark,

I'm investigating high CPU load on a domain member server (file server)
after an upgrade from 4.5.5 to 4.6.2. The problem continued after a
subsequent upgrade to 4.6.7.

I turned up the log level to 3 for a short time and looked at the logs. One
thing I notice is some entries like this:

[2018/01/24 18:28:37.933498,  3]
  get_user_from_kerberos_info: Username STA\I7X4-42G-12$ is invalid on this
[2018/01/24 18:28:37.933525,  3]
  auth3_generate_session_info_pac: Failed to map kerberos principal to
[2018/01/24 18:28:37.933582,  3]
  smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1]
status[NT_STATUS_ACCESS_DENIED] || at ../source3/smbd/smb2_sesssetup.c:134
[2018/01/24 18:28:37.934058,  2]
  STA\jimenez closed file 2017dwgs/17020/Revit/633 Folsom
Street_TSE_Struct_backup/_contents.2154.dat (numopen=504) NT_STATUS_OK
[2018/01/24 18:28:37.934320,  3]
[2018/01/24 18:28:37.934340,  3] ../source3/smbd/dir.c:656(dptr_create)

The name  STA\I7X4-42G-12$ is a machine name. Is this one of those normal
and expected error messages or does it indicate a problem?

Computer accounts are mostly like user accounts, and it can be used to connect to network shares. For example workstation computer account is used to connect to SYSVOL share to download GPO at machine startup.

It is uncommon to have a workstation connect to a fileserver, although there are some use cases. If my memory is right, the server is configured with rfc2307, so it get uidnumber and gidnumber from LDAP tree, and there is probably no uidnumber on workstation accounts.

One option is to add uidnumber/gidnumber to workstations to avoid this error message, or to switch to rid mapping (but you'll need to remap ACL on network shares). But anyway, like I said before, there is probably no use for you workstation to connect to the server, so you may have to check why it is doing that.

For the high load, I don't know if it is linked to that. If the query non resolving query is coming in all the time, it may be usefull to add some negative cache time on winbind.



When I run "wbinfo -i" it returns valid info for domain users. Is it
supposed to do the same for machine accounts?

If this is a red herring, do you have any suggestions on how to proceed?

Denis Cardon
Tranquil IT Systems
Les Espaces Jules Verne, bâtiment A
12 avenue Jules Verne
44230 Saint Sébastien sur Loire
tel : +33 (0)

To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba