hi,
today I saw our File-Server was crashed and in the message log I found this:
Feb 22 07:59:54 file-server smbd_audit[32593]: close fd 27
Feb 22 08:00:01 file-server smbd_audit[32593]: close fd 36
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@zystkie
wyst?pienia /usr/lib/X11/fonts/CID.
Extended_description-pt.utf-8: O caminho do local dos tipos de letra
TrueType e CID geridos por defoma foram modificados novamente. Por
favor adicione estas entradas ? sec??o "Files" do ficheiro
/etc/X11/xorg.conf:\n\n FontPath
"/var/lib/defoma/x-ttcidfont-conf.d/dirs/CID"\n FontPath
"/var/lib/defoma/x-ttcidfont-conf.d/dirs/TrueType"\n\n\nAdicione
tamb?m estes dois direct?rios ?s listas de caminho "catalogue" em
/etc/X11/fs/config?e/ou?/etc/X11/fs-xtt/config, e apague qualquer
men??o de qualquer destes ficheiros em /usr/lib/X11/fonts/CID.
Extended_description-pt_br.utf-8: Os caminhos para fontes TrueType e
CID, os quais s?o gerenciados pelo defoma, mudaram novamente. Por
favor, adicione estas entradas a se??o "Files" do arquivo
/etc/X11/xorg.conf :\n\n FontPath
"/var/lib/defoma/x-ttcidfont-conf.d/dirs/CID"\n FontPath
"/var/lib/defoma/x-ttcidfont-conf.d/dirs/TrueType"\n\n\nAdicione
tamb?m estes dois diret?rios ?s listas de caminhos "catalogue" em
/etc/X11/fs/config e/ou /etc/X11/fs-xtt/config e remova qualquer
men??o do diret?rio /usr/lib/X11/fonts/CID em ambos os arquivos.
Extended_description-ru.utf-8: ???? ? ????? ??????? TrueType ? CID,
??????????? ????? defoma ????? ??????????. ???????? ????????? ?????? ?
?????? "Files" ????? /etc/X11/xorg.conf:\n\n FontPath
"/var/lib/defoma/x-ttcidfont-conf.d/dirs/CID"\n FontPath
"/var/lib/defoma/x-ttcidfont-conf.d/dirs/TrueType"\n\n\n????? ????????
??? ??? ???????? ? ?????? ????? "catalogue" ? ??????
/etc/X11/fs/config ?/??? /etc/X11/fs-xtt/config ? ??????? ??? ????????
?? /usr/lib/X11/fonts/CID ?? ???? ???? ??????.
So, this is reproduceible as I listed an specific directory.
As you can see, I've activated the samba audit and our samba version
is: 3.5.12-SerNet-Debian on Debian 6.0.4
Can someone explain me that and how we could avoid this?
Thanks.
Greetings, Bj?rn
