Hello, Although I've been using samba for years at my customers office, I recently moved one on a HP E60 server running RedHat 6.2. The samba version is 2.0.6, untouched from the distribution. They use a (weird) accounting software built on the top of FoxPro, requiring a *huge* amount of open files. I accordingly raised the values for files-nr and inode-nr and the stats seem ok. They have many times a day failure from their software, telling them it cannot open a file (random name) on the file server. So I set debug level to 3, to try to see what's going on and told them to phone immediatly and stop working as soon as the symptom shows again. I then wandered through the logs and found thing that seem strange to me: in the log.machine, I find at the same timestamp close requests, followed by two line of the form: [timestamp]lib/doscalls.c:dos_ChDir(336) dos_ChDir to /var/sauvegarde [timestamp]connexion closed for user compta and then a reconnection to the same user, at the same timestamp. I don't understand the reason of the deconnection, and the dos_ChDir call, as neitheir the client nor samba knows anything about the /var/sauvegarde directory, which I use to store backup locks. Beside this, at the very same time, I find in /var/message the line [timestamp]PAM_pwdb: (login) authentication failure; (uid 0) -> compta for samba service which I cannot neither explain. The client is a Windows 98, with registry patched to allow plain text passwords (closed private network), and smb.conf is not set to allow crypted passwords. Does any of you, gurus, could tell me what's going wrong, or in which direction should I continue searching to get more interesting stuff ? I thank you for your time and help, Fran?ois D?sarm?nien PS: could you please CC to me, as I'm not (currently) signed up on the list ?
Fran?ois D?sarm?nien wrote:
| in the log.machine, I find at the same timestamp close requests,
| followed by two line of the form:
| [timestamp]lib/doscalls.c:dos_ChDir(336) dos_ChDir to
/var/sauvegarde
| [timestamp]connexion closed for user compta
| and then a reconnection to the same user, at the same timestamp.
Hmmn, people seem to be reporting that a lot these days...
Normally it indicates one of
- an error on the client
- the client timing out
- an error seen by the client
One commentator had a bad hub, another only saw
it on a particular machine, others didn'd see
anything unique that might cause it...
Can you look at your net with a snooper (eg, etherial,
tcpdump) and look for suspicious packets just before the
disconnection? The chap with the bad hub was seeing (if
memory serves) truncated packets.
| [timestamp]PAM_pwdb: (login) authentication failure;
(uid 0) -> compta for samba service
This look like a normal failure reported by the pam module
--dave
--
David Collier-Brown, | Always do right. This will gratify some people
185 Ellerslie Ave., | and astonish the rest. -- Mark Twain
Willowdale, Ontario | //www.oreilly.com/catalog/samba/author.html
Work: (905) 415-2849 Home: (416) 223-8968 Email: davecb@canada.sun.com
David Collier-Brown wrote:> > Fran?ois D?sarm?nien wrote: > | in the log.machine, I find at the same timestamp close requests, > | followed by two line of the form: > | [timestamp]lib/doscalls.c:dos_ChDir(336) dos_ChDir to > /var/sauvegarde > | [timestamp]connexion closed for user compta > | and then a reconnection to the same user, at the same timestamp. > > Hmmn, people seem to be reporting that a lot these days... > Normally it indicates one of > - an error on the client > - the client timing out > - an error seen by the client > One commentator had a bad hub, another only saw > it on a particular machine, others didn'd see > anything unique that might cause it... >I thought of that, of course. Well, if "people seem to be reporting that a lot these days", I'll first try to downgrade to 2.0.5a, which I have running without trouble on many sites.> Can you look at your net with a snooper (eg, etherial, > tcpdump) and look for suspicious packets just before the > disconnection? The chap with the bad hub was seeing (if > memory serves) truncated packets.Yes, this will be the second try, as it is *much* more time (and disk:) consuming. I've been hurt with a bad hub one day, this can effectively leads to strange phenomenon...> > | [timestamp]PAM_pwdb: (login) authentication failure; > (uid 0) -> compta for samba service > > This look like a normal failure reported by the pam module >Except that nobody's trying to conect on 'compta' account, and it is the samba account the wind'oz client's trying to reconnect... And the dos_ChDir to /var/sauvegarde really puzzles me :-o Many thanks for your time and answer, Fran?ois