samba - Sep 2008 - smbstatus - switched off computers are sometimes showed

I have a Samba server configured as PDC for ~100 computers. It's version 
3.0.24 running on Debian Etch (distribution package).

I want to write a tool for user logon/logoff tracking. Because parsing 
log files is hard job (windows frequently disconnets or connects during 
user session or etc.) I decide to use smbstatus output which seem to be 
reliable.

So I run smbstatus binary every 10 seconds, parse the output and all is 
fine. But sometimes in the smbstatus output is show computer which is 
several hours switched off. At the next run (after 10s) this record is 
not presented. Sometimes this "ghost" record is shown for ~30 seconds.

Example:

11:10:21 - MACHINE1/USER1 - is in smbstatus
... constantly is in smbstatus
12:14:11 - MACHINE1/USER1 - is NOT in smbstatus
12:15:21 - MACHINE1/USER2 - is in smbstatus
...
12:45:31 - MACHINE1/USER2 - is NOT in smbstatus
Now the MACHINE1 is switched off.
18:16:21 - MACHINE1/USER1 - is in smbstatus !! (and the MACHINE1 is 
switched off several hours!)
18:16:31 - MACHINE1/USER1 - is NOT in smbstatus

Sometimes (cca twice a day) smbstatus return error output like this:
  tdb(/var/run/samba/sessionid.tdb): rec_read bad magic 0xd9fee666 at 
offset=116988

It's a bug or a feature and smbstatus is only informative? It's solved 
in some newer version? Can you tell me about better source for connected 
user status?

Thanks.

Vlastimil ?etka wrote:
> 
> Sometimes (cca twice a day) smbstatus return error output like this:
>  tdb(/var/run/samba/sessionid.tdb): rec_read bad magic 0xd9fee666 at
> offset=116988
It looks like you have an issue with a record.  Stop your service for a
moment, go in and cp your files in /var/run/samba to a new directory,
say to /var/run/samba.backup, then go into /var/run/samba and do this:

tdbbackup -sbak *.tdb
tdbbackup -v -sbak

...then start Samba.  The first makes a backup of your tdb tables; the
second verifies (and restores if needed) your tdb records.  This is
safe, but if there was any issue, you can always restore your files from
the copy in /var/run/samba.backup that you made.
> It's a bug or a feature and smbstatus is only informative? It's
solved
> in some newer version? Can you tell me about better source for connected
> user status?
On RHEL52 here and just moved up to 3.0.28 as part of an update from
stock RHEL50.  Significant difference in stability and behavior from the
stock 3.0.25b.  Twice-a-week locking issues have just "disappeared"
and
using the Computer Management tool attached to the Samba server shows
actual files open instead of "ghost files".

Does "apt-get update && apt-get upgrade" show any entries for
Samba?

On Fri, Sep 19, 2008 at 10:02:02PM +0200, Vlastimil ?etka
wrote:
> I have a Samba server configured as PDC for ~100 computers. It's
version
> 3.0.24 running on Debian Etch (distribution package).
> 
> I want to write a tool for user logon/logoff tracking. Because parsing 
> log files is hard job (windows frequently disconnets or connects during 
> user session or etc.) I decide to use smbstatus output which seem to be 
> reliable.
> 
> So I run smbstatus binary every 10 seconds, parse the output and all is 
> fine. But sometimes in the smbstatus output is show computer which is 
> several hours switched off. At the next run (after 10s) this record is 
> not presented. Sometimes this "ghost" record is shown for ~30
seconds.
Does that smbd still exist? If computers are just switched
off then Samba might not notice.
> Example:
> 
> 11:10:21 - MACHINE1/USER1 - is in smbstatus
> ... constantly is in smbstatus
> 12:14:11 - MACHINE1/USER1 - is NOT in smbstatus
> 12:15:21 - MACHINE1/USER2 - is in smbstatus
> ...
> 12:45:31 - MACHINE1/USER2 - is NOT in smbstatus
> Now the MACHINE1 is switched off.
> 18:16:21 - MACHINE1/USER1 - is in smbstatus !! (and the MACHINE1 is 
> switched off several hours!)
> 18:16:31 - MACHINE1/USER1 - is NOT in smbstatus
> 
> Sometimes (cca twice a day) smbstatus return error output like this:
>  tdb(/var/run/samba/sessionid.tdb): rec_read bad magic 0xd9fee666 at 
> offset=116988
This is normal. Smbstatus reads the tdb files in read-only
mode. This implies no locking which in turn might lead to
smbstatus reading an inconsistent tdb file.

Volker
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url :
http://lists.samba.org/archive/samba/attachments/20080920/3e857c21/attachment.bin