samba - Sep 2022 - High cpu load on LDAP

hello,
I often have the problem of high load on the LDAP processes.
1-3 LDAP processes cause 100% cpu load for approx. 10 sec. This happens
regularly in intervals of 2-3 minutes.
How can I find out which client is causing this load and why?
How can I configure the logging to see who/what is causing the LDAP
process?
We have about 5000 users, 4000 clients in our AD with 4 DCs with Samba
4.16.4.

thanks


regards,
Heinz


smb.conf:
# Global parameters
[global]
	bind interfaces only = Yes
	interfaces = lo ens3
	netbios name = DC1
	realm = XXXX.NET
	workgroup = XXXX
	server role = active directory domain controller
	idmap_ldb:use rfc2307 = yes
	comment = 
	template homedir = /home/%U
 	template shell = /bin/bash
	ldap server require strong auth = No
	ntlm auth = Yes 
        log level = auth_json_audit:0 auth_audit:3
	logging = syslog
	password hash gpg key ids = "4FE6CFC510ADE7B9"
	dns forwarder = 192.168.0.1
	dns update command = /usr/local/samba/sbin/samba_dnsupdate --
use-samba-tool
	logon script = login.bat

On Mon, 2022-09-19 at 14:04 +0000, Heinz H?lzl via samba
wrote:
> hello,
> I often have the problem of high load on the LDAP processes.
> 1-3 LDAP processes cause 100% cpu load for approx. 10 sec. This
> happens
> regularly in intervals of 2-3 minutes.
> How can I find out which client is causing this load and why?
> How can I configure the logging to see who/what is causing the LDAP
> process?
> We have about 5000 users, 4000 clients in our AD with 4 DCs with
> Samba
> 4.16.4.
> 
> thanks

I would also note the similarity with this other post on the mailing
list.

If this is the same issue, the sockets to the client would be stuck in
CLOSE_WAIT.

https://lists.samba.org/archive/samba/2022-September/241873.html

Can you, on the instance with the high-cpu use, at the time it is in
that state, run (matching the commands our mailing list user has run):

Work out which PIDs are high CPU use:

netstat -avp | grep <PID>

gdb -p <PID>
bt full

strace -p <PID>

as well as a FlameGraph: 
https://www.brendangregg.com/FlameGraphs/cpuflamegraphs.html#Instructions

I would love to get to the bottom of this.
Andrew Bartlett


-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions