samba - Sep 2001 - Winbind slowing down entire system

Hello people,

Ok, I am only testing my system yet, so I update the SAMBA_2_2 cvs sources
frequently. That was what I did today, updated as usual, but now I noticed
winbind is slowing down the entire system while active.

A simple lpd restart after making changes to the printers takes minutes.
Opening a terminal window in X server takes more than 10 seconds. If I shut
down the winbind process, everything comes back to normal.

Looking at the systems active processes, I notice winbind is taking usually
10-15% CPU and 20% memory (it's a PIII 733 with 512 Mb RAM) while doing
anything in the system. After the process finishes (lpd restart for
example), winbind goes back to the normal sleep state.

Tha samba side: accessing shares looks as fast as usual, but opening or
making changes to printer properties also takes ages.

Also, I noticed logging into the server with a telnet session takes several
seconds (using a local unix account). And it wasn't like that, some recent
changes in the sources made that difference.

System is Red Hat Linux 7.1, 2.4.3 kernel. I didn't make any changes to pam
files as I don't need domain users accessing unix services. In
nsswitch.conf, the passwd and group lines are 'files winbind'.

Any clues?

cheers
Gustavo

A little follow up

Right now my winbind process is taking 50% of system memory and going
higher.

  PID USER     PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME COMMAND
25937 root      16   0  266M 266M  1036 R    10.3 53.1   0:56 winbindd

Weird...

cheers
Gustavo
> -----Original Message-----
> From: Michels, Gustavo [EES/BR] 
> Sent: segunda-feira, 24 de setembro de 2001 14:17
> To: samba@lists.samba.org
> Subject: Winbind slowing down entire system
> 
> 
> Hello people,
> 
> Ok, I am only testing my system yet, so I update the 
> SAMBA_2_2 cvs sources
> frequently. That was what I did today, updated as usual, but 
> now I noticed
> winbind is slowing down the entire system while active.
> 
> A simple lpd restart after making changes to the printers 
> takes minutes.
> Opening a terminal window in X server takes more than 10 
> seconds. If I shut
> down the winbind process, everything comes back to normal.
> 
> Looking at the systems active processes, I notice winbind is 
> taking usually
> 10-15% CPU and 20% memory (it's a PIII 733 with 512 Mb RAM) 
> while doing
> anything in the system. After the process finishes (lpd restart for
> example), winbind goes back to the normal sleep state.
> 
> Tha samba side: accessing shares looks as fast as usual, but 
> opening or
> making changes to printer properties also takes ages.
> 
> Also, I noticed logging into the server with a telnet session 
> takes several
> seconds (using a local unix account). And it wasn't like 
> that, some recent
> changes in the sources made that difference.
> 
> System is Red Hat Linux 7.1, 2.4.3 kernel. I didn't make any 
> changes to pam
> files as I don't need domain users accessing unix services. In
> nsswitch.conf, the passwd and group lines are 'files winbind'.
> 
> Any clues?
> 
> cheers
> Gustavo
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  http://lists.samba.org/mailman/listinfo/samba
>

I have had the same trouble.  I traced it to login getting group
information.  When trying to find out what groups a user belongs to, login
gets a list of _all_ the groups the system is aware of.  On a domain with
12000 users and 14000 groups, it was taking 1 minute or more to come back
and sometimes the login session would timeout.  I was unable to find a
solution, but you can check to see if this is really the case for you by
taking winbind out of the group line of your nsswitch.conf file and
restarting inetd.  If the pause is gone when you telnet in, then you are
having the same problem I was.

Good luck,
Cary
> -----Original Message-----
> From: Michels, Gustavo [EES/BR]
> [mailto:gustavo.michels@emersonenergy.com]
> Sent: Monday, September 24, 2001 11:17 AM
> To: samba@lists.samba.org
> Subject: Winbind slowing down entire system
> 
> 
> Hello people,
> 
> Ok, I am only testing my system yet, so I update the 
> SAMBA_2_2 cvs sources
> frequently. That was what I did today, updated as usual, but 
> now I noticed
> winbind is slowing down the entire system while active.
> 
> A simple lpd restart after making changes to the printers 
> takes minutes.
> Opening a terminal window in X server takes more than 10 
> seconds. If I shut
> down the winbind process, everything comes back to normal.
> 
> Looking at the systems active processes, I notice winbind is 
> taking usually
> 10-15% CPU and 20% memory (it's a PIII 733 with 512 Mb RAM) 
> while doing
> anything in the system. After the process finishes (lpd restart for
> example), winbind goes back to the normal sleep state.
> 
> Tha samba side: accessing shares looks as fast as usual, but 
> opening or
> making changes to printer properties also takes ages.
> 
> Also, I noticed logging into the server with a telnet session 
> takes several
> seconds (using a local unix account). And it wasn't like 
> that, some recent
> changes in the sources made that difference.
> 
> System is Red Hat Linux 7.1, 2.4.3 kernel. I didn't make any 
> changes to pam
> files as I don't need domain users accessing unix services. In
> nsswitch.conf, the passwd and group lines are 'files winbind'.
> 
> Any clues?
> 
> cheers
> Gustavo
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  http://lists.samba.org/mailman/listinfo/samba
>

Hi, :-)

Taking winbind out of the group line in nsswitch.conf really wiped away the
pause while I was telnetting in. But the problem is I need domain groups
because my share's security are set by domain group membership.

So, I must find other solution... :-( This is really strange as last friday
my server wasn't like this, only with this new cvs sources this slowdown
started. Actually, the telnet delay was present (although there wasn't a
delay, let's say, with 2 weeks ago sources), but winbind wasn't eating
up
the whole system resources.

Thanks for the help, anyway.

cheers
Gustavo
> -----Original Message-----
> From: DICKENS,CARY (HP-Loveland,ex2) [mailto:cary_dickens2@hp.com]
> Sent: segunda-feira, 24 de setembro de 2001 15:47
> To: Michels, Gustavo [EES/BR]; samba@lists.samba.org
> Subject: RE: Winbind slowing down entire system
> 
> 
> I have had the same trouble.  I traced it to login getting group
> information.  When trying to find out what groups a user 
> belongs to, login
> gets a list of _all_ the groups the system is aware of.  On a 
> domain with
> 12000 users and 14000 groups, it was taking 1 minute or more 
> to come back
> and sometimes the login session would timeout.  I was unable to find a
> solution, but you can check to see if this is really the case 
> for you by
> taking winbind out of the group line of your nsswitch.conf file and
> restarting inetd.  If the pause is gone when you telnet in, 
> then you are
> having the same problem I was.
> 
> Good luck,
> Cary
> 
> > -----Original Message-----
> > From: Michels, Gustavo [EES/BR]
> > [mailto:gustavo.michels@emersonenergy.com]
> > Sent: Monday, September 24, 2001 11:17 AM
> > To: samba@lists.samba.org
> > Subject: Winbind slowing down entire system
> > 
> > 
> > Hello people,
> > 
> > Ok, I am only testing my system yet, so I update the 
> > SAMBA_2_2 cvs sources
> > frequently. That was what I did today, updated as usual, but 
> > now I noticed
> > winbind is slowing down the entire system while active.
> > 
> > A simple lpd restart after making changes to the printers 
> > takes minutes.
> > Opening a terminal window in X server takes more than 10 
> > seconds. If I shut
> > down the winbind process, everything comes back to normal.
> > 
> > Looking at the systems active processes, I notice winbind is 
> > taking usually
> > 10-15% CPU and 20% memory (it's a PIII 733 with 512 Mb RAM) 
> > while doing
> > anything in the system. After the process finishes (lpd restart for
> > example), winbind goes back to the normal sleep state.
> > 
> > Tha samba side: accessing shares looks as fast as usual, but 
> > opening or
> > making changes to printer properties also takes ages.
> > 
> > Also, I noticed logging into the server with a telnet session 
> > takes several
> > seconds (using a local unix account). And it wasn't like 
> > that, some recent
> > changes in the sources made that difference.
> > 
> > System is Red Hat Linux 7.1, 2.4.3 kernel. I didn't make any 
> > changes to pam
> > files as I don't need domain users accessing unix services. In
> > nsswitch.conf, the passwd and group lines are 'files winbind'.
> > 
> > Any clues?
> > 
> > cheers
> > Gustavo
> > 
> > -- 
> > To unsubscribe from this list go to the following URL and read the
> > instructions:  http://lists.samba.org/mailman/listinfo/samba
> > 
>

Hi,

I am currently testing with winbind enum users and groups set as no to see
memory consumption.

Winbind is really eating up everything here, even without many usage. The
test server is only acting as a time server for our resource domain users
(about 100 users) and is serving as a test print server for 3 clients, using
cups.

I restarted the server last night and this morning winbind was taking 70% of
the system memory (512 RAM and 512 swap total)

I still can't understand why it just started eating up the whole system...

cheers
Gustavo
> -----Original Message-----
> From: Anthony J. Breeds-Taurima [mailto:tony@cantech.net.au]
> Sent: ter?a-feira, 25 de setembro de 2001 23:50
> To: Michels, Gustavo [EES/BR]
> Cc: cary_dickens2@hp.com; samba@lists.samba.org
> Subject: RE: Winbind slowing down entire system
> 
> 
> On Mon, 24 Sep 2001, Michels, Gustavo [EES/BR] wrote:
> 
> > Taking winbind out of the group line in nsswitch.conf 
> really wiped away the
> > pause while I was telnetting in. But the problem is I need 
> domain groups
> > because my share's security are set by domain group membership.
> >
> > So, I must find other solution... :-( This is really 
> strange as last friday
> > my server wasn't like this, only with this new cvs sources 
> this slowdown
> > started. Actually, the telnet delay was present (although 
> there wasn't a
> > delay, let's say, with 2 weeks ago sources), but winbind 
> wasn't eating up
> > the whole system resources.
> 
> Hmm isn't this what "winbind enum users" is for.
> 
>        winbind enum users
>               On  large installations it may be necessary to sup-
>               press the enumeration of users through  the   setp-
>               went(),  getpwent()  and endpwent() group of system
>               calls. If  the  winbind  enum  users  parameter  is
>               false,  calls  to the getpwent system call will not
>               return any data.
> 
>               Warning: Turning off  user  enumeration  may  cause
>               some  programs  to  behave  oddly. For example, the
>               finger program relies on having access to the  full
>               user list when searching for matching usernames.
> 
>               Default: winbind enum users = yes
> 
> See if that helps.
> 
> Yours Tony.
> 
> /*
>  * "The significant problems we face cannot be solved at the
>  * same level of thinking we were at when we created them."
>  * --Albert Einstein
>  */
>

On Mon, 24 Sep 2001, DICKENS,CARY (HP-Loveland,ex2) wrote:
> I have had the same trouble.  I traced it to login getting group
> information.  When trying to find out what groups a user belongs to, login
> gets a list of _all_ the groups the system is aware of.  On a domain with
> 12000 users and 14000 groups, it was taking 1 minute or more to come back
Yup this would be a problem.  winbindd views all domain groups to
see which ones the user is a member of IIRC.

Tim, am I wrong?  Need to check the code.  We should probably
cache domain groups more.  Since a RID cannot be reused under NT
this is not a problem.  What do you think?











cheers, jerry
 ---------------------------------------------------------------------
 www.samba.org              SAMBA Team              jerry_at_samba.org
 www.plainjoe.org                                jerry_at_plainjoe.org
 --"I never saved anything for the swim back." Ethan Hawk in Gattaca--

Just a follow up:

Using winbind enum users and groups = no solved the problem. Winbind is
using 0.6% (3 Mb) of system memory for a while now. And that delay while
telnetting in also disappeared.

cheers
Gustavo
> -----Original Message-----
> From: Gerald Carter [mailto:gcarter@valinux.com]
> Sent: quarta-feira, 26 de setembro de 2001 10:48
> To: DICKENS,CARY (HP-Loveland,ex2)
> Cc: Michels, Gustavo [EES/BR]; samba@lists.samba.org; tpot@samba.org
> Subject: RE: Winbind slowing down entire system
> 
> 
> On Mon, 24 Sep 2001, DICKENS,CARY (HP-Loveland,ex2) wrote:
> 
> > I have had the same trouble.  I traced it to login getting group
> > information.  When trying to find out what groups a user 
> belongs to, login
> > gets a list of _all_ the groups the system is aware of.  On 
> a domain with
> > 12000 users and 14000 groups, it was taking 1 minute or 
> more to come back
> 
> Yup this would be a problem.  winbindd views all domain groups to
> see which ones the user is a member of IIRC.
> 
> Tim, am I wrong?  Need to check the code.  We should probably
> cache domain groups more.  Since a RID cannot be reused under NT
> this is not a problem.  What do you think?
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> cheers, jerry
>  ---------------------------------------------------------------------
>  www.samba.org              SAMBA Team              jerry_at_samba.org
>  www.plainjoe.org                                jerry_at_plainjoe.org
>  --"I never saved anything for the swim back." Ethan Hawk in
Gattaca--
>

On Wed, 26 Sep 2001, Michels, Gustavo [EES/BR] wrote:
> Just a follow up:
>
> Using winbind enum users and groups = no solved the problem. Winbind is
> using 0.6% (3 Mb) of system memory for a while now. And that delay while
> telnetting in also disappeared.
Good.  /usr/bin/id still works correctly for domain users?





cheers, jerry
 ---------------------------------------------------------------------
 www.samba.org              SAMBA Team              jerry_at_samba.org
 www.plainjoe.org                                jerry_at_plainjoe.org
 --"I never saved anything for the swim back." Ethan Hawk in Gattaca--

Hi,

Yes, /usr/bin/id returns the user id for domain users.

cheers
Gustavo

> -----Original Message-----
> From: Gerald Carter [mailto:gcarter@valinux.com]
> Sent: quarta-feira, 26 de setembro de 2001 10:56
> To: Michels, Gustavo [EES/BR]
> Cc: DICKENS,CARY (HP-Loveland,ex2); samba@lists.samba.org;
> tpot@samba.org
> Subject: RE: Winbind slowing down entire system
> 
> 
> On Wed, 26 Sep 2001, Michels, Gustavo [EES/BR] wrote:
> 
> > Just a follow up:
> >
> > Using winbind enum users and groups = no solved the 
> problem. Winbind is
> > using 0.6% (3 Mb) of system memory for a while now. And 
> that delay while
> > telnetting in also disappeared.
> 
> Good.  /usr/bin/id still works correctly for domain users?
> 
> 
> 
> 
> 
> cheers, jerry
>  ---------------------------------------------------------------------
>  www.samba.org              SAMBA Team              jerry_at_samba.org
>  www.plainjoe.org                                jerry_at_plainjoe.org
>  --"I never saved anything for the swim back." Ethan Hawk in
Gattaca--
>

On Wed, 26 Sep 2001, Michels, Gustavo [EES/BR] wrote:
> Hi,
>
> Yes, /usr/bin/id returns the user id for domain users.
and domain groups that the user is a member of as well
I assume?





jerry

Yes :-).

cheers
Gustavo
> -----Original Message-----
> From: Gerald Carter [mailto:gcarter@valinux.com]
> Sent: quarta-feira, 26 de setembro de 2001 11:13
> To: Michels, Gustavo [EES/BR]
> Cc: samba@lists.samba.org
> Subject: RE: Winbind slowing down entire system
> 
> 
> On Wed, 26 Sep 2001, Michels, Gustavo [EES/BR] wrote:
> 
> > Hi,
> >
> > Yes, /usr/bin/id returns the user id for domain users.
> 
> and domain groups that the user is a member of as well
> I assume?
> 
> 
> 
> 
> 
> jerry
> 
> 
>

Michels, Gustavo [EES/BR] writes:
> Just a follow up:
> 
> Using winbind enum users and groups = no solved the problem. Winbind is
> using 0.6% (3 Mb) of system memory for a while now. And that delay while
> telnetting in also disappeared.
Or you could do that.  (-:  That is the reason why I added the
ability to disable enumeration of users or groups.


Tim.

Hi,

The domain I am working on has about 5000 users (I don't know the number of
groups) and I haven't noticed any differences in samba functionality turning
those options off (apart from the slowdown in the system that stopped, of
course) and all my shares have their security defined by domain groups
through valid users entries in smb.conf. Looks the same as before for me,
that's great!

Even libnss_wins.so is working perfectly :-)

cheers
Gustavo
> -----Original Message-----
> From: Tim Potter [mailto:tpot@samba.org]
> Sent: quarta-feira, 26 de setembro de 2001 19:53
> To: Michels, Gustavo [EES/BR]
> Cc: Gerald Carter; DICKENS,CARY (HP-Loveland,ex2); 
> samba@lists.samba.org
> Subject: RE: Winbind slowing down entire system
> 
> 
> Michels, Gustavo [EES/BR] writes:
> 
> > Just a follow up:
> > 
> > Using winbind enum users and groups = no solved the 
> problem. Winbind is
> > using 0.6% (3 Mb) of system memory for a while now. And 
> that delay while
> > telnetting in also disappeared.
> 
> Or you could do that.  (-:  That is the reason why I added the
> ability to disable enumeration of users or groups.
> 
> 
> Tim.
>