samba - Sep 2002 - smbd process with high cpu utilization.

One of my smbd processes used 100% cpu.  I straced the process and the
output follows:

washington:~# strace -p 3416
fcntl64(13, F_SETLKW64, {type=F_UNLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
sendto(12,
"\3\0X\r\0\0&\0\0\0\0\0\0\0\'\374\f\0\0\0\0\0\16\0\0\0", 26,
0,
{sin_family=AF_INET, sin_port=htons(41373),
sin_addr=inet_addr("127.0.0.1")}}, 16) = 26
fcntl64(13, F_SETLKW64, {type=F_WRLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
kill(3382, SIG_0)                       = 0
fcntl64(13, F_SETLKW64, {type=F_UNLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
sendto(12,
"\3\0X\r\0\0&\0\0\0\0\0\0\0\'\374\f\0\0\0\0\0\16\0\0\0", 26,
0,
{sin_family=AF_INET, sin_port=htons(41373),
sin_addr=inet_addr("127.0.0.1")}}, 16) = 26
fcntl64(13, F_SETLKW64, {type=F_WRLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
kill(3382, SIG_0)                       = 0
fcntl64(13, F_SETLKW64, {type=F_UNLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
sendto(12,
"\3\0X\r\0\0&\0\0\0\0\0\0\0\'\374\f\0\0\0\0\0\16\0\0\0", 26,
0,
{sin_family=AF_INET, sin_port=htons(41373),
sin_addr=inet_addr("127.0.0.1")}}, 16) = 26
fcntl64(13, F_SETLKW64, {type=F_WRLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
kill(3382, SIG_0)                       = 0
fcntl64(13, F_SETLKW64, {type=F_UNLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
sendto(12,
"\3\0X\r\0\0&\0\0\0\0\0\0\0\'\374\f\0\0\0\0\0\16\0\0\0", 26,
0,
{sin_family=AF_INET, sin_port=htons(41373),
sin_addr=inet_addr("127.0.0.1")}}, 16) = 26
fcntl64(13, F_SETLKW64, {type=F_WRLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
kill(3382, SIG_0)                       = 0
fcntl64(13, F_SETLKW64, {type=F_UNLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
sendto(12,
"\3\0X\r\0\0&\0\0\0\0\0\0\0\'\374\f\0\0\0\0\0\16\0\0\0", 26,
0,
{sin_family=AF_INET, sin_port=htons(41373),
sin_addr=inet_addr("127.0.0.1")}}, 16) = 26
fcntl64(13, F_SETLKW64, {type=F_WRLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
kill(3382, SIG_0)                       = 0
fcntl64(13, F_SETLKW64, {type=F_UNLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
sendto(12,
"\3\0X\r\0\0&\0\0\0\0\0\0\0\'\374\f\0\0\0\0\0\16\0\0\0", 26,
0,
{sin_family=AF_INET, sin_port=htons(41373),
sin_addr=inet_addr("127.0.0.1")}}, 16) = 26
fcntl64(13, F_SETLKW64, {type=F_WRLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
kill(3382, SIG_0)                       = 0
fcntl64(13, F_SETLKW64, {type=F_UNLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0
sendto(12,
"\3\0X\r\0\0&\0\0\0\0\0\0\0\'\374\f\0\0\0\0\0\16\0\0\0", 26,
0,
{sin_family=AF_INET, sin_port=htons(41373),
sin_addr=inet_addr("127.0.0.1")}}, 16) = 26
fcntl64(13, F_SETLKW64, {type=F_WRLCK, whence=SEEK_SET, start=404, len=1},
0xbfffefa0) = 0

Then comes the interesting part: 
The process with 100% cpu utilization (pid 3416) is owned by UID 23347
while the process it tries to kill (pid 3382) is owned by UID 21194. Both
users are connected from the same TS.

We are running samba 2.2.5 using windows 2k DC for authentication with
security=domain. The server is running linux 2.4.18.

Is there anyone who has experienced something similar or who perhaps might
know what causes this problem?



-- 
Magnus Nordseth
echo
'[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' |
dc

Magnus Nordseth:
> One of my smbd processes used 100% cpu.  I straced the process and the
> output follows:
[Snip]

I work for the same company as Magnus. Later we found several other
instances that used up all the cpu. In total the user 'sydnes' had 6
process running. Stracing one of them yielded:

kill(5663, SIG_0)                       = 0
kill(5532, SIG_0)                       = 0
fcntl64(13, F_SETLKW64, {type=F_UNLCK, whence=SEEK_SET, start=496, len=1},
0xbfffefa0) = 0
fcntl64(13, F_SETLKW64, {type=F_WRLCK, whence=SEEK_SET, start=496, len=1},
0xbfffefa0) = 0

repeated over and over again.
However smbstatus | grep 5532 yielded:

larswist     larswist iikt_s1   5532   ts-intro12 (129.241.107.172) Wed Sep 25
11:03:09 2002
groh         groh     tall_s3   5532   ts-intro12 (129.241.107.172) Wed Sep 25
11:01:50 2002
www          sveinelo tall_s1   5532   ts-intro12 (129.241.107.172) Wed Sep 25
11:03:09 2002
www          sydnes   kall_s    5532   ts-intro12 (129.241.107.172) Wed Sep 25
11:01:51 2002
sydnes       sydnes   kall_s    5532   ts-intro12 (129.241.107.172) Wed Sep 25
11:03:09 2002
www          skuncke  fidi_s    5532   ts-intro12 (129.241.107.172) Wed Sep 25
11:01:51 2002
reinas       reinas   fall_s    5532   ts-intro12 (129.241.107.172) Wed Sep 25
11:01:51 2002
www          sigrunm  gall_s    5532   ts-intro12 (129.241.107.172) Wed Sep 25
11:01:50 2002
www          michelh  fidi_s    5532   ts-intro12 (129.241.107.172) Wed Sep 25
11:01:50 2002
5532   DENY_NONE  0x20089     RDONLY     LEVEL_II        
/local/www.stud.users/sydnes/oving4/teori.jsp   Wed Sep 25 11:01:51 2002

Note that ts-intro12 is a terminal server running w2k.
But I could not find the process with ps.

Any help regarding what might be wrong, would be much appreciated.
Thanks in advance!

-- 

Marius Grann?s
------------------------
I see fragged people.

Hi!

I'm running into the same problems reported by Magnus Nordseth and Marius
Grannaes on this list:

I got one smbd process running wild (using up all CPU) with only two
function calls (nearly all kill(...)):

strace:
...
kill(10245, SIG_0)                      = 0
kill(10827, SIG_0)                      = 0
kill(10820, SIG_0)                      = 0
kill(10759, SIG_0)                      = 0
kill(10257, SIG_0)                      = 0
kill(10245, SIG_0)                      = 0
fcntl64(13, F_SETLKW64, {type=F_UNLCK, whence=SEEK_SET, start=336, len=1},
0xbffff150) = 0
sendto(12, "\3\0\1
\0\0\6\10\0\0\0\0\0\0\306\373\0\0\0\0\0\0\354\1"...,
26, 0, {sin_family=AF_INET, sin_port=htons(1716),
sin_addr=inet_addr("127.0.0.1")}}, 1
6) = 26
fcntl64(13, F_SETLKW64, {type=F_WRLCK, whence=SEEK_SET, start=336, len=1},
0xbffff150) = 0
...


I had to reboot the system twice last week - due to high load. To fix this
problem I upgraded to SuSE 8.1 with samba 2.2.5 (former version was SuSE
7.3 with samba 2.2.1a) - but the problems seem to be the same - no
improvements.

Any ideas? As more people have observed this behaviour I'd really like to
get this fixed ...

Ciao,
  Marcel

PS: Please CC me - I'm not subscribed to samba-ml.

----
Marcel Ritter
Linux Betreuer
Regionales Rechenzentrum Erlangen
----
Unix _IS_ user friendly... It's just selective about who its friends are.