samba - Nov 2005 - Lots of "write_data: write failure in writing to client" and "Error writing 4 bytes to client. -1"

Last week we installed Samba 3.0.20b on one of our servers, worked fine and
does it's job well. But today the load was rising due two smbd processes
taking up all cputime. While looking for hints on what was going on the
logfiles show two types of errors (I don't know at this time if it has
anything to do with the load spike):

lib/util_sock.c:write_data(554)
write_data: write failure in writing to client 0.0.0.0 <http://0.0.0.0>.
Error Connection reset by peer

followed by:

lib/util_sock.c:send_smb(762)
Error writing 4 bytes to client. -1. (Connection reset by peer)

After a few hours I killed the two offending smbd's but I like to know more
before it reoccurs.

---
Server: 2 x Intel Xeon 3.2 ; 4 GB memory
OS: 32bit RedHat Enterprise Linux ES release 4 Update 1
Clients: 500 x Windows XP (each have at least two drives mapped to this
server)
Smb builtin modules: pdb_ldap pdb_smbpasswd pdb_tdbsam pdb_guest rpc_lsa
rpc_reg rpc_lsa_ds rpc_wks rpc_svcctl rpc_net rpc_dfs rpc_srv rpc_spoo
lss rpc_eventlog rpc_samr idmap_ldap idmap_tdb auth_rhosts auth_sam
auth_unix auth_winbind auth_server auth_domain auth_builtin

Thanks,
Leroy

On Sun, 2005-11-20 at 22:02 +0100, Leroy van Logchem
wrote:
> Last week we installed Samba 3.0.20b on one of our servers, worked fine and
> does it's job well. But today the load was rising due two smbd
processes
> taking up all cputime. While looking for hints on what was going on the
> logfiles show two types of errors (I don't know at this time if it has
> anything to do with the load spike):
> 
> lib/util_sock.c:write_data(554)
> write_data: write failure in writing to client 0.0.0.0
<http://0.0.0.0>.
> Error Connection reset by peer
> 
> followed by:
> 
> lib/util_sock.c:send_smb(762)
> Error writing 4 bytes to client. -1. (Connection reset by peer)
this is a "normal" client disconnection, ma have been a reboot, a
network glitch, or any other client problem.
> After a few hours I killed the two offending smbd's but I like to know
more
> before it reoccurs.
would you have run strace or gdb on the process to see where they where
stuck ...

next time please do it.

Simo.

-- 
Simo Sorce    -  idra@samba.org
Samba Team    -  http://www.samba.org
Italian Site  -  http://samba.xsec.it