My Samba Server had a wild time this weekend thanks to alleged power fluctuations. I'm using Samba 3.x on Fedora 4. My server sits on an APC UPS that remains in good health. When I arrived this Monday I found that my MicroTik Router was still up. My Win XP pro AV server was off and my Fedora/SAMBA box was also off. (all boxes have their own 15min UPS) The Win XP pro was brought up w/out difficulty. The Fedora/SAMBA box after thinking a long time would only bring up Grub. The rescue CD could not mount /dev/sda1. 3 sips of Whisky later (not really, but it communicates how I felt.. I'm still wet behind the ears..) something I did in the shell (trying to remount perhaps), or blind happy luck caused the system to boot as normal. No file corruption or anomalies that I can see. Here comes the sleuthing. Some people in our school's community experienced power outages (not exceeding 8 min) on Saturday, the 18th. Nobody called us from campus to report any outages. Nobody called Maintenance either. My router in my office across the street from the campus and on the same grid as my servers was locked up. This led me to believe that my server room also experienced some form of outage or surge. So I began to troll through the log files. I discovered a faculty member had logged on successfully in the morning on Saturday. By 2:00 pm, when he came back, he could not log in. My SAMBA server was "up" enough to log this attempt, but "down" enough that it could not resolve the login attempt to a username.. lib/util_seaccess.c:se_access_check(251) se_access_check: user sid is S-1-5-21-1656605845-1192728522-1085763284-501 se_access_check: also S-1-5-21-1656605845-1192728522-1085763284-1199 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 free_pipe_context: destroying talloc pool of size 820 The above happened repeatedly (I'm on loglevel 3) for a min. And then claimed Successful Loggout.. but never resolved the SID Then we come to Saturday. Syslog stops recording activity @ 3:41am in the morning Syslog restarts @ 4:04 am in the morning SAMBA still cannot resolve sid(s) into usernames at this point. Oddly, the computer just next to the server room had attempted logins just before my server received a shutdown signal. I have a SID. How do I translate that into the user who was in the room 3 min before shutdown? T.I.A.
Moondance Foxmarnick wrote:> > The Fedora/SAMBA box after thinking a long time would only bring up > Grub. The rescue CD could not mount /dev/sda1. 3 sips of Whisky later > (not really, but it communicates how I felt.. I'm still wet behind > the ears..)Try drinking the stuff. Dabbing it behind your ears is for girls to do with cologne.> > I have a SID. How do I translate that into the user who was in the > room 3 min before shutdown?pdbedit -vL lists full user details, including SIDs. -- Jack.
Jack,
And here I thought I would be taken to task for sipping! <grin>
Thank you. I remember pdbedit. I don't remember why I have used it, and I
certainly didn't remember that it could give me SIDs. (that just looks
wrong) And you have no idea how many variant ways I typed into Google for SID to
UID conversion. None of the hits mentioned pdbedit. <sigh>
The problem I have with this software is that I only need to work with it 3
times a year after taking, what, 3 months to dive in and learn to set it up. You
just can't learn or retain information that way. Now if a large, militant,
propriatary company made this software.. why, it would go down once a week at
minimum and would know the system like the back of my hand!
Guys.. can we work on this?
Feeling nothing but Luv for the SAMBA team,
-Moondance
-----Original Message----->From: "Mr. Demeanour" <mrdemeanour@jackpot.uk.net>
>Sent: Nov 21, 2006 5:28 AM
>To: samba@lists.samba.org
>Subject: Re: [Samba] Sluething
>
>Moondance Foxmarnick wrote:
>>
>> The Fedora/SAMBA box after thinking a long time would only bring up
>> Grub. The rescue CD could not mount /dev/sda1. 3 sips of Whisky later
>> (not really, but it communicates how I felt.. I'm still wet behind
>> the ears..)
>
>Try drinking the stuff. Dabbing it behind your ears is for girls to do
>with cologne.
>>
>> I have a SID. How do I translate that into the user who was in the
>> room 3 min before shutdown?
>
>pdbedit -vL
>
>lists full user details, including SIDs.
>
>--
>Jack.