samba - Oct 2009 - Log entries with truncated service names

Hi,

Situation:

I'm seeing lots (~500k per day) of log entries like:
smbd[13939]: itlab-pc06 (::ffff:10.51.51.103) couldn't find service it261

In this case, the last character of the request is truncated - it should be
it2610

I'm seeing the same/similar issue to
http://lists.samba.org/archive/samba/2009-March/147277.html

I've dismissed this over the last few weeks as a minor inconvenience, but
I'm now convinced that it's affecting the performance of the Windows
client
machines that are connecting to it - a 30 second operation on local disk,
takes upwards of 5 mins over a network connection, generating thousands of
entries similar to the above.

This isn't unique - over the last 16 business hours (it's in a lab in a
university dept.), there have been ~900k similar entries. It's also not just
for this particular share, it's on all of the "home" shares that
have been
accessed, and also all of the 4 "defined" shares in smb.conf. Also,
it's
across many different hosts, and affecting different Windows OS's. My
primary testing has been using Windows7 - I have a lab of 33 machines with
this OS, but I believe I've also seen this from Windows XP and Vista hosts.

Also, it's not restricted to this particular host:
Turing (RHEL5) - tried versions samba-3.0.33-3.14.el5 samba3x-3.3.5-0.40.el5
Babbage (RHEL4) exhibits the same, samba-3.0.33-0.17.el4

Babbage which has higher use (in the last 48 hours), has seen a total of 150
different host/service combinations from the logs, across different networks
with different clients and different OS's.

I've got output from "log level = 10" from turing, and I've
got a tcpdump
from the server end with the communication with one of the machines.
Interestingly, the truncated request is visible in wireshark. I'd rather not
share the complete set of logs publically on the list, but will send
off-list to others (that and they're ~2MB).

Please let me know any further debugging steps that are necessary.

Thanks,

Matthew

On 10/06/2009 08:55 PM, Matthew Dickinson wrote:
> Hi,
> 
> Situation:
> 
> I'm seeing lots (~500k per day) of log entries like:
> smbd[13939]: itlab-pc06 (::ffff:10.51.51.103) couldn't find service
it261
> 
> In this case, the last character of the request is truncated - it should be
> it2610
> 
> I'm seeing the same/similar issue to
> http://lists.samba.org/archive/samba/2009-March/147277.html
> 
> I've dismissed this over the last few weeks as a minor inconvenience,
but
> I'm now convinced that it's affecting the performance of the
Windows client
> machines that are connecting to it - a 30 second operation on local disk,
> takes upwards of 5 mins over a network connection, generating thousands of
> entries similar to the above.
> 
> This isn't unique - over the last 16 business hours (it's in a lab
in a
> university dept.), there have been ~900k similar entries. It's also not
just
> for this particular share, it's on all of the "home" shares
that have been
> accessed, and also all of the 4 "defined" shares in smb.conf.
Also, it's
> across many different hosts, and affecting different Windows OS's. My
> primary testing has been using Windows7 - I have a lab of 33 machines with
> this OS, but I believe I've also seen this from Windows XP and Vista
hosts.
> 
> Also, it's not restricted to this particular host:
> Turing (RHEL5) - tried versions samba-3.0.33-3.14.el5
samba3x-3.3.5-0.40.el5
> Babbage (RHEL4) exhibits the same, samba-3.0.33-0.17.el4
> 
> Babbage which has higher use (in the last 48 hours), has seen a total of
150
> different host/service combinations from the logs, across different
networks
> with different clients and different OS's.
> 
> I've got output from "log level = 10" from turing, and
I've got a tcpdump
> from the server end with the communication with one of the machines.
> Interestingly, the truncated request is visible in wireshark. I'd
rather not
> share the complete set of logs publically on the list, but will send
> off-list to others (that and they're ~2MB).
> 
> Please let me know any further debugging steps that are necessary.
> 
> Thanks,
> 
> Matthew
> 
> 
Please file a bug report on https://bugzilla.samba.org and upload the
logfiles as part of the bug report.  Also, please provide as much info
as necessary so that one of the Samba developers can reproduce the
problem.  Thanks.

- John Terpstra