samba - Sep 2018 - dcesrv process purpose

>> hi all,
>> 
>> after investigating a bit more about my performance problems, the task
>> that spins at 100% cpu (once in a while) appears to be consistently
dcesrv.
>> 
>> What is the dcesrv role's purpose?
>> 
>> Which is the samba log facility that captures dcesrv activities?
>> 
>> thank you,
> 
> Can you be a bit more specific about the exact process name causing you
> trouble?  
> 
from top I see the process with PID 1648 is the hungry one (today), then
I did:

$ ps auxwww | grep 1468
root      1468  5.3 12.3 2536300 1007424 ?     R    set01 247:17 samba:
task[dcesrv]

> DCE/RPC is at the core of Samba's capability as an AD DC, covering
> important protocols like NETLOGON (NTLM auth), LSA (name/SID lookups,
> trust handling), SAMR (user administration) and DRSUAPI (replication).
>
> Additionally, there is the similarly named dreplsrv sub-process which
> handles the 'client' side of replication, pulling and pushing
changes
> as required to other DCs.
thank you, really helpful.
> Finally, I would say that 50k users is not a mid-sided domain for Samba
> as an AD DC, indeed it is one of the largest I've heard of.  If so, it
> is quite likely that you are hitting some scaling issues.
the users are syncronized from OpenLDAP with LSC. When we make the
nightly full-syncronization, with hundreds of modify/add/delete, the
load is high, but not scaring. So the general case is, in my opinion, fine.
> 
> We continue to improve Samba's AD DC performance at this scale, but
> while we have also identified a number of potential improvements we
> haven't had the opportunity to action those yet[1].
> 
> Thanks,
> 
> Andrew Bartlett
> 
> [1] Help financing Samba at scale most welcome.
took a note, thank you,

franz

On Tue, 2018-09-04 at 11:45 +0200, Francesco Malvezzi via samba
wrote:
> > > hi all,
> > > 
> > > after investigating a bit more about my performance problems, the
task
> > > that spins at 100% cpu (once in a while) appears to be
consistently dcesrv.
> > > 
> > > What is the dcesrv role's purpose?
> > > 
> > > Which is the samba log facility that captures dcesrv activities?
> > > 
> > > thank you,
> > 
> > Can you be a bit more specific about the exact process name causing
you
> > trouble?  
> > 
> 
> from top I see the process with PID 1648 is the hungry one (today), then
> I did:
> 
> $ ps auxwww | grep 1468
> root      1468  5.3 12.3 2536300 1007424 ?     R    set01 247:17 samba:
> task[dcesrv]
This is the single process that handles all DCE/RPC in Samba (except
some netlogon work in Samba 4.7 and later).

It could be any of the things in there causing your issue, but my bet
is on the DRSUAPI server spinning due to all the other DCs looking for
replication changes.
> 
> > DCE/RPC is at the core of Samba's capability as an AD DC, covering
> > important protocols like NETLOGON (NTLM auth), LSA (name/SID lookups,
> > trust handling), SAMR (user administration) and DRSUAPI (replication).
> > 
> > Additionally, there is the similarly named dreplsrv sub-process which
> > handles the 'client' side of replication, pulling and pushing
changes
> > as required to other DCs.
> 
> thank you, really helpful.
> 
> > Finally, I would say that 50k users is not a mid-sided domain for
Samba
> > as an AD DC, indeed it is one of the largest I've heard of.  If
so, it
> > is quite likely that you are hitting some scaling issues.
> 
> the users are syncronized from OpenLDAP with LSC. When we make the
> nightly full-syncronization, with hundreds of modify/add/delete, the
> load is high, but not scaring. So the general case is, in my opinion, fine.
OK.  Good to know.
> > 
> > We continue to improve Samba's AD DC performance at this scale,
but
> > while we have also identified a number of potential improvements we
> > haven't had the opportunity to action those yet[1].
> > 
> > Thanks,
> > 
> > Andrew Bartlett
> > 
> > [1] Help financing Samba at scale most welcome.
> 
> took a note, thank you,
> 
> franz
Thanks,

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba