thr3ads.net - samba - [Samba] 4.17.1 rpcd_winreg, rpcd

If this information is useful, please help other people find it:
Share via:

Tim ODriscoll

2022-Nov-03 19:59 UTC

[Samba] 4.17.1 rpcd_winreg, rpcd_spoolss and printing

On 03 November 2022 16:44, Jeremy Allison via samba
wrote:> Can you do an strace on an rpcd_winreg process ? That seems an inordinate
> amount of CPU...
Hi Jeremy,

There's no printing activity on the server at the moment, but there are
still a few lingering rpcd_winreg processes, so I picked the longest running one
and ran 'strace -p 18841 -o rpcd_winreg.strace', left it running for 5
seconds and [ctrl]+c to stop it.

This is the 'top' output for the process:
  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
18841 root      20   0  911684 204236  18440 R  90.1  0.6 124:18.11 rpcd_winreg 

I've put the output here as it's too big to post to the list:
https://raw.githubusercontent.com/7604timo/7604timo/main/rpcd_winreg.strace

I've no idea what most of the output means, but skimming through it I
don't see any blindingly obvious errors.....

Many thanks,

Tim

Tim ODriscoll

2022-Nov-04 09:38 UTC

head link

[Samba] 4.17.1 rpcd_winreg, rpcd_spoolss and printing

On 03 November 2022 19:59, Tim ODriscoll via samba
wrote:>On 03 November 2022 16:44, Jeremy Allison via samba wrote:
>> Can you do an strace on an rpcd_winreg process ? That seems an
inordinate
>> amount of CPU...
>
>There's no printing activity on the server at the moment, but there are
still a few lingering rpcd_winreg processes, so I picked the longest running one
and ran >'strace -p 18841 -o rpcd_winreg.strace', left it running for
5 seconds and [ctrl]+c to stop it.
>
I'm beginning to suspect this is communication issue between Windows and
Samba:
On my brand new print server, I've only tried setting up one client (Windows
11), yet the server is still showing one rpcd_winreg process taking up 100% CPU
and it's been running since the sernet-samba-ad service was last started.

Looking through the rpcd_spoolss log file, every few seconds there is an
authentication request from the Windows client's logged in user, then a
request for the printer list. The Windows client is apparently idle, I should
point out.

So, I'm now wondering if there's a GPO I've made recently which has
a setting that is making Windows expect a certain response from a print server
that Samba isn't giving it.

Tim

Here's a snippet from the log file - all these entries are for the logged in
user on my test machine, on which I've added a printer from the new DC:
grep authentication_event /var/log/samba/log.rpcd_spoolss
[2022/11/04 09:20:46,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:20:47,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:20:47,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:20:48,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:20:53,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:20:53,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:20:56,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:20:56,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:20:57,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:20:57,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:20:58,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:20:58,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:20:59,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:04,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:06,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:06,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:07,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:07,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:08,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:09,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:09,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:15,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:16,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:16,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:17,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:17,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:18,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:20,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:20,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:26,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:26,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:27,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:27,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:27,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:28,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:30,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:32,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:36,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:36,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:37,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:37,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:38,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:40,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:41,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:41,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:41,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:41,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)
[2022/11/04 09:21:41,  3]
../../auth/auth_log.c:647(log_authentication_event_human_readable)

samba - Nov 2022 - 4.17.1 rpcd_winreg, rpcd_spoolss and printing

[Samba] 4.17.1 rpcd_winreg, rpcd_spoolss and printing

[Samba] 4.17.1 rpcd_winreg, rpcd_spoolss and printing