Per Dalgas Jakobsen
2023-Feb-01 10:23 UTC
[Samba] smbstatus -p gives multiple identical lines
I'm tracking down a problem that might be related to how some clients
use our Samba server.
Running Samba 4.6 on an AIX 7.2 (yes, we know it is not the newest, but
for now we want to diagnose the existing situation).
Running "smbstatus -p" gives me multiple lines for some processes:
---
26804526 nobody?????? nobody?????? 10.70.134.152
(ipv4:10.10.134.152:64261)? SMB3_11?????????? -??????????????????? -
26804526 nobody?????? nobody?????? 10.10.134.152
(ipv4:10.10.134.152:64261)? SMB3_11?????????? -??????????????????? -
26804526 nobody?????? nobody?????? 10.10.134.152
(ipv4:10.10.134.152:64261)? SMB3_11?????????? -??????????????????? -
23921110 nobody?????? nobody?????? 10.10.27.101
(ipv4:10.10.27.101:49164)??? SMB3_11?????????? - -
26804526 nobody?????? nobody?????? 10.10.134.152
(ipv4:10.10.134.152:64261)? SMB3_11?????????? -??????????????????? -
26804526 nobody?????? nobody?????? 10.10.134.152
(ipv4:10.10.134.152:64261)? SMB3_11?????????? -??????????????????? -
26804526 nobody?????? nobody?????? 10.10.134.152
(ipv4:10.10.134.152:64261)? SMB3_11?????????? -??????????????????? -
---
A representative extract of
root>smbstatus -p | awk '{ print $5, $1 }' | sort | uniq -c | sort -n
gives:
---
?? 1 (ipv4:10.10.107.101:50681) 13435622
?? 1 (ipv4:10.10.134.169:64346) 21168672
?? 1 (ipv4:10.10.18.106:54846) 16122292
?? 1 (ipv4:10.10.18.148:55037) 10224334
?? 6 (ipv4:10.10.100.45:57811) 19202612
? 11 (ipv4:10.10.19.105:50521) 28181056
? 82 (ipv4:10.10.18.102:58714) 23396860
?187 (ipv4:10.10.22.105:65346) 27132162
?214 (ipv4:10.10.19.108:52310) 37290358
?359 (ipv4:10.10.18.158:58427) 17892066
?466 (ipv4:10.10.17.103:60698) 22675718
?774 (ipv4:10.10.134.170:62843) 19530390
?800 (ipv4:10.10.19.166:52874) 10551728
5985 (ipv4:10.10.27.101:49164) 23921110
6019 (ipv4:10.10.134.160:50197) 20906548
7704 (ipv4:10.10.134.152:64261) 26804526
---
If I read the manual it says:
-p|--processes
????????????? print a list of smbd(8) processes and exit. Useful for?
scripting.
How come that the same process (and ip:port) combination gives more than
one output line in smbstatus? What does each line represent?
7704 identical lines on process 26804526, what would that indicate?
~Per
Per Dalgas Jakobsen
2023-Feb-03 17:10 UTC
[Samba] Follow-up: smbstatus -p gives multiple identical lines
It seems to be correlated to SMB3 only: Sequence: Client -> Samba: GetInfo Request FS_INFO/SMB2_FS_INFO_07 Samba -> Client: GetInfo Response Client -> Samba: 55089?445 [ACK] Seq=29007 Ack=49714 Win=8190 Len=0 Client -> Samba: Session Setup Request, NTLMSSP_NEGOTIATE Samba -> Client: Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE Client -> Samba: Session Setup Request, NTLMSSP_AUTH, User: DOMAIN/USER (samba is not part of domain) Samba -> Client: Session Setup Response (no text follows, package length = 130) then some repetitions from NTLMSSP_NEGOTIATE However, I still do not know what smbstatus is trying to tell me with the duplicated entries... The troublesome clients *do* seem to connect and seem to run OK (connecting as "nobody"). Clients running SMB2 has no problems, and are represented with one entry only. Does this ring any bells here, and perhaps having a known fix at version 4.x.y? ~Per On 01-02-2023 11:23, Per Dalgas Jakobsen via samba wrote:> I'm tracking down a problem that might be related to how some clients > use our Samba server. > Running Samba 4.6 on an AIX 7.2 (yes, we know it is not the newest, > but for now we want to diagnose the existing situation). > > Running "smbstatus -p" gives me multiple lines for some processes: > --- > 26804526 nobody?????? nobody?????? 10.70.134.152 > (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - > 26804526 nobody?????? nobody?????? 10.10.134.152 > (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - > 26804526 nobody?????? nobody?????? 10.10.134.152 > (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - > 23921110 nobody?????? nobody?????? 10.10.27.101 > (ipv4:10.10.27.101:49164)??? SMB3_11?????????? - - > 26804526 nobody?????? nobody?????? 10.10.134.152 > (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - > 26804526 nobody?????? nobody?????? 10.10.134.152 > (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - > 26804526 nobody?????? nobody?????? 10.10.134.152 > (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - > --- > > A representative extract of > root>smbstatus -p | awk '{ print $5, $1 }' | sort | uniq -c | sort -n > gives: > --- > ?? 1 (ipv4:10.10.107.101:50681) 13435622 > ?? 1 (ipv4:10.10.134.169:64346) 21168672 > ?? 1 (ipv4:10.10.18.106:54846) 16122292 > ?? 1 (ipv4:10.10.18.148:55037) 10224334 > ?? 6 (ipv4:10.10.100.45:57811) 19202612 > ? 11 (ipv4:10.10.19.105:50521) 28181056 > ? 82 (ipv4:10.10.18.102:58714) 23396860 > ?187 (ipv4:10.10.22.105:65346) 27132162 > ?214 (ipv4:10.10.19.108:52310) 37290358 > ?359 (ipv4:10.10.18.158:58427) 17892066 > ?466 (ipv4:10.10.17.103:60698) 22675718 > ?774 (ipv4:10.10.134.170:62843) 19530390 > ?800 (ipv4:10.10.19.166:52874) 10551728 > 5985 (ipv4:10.10.27.101:49164) 23921110 > 6019 (ipv4:10.10.134.160:50197) 20906548 > 7704 (ipv4:10.10.134.152:64261) 26804526 > --- > > If I read the manual it says: > -p|--processes > ????????????? print a list of smbd(8) processes and exit. Useful for? > scripting. > > How come that the same process (and ip:port) combination gives more > than one output line in smbstatus? What does each line represent? > 7704 identical lines on process 26804526, what would that indicate? > > ~Per > >