Per Dalgas Jakobsen
2023-Feb-03 17:10 UTC
[Samba] Follow-up: smbstatus -p gives multiple identical lines
It seems to be correlated to SMB3 only: Sequence: Client -> Samba: GetInfo Request FS_INFO/SMB2_FS_INFO_07 Samba -> Client: GetInfo Response Client -> Samba: 55089?445 [ACK] Seq=29007 Ack=49714 Win=8190 Len=0 Client -> Samba: Session Setup Request, NTLMSSP_NEGOTIATE Samba -> Client: Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE Client -> Samba: Session Setup Request, NTLMSSP_AUTH, User: DOMAIN/USER (samba is not part of domain) Samba -> Client: Session Setup Response (no text follows, package length = 130) then some repetitions from NTLMSSP_NEGOTIATE However, I still do not know what smbstatus is trying to tell me with the duplicated entries... The troublesome clients *do* seem to connect and seem to run OK (connecting as "nobody"). Clients running SMB2 has no problems, and are represented with one entry only. Does this ring any bells here, and perhaps having a known fix at version 4.x.y? ~Per On 01-02-2023 11:23, Per Dalgas Jakobsen via samba wrote:> I'm tracking down a problem that might be related to how some clients > use our Samba server. > Running Samba 4.6 on an AIX 7.2 (yes, we know it is not the newest, > but for now we want to diagnose the existing situation). > > Running "smbstatus -p" gives me multiple lines for some processes: > --- > 26804526 nobody?????? nobody?????? 10.70.134.152 > (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - > 26804526 nobody?????? nobody?????? 10.10.134.152 > (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - > 26804526 nobody?????? nobody?????? 10.10.134.152 > (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - > 23921110 nobody?????? nobody?????? 10.10.27.101 > (ipv4:10.10.27.101:49164)??? SMB3_11?????????? - - > 26804526 nobody?????? nobody?????? 10.10.134.152 > (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - > 26804526 nobody?????? nobody?????? 10.10.134.152 > (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - > 26804526 nobody?????? nobody?????? 10.10.134.152 > (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - > --- > > A representative extract of > root>smbstatus -p | awk '{ print $5, $1 }' | sort | uniq -c | sort -n > gives: > --- > ?? 1 (ipv4:10.10.107.101:50681) 13435622 > ?? 1 (ipv4:10.10.134.169:64346) 21168672 > ?? 1 (ipv4:10.10.18.106:54846) 16122292 > ?? 1 (ipv4:10.10.18.148:55037) 10224334 > ?? 6 (ipv4:10.10.100.45:57811) 19202612 > ? 11 (ipv4:10.10.19.105:50521) 28181056 > ? 82 (ipv4:10.10.18.102:58714) 23396860 > ?187 (ipv4:10.10.22.105:65346) 27132162 > ?214 (ipv4:10.10.19.108:52310) 37290358 > ?359 (ipv4:10.10.18.158:58427) 17892066 > ?466 (ipv4:10.10.17.103:60698) 22675718 > ?774 (ipv4:10.10.134.170:62843) 19530390 > ?800 (ipv4:10.10.19.166:52874) 10551728 > 5985 (ipv4:10.10.27.101:49164) 23921110 > 6019 (ipv4:10.10.134.160:50197) 20906548 > 7704 (ipv4:10.10.134.152:64261) 26804526 > --- > > If I read the manual it says: > -p|--processes > ????????????? print a list of smbd(8) processes and exit. Useful for? > scripting. > > How come that the same process (and ip:port) combination gives more > than one output line in smbstatus? What does each line represent? > 7704 identical lines on process 26804526, what would that indicate? > > ~Per > >
Per Dalgas Jakobsen
2023-Feb-27 20:04 UTC
[Samba] Another follow-up: smbstatus -p gives multiple identical lines
Not only correlated to SMB3, tried to force SMB2 but problem persist. Are there really nobody here that knows smbstatus well enough to know what multiple identical process lines in smbstatus means? Memory and cpu usage for the process raise with the amount of identical lines. ~Per On 2/3/23 18:10, Per Dalgas Jakobsen via samba wrote:> It seems to be correlated to SMB3 only: > > Sequence: > Client -> Samba: GetInfo Request FS_INFO/SMB2_FS_INFO_07 > Samba -> Client: GetInfo Response > Client -> Samba: 55089?445 [ACK] Seq=29007 Ack=49714 Win=8190 Len=0 > Client -> Samba: Session Setup Request, NTLMSSP_NEGOTIATE > Samba -> Client: Session Setup Response, Error: > STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE > Client -> Samba: Session Setup Request, NTLMSSP_AUTH, User: > DOMAIN/USER (samba is not part of domain) > Samba -> Client: Session Setup Response (no text follows, package > length = 130) > then some repetitions from NTLMSSP_NEGOTIATE > > However, I still do not know what smbstatus is trying to tell me with > the duplicated entries... > The troublesome clients *do* seem to connect and seem to run OK > (connecting as "nobody"). > Clients running SMB2 has no problems, and are represented with one > entry only. > > Does this ring any bells here, and perhaps having a known fix at > version 4.x.y? > > ~Per > > On 01-02-2023 11:23, Per Dalgas Jakobsen via samba wrote: >> I'm tracking down a problem that might be related to how some clients >> use our Samba server. >> Running Samba 4.6 on an AIX 7.2 (yes, we know it is not the newest, >> but for now we want to diagnose the existing situation). >> >> Running "smbstatus -p" gives me multiple lines for some processes: >> --- >> 26804526 nobody?????? nobody?????? 10.70.134.152 >> (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - >> 26804526 nobody?????? nobody?????? 10.10.134.152 >> (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - >> 26804526 nobody?????? nobody?????? 10.10.134.152 >> (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - >> 23921110 nobody?????? nobody?????? 10.10.27.101 >> (ipv4:10.10.27.101:49164)??? SMB3_11?????????? - - >> 26804526 nobody?????? nobody?????? 10.10.134.152 >> (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - >> 26804526 nobody?????? nobody?????? 10.10.134.152 >> (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - >> 26804526 nobody?????? nobody?????? 10.10.134.152 >> (ipv4:10.10.134.152:64261)? SMB3_11?????????? - - >> --- >> >> A representative extract of >> root>smbstatus -p | awk '{ print $5, $1 }' | sort | uniq -c | sort -n >> gives: >> --- >> ?? 1 (ipv4:10.10.107.101:50681) 13435622 >> ?? 1 (ipv4:10.10.134.169:64346) 21168672 >> ?? 1 (ipv4:10.10.18.106:54846) 16122292 >> ?? 1 (ipv4:10.10.18.148:55037) 10224334 >> ?? 6 (ipv4:10.10.100.45:57811) 19202612 >> ? 11 (ipv4:10.10.19.105:50521) 28181056 >> ? 82 (ipv4:10.10.18.102:58714) 23396860 >> ?187 (ipv4:10.10.22.105:65346) 27132162 >> ?214 (ipv4:10.10.19.108:52310) 37290358 >> ?359 (ipv4:10.10.18.158:58427) 17892066 >> ?466 (ipv4:10.10.17.103:60698) 22675718 >> ?774 (ipv4:10.10.134.170:62843) 19530390 >> ?800 (ipv4:10.10.19.166:52874) 10551728 >> 5985 (ipv4:10.10.27.101:49164) 23921110 >> 6019 (ipv4:10.10.134.160:50197) 20906548 >> 7704 (ipv4:10.10.134.152:64261) 26804526 >> --- >> >> If I read the manual it says: >> -p|--processes >> ????????????? print a list of smbd(8) processes and exit. Useful for? >> scripting. >> >> How come that the same process (and ip:port) combination gives more >> than one output line in smbstatus? What does each line represent? >> 7704 identical lines on process 26804526, what would that indicate? >> >> ~Per >> >>