samba - Oct 2023 - rpc_pipe_open_ncalrpc: connect(/run/samba/ncalrpc/EPMAPPER) failed: No such file or directory

This question has already been asked in the past, but there was
no answer.

The above message is logged quite often in /var/log/samba/log.samba-dcerpcd.
This is a stand-alone anonymous read-only server.

Is it something to worry about?  It smells like samba isn't working
properly.

If yes, how can I fix it?

If no, how can I stop samba from logging un-interesting messages?

What dcerpcd is used for to begin with?  I don't remember it running
before (but iirc it is a new thing in 4.16).

Thanks,

/mjt

On 01.10.2023 7:41, Michael Tokarev via samba wrote:
> This question has already been asked in the past, but there was
> no answer.
>
> The above message is logged quite often in 
> /var/log/samba/log.samba-dcerpcd.
> This is a stand-alone anonymous read-only server.
>
> Is it something to worry about?? It smells like samba isn't working
> properly.
>
> If yes, how can I fix it?
>
> If no, how can I stop samba from logging un-interesting messages?
>
> What dcerpcd is used for to begin with?? I don't remember it running
> before (but iirc it is a new thing in 4.16).
>
> Thanks,
>
> /mjt
>
Hi Michael,

That message is there for ages, exists at least from 4.17.x. It doesn't 
seem to impact operations though.

A look at the directory structure gives that the directory 
/run/samba/ncalrpc/np/epmapper exists. It also existed in previous Samba 
installations (Debian, Samba 4.17.x and later).

Best regards,

Peter

On Sun, 1 Oct 2023 08:41:01 +0300
Michael Tokarev via samba <samba at lists.samba.org> wrote:
> This question has already been asked in the past, but there was
> no answer.
> 
> The above message is logged quite often
> in /var/log/samba/log.samba-dcerpcd. This is a stand-alone anonymous
> read-only server.
> 
> Is it something to worry about?  It smells like samba isn't working
> properly.
This could be something as simple as the directory being created as
'/run/samba/ncalrpc/np/epmapper' and being searched for as
'/run/samba/ncalrpc/np/EPMAPPER'. Which may or may not matter,
depending on just what is supposed to end up in the 'emapper/EMAPPER'
directory. Interestingly, I have '/run/samba/ncalcrpc/np/emapper' and
'/run/samba/ncalrpc/EPMAPPER', I wonder if I should ?

To me, this sounds like a bug, should the directory be created as
'/run/samba/ncalrpc/np/EPMAPPER' or should it be searched for as
'/run/samba/ncalrpc/np/epmapper' ?
> 
> If yes, how can I fix it?
As a workaround, you could try setting 'log level = 0'.
> 
> If no, how can I stop samba from logging un-interesting messages?
> 
> What dcerpcd is used for to begin with?  I don't remember it running
> before (but iirc it is a new thing in 4.16).
Yes, it was introduced at 4.16.0 by the creation of the samba-dcerpcd
binary, which, if I understand it correctly, was created by removing
parts of the smbd binary and running them as a standalone binary. It
stands for 'Distributed Computing Environment/Remote Procedure Call',
you can find more info here:

http://www.dcerpc.org/

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15

https://wiki.samba.org/index.php/DCERPC

Rowland

Am 01.10.2023 um 07:41 schrieb Michael Tokarev via
samba:
> This question has already been asked in the past, but there was
> no answer.
>
> The above message is logged quite often in
/var/log/samba/log.samba-dcerpcd.
> This is a stand-alone anonymous read-only server.
>
> Is it something to worry about?? It smells like samba isn't working
> properly.
>
> If yes, how can I fix it?
>
> If no, how can I stop samba from logging un-interesting messages?
>
> What dcerpcd is used for to begin with?? I don't remember it running
> before (but iirc it is a new thing in 4.16).
>
> Thanks,
>
> /mjt
>
I see this EPMAPPER error in my logs excatly once.

[2023/09/29 09:30:16,? 0] ../../source3/rpc_server/rpc_host.c:2981(main)
? samba-dcerpcd version 4.18.6-Debian started.
? Copyright Andrew Tridgell and the Samba Team 1992-2023
[2023/09/29 09:30:16.791210,? 1]
../../source3/rpc_client/cli_pipe.c:3014(rpc_pipe_open_ncalrpc)
? rpc_pipe_open_ncalrpc: connect(/run/samba/ncalrpc/EPMAPPER) failed:
Verbindungsaufbau abgelehnt
[2023/09/29 09:30:17.184124,? 1]
../../source3/rpc_server/rpc_host.c:1778(rpc_worker_exited)
? rpc_worker_exited: No worker with PID 1699406

At the same time there are a few errors reported in rpc_spoolss.

[2023/09/29 09:29:58,? 0]
../../source3/rpc_server/spoolss/srv_spoolss_util.c:57(winreg_printer_binding_handle)
? winreg_printer_binding_handle: Could not connect to winreg pipe:
NT_STATUS_CONNECTION_DISCONNECTED
[2023/09/29 09:31:30,? 0]
../../source3/rpc_server/rpc_worker.c:1125(rpc_worker_main)

Not sure if they are related I see the spoolss errors at different times without
the EPMAPPER error.

OS is bookworm and there is no socket /run/samba/ncalrpc/EPMAPPER here. Only the
one at /run/samba/ncalrpc/np/epmapper.

achim~