samba - Oct 2023 - rpc_pipe_open_ncalrpc: connect(/run/samba/ncalrpc/EPMAPPER) failed: No such file or directory

On Sun, 1 Oct 2023 08:41:01 +0300
Michael Tokarev via samba <samba at lists.samba.org> wrote:
> This question has already been asked in the past, but there was
> no answer.
> 
> The above message is logged quite often
> in /var/log/samba/log.samba-dcerpcd. This is a stand-alone anonymous
> read-only server.
> 
> Is it something to worry about?  It smells like samba isn't working
> properly.
This could be something as simple as the directory being created as
'/run/samba/ncalrpc/np/epmapper' and being searched for as
'/run/samba/ncalrpc/np/EPMAPPER'. Which may or may not matter,
depending on just what is supposed to end up in the 'emapper/EMAPPER'
directory. Interestingly, I have '/run/samba/ncalcrpc/np/emapper' and
'/run/samba/ncalrpc/EPMAPPER', I wonder if I should ?

To me, this sounds like a bug, should the directory be created as
'/run/samba/ncalrpc/np/EPMAPPER' or should it be searched for as
'/run/samba/ncalrpc/np/epmapper' ?
> 
> If yes, how can I fix it?
As a workaround, you could try setting 'log level = 0'.
> 
> If no, how can I stop samba from logging un-interesting messages?
> 
> What dcerpcd is used for to begin with?  I don't remember it running
> before (but iirc it is a new thing in 4.16).
Yes, it was introduced at 4.16.0 by the creation of the samba-dcerpcd
binary, which, if I understand it correctly, was created by removing
parts of the smbd binary and running them as a standalone binary. It
stands for 'Distributed Computing Environment/Remote Procedure Call',
you can find more info here:

http://www.dcerpc.org/

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15

https://wiki.samba.org/index.php/DCERPC

Rowland

01.10.2023 17:04, Rowland Penny via samba wrote:
> On Sun, 1 Oct 2023 08:41:01 +0300
> Michael Tokarev via samba <samba at lists.samba.org> wrote:
> 
>> This question has already been asked in the past, but there was
>> no answer.
>>
>> The above message is logged quite often
>> in /var/log/samba/log.samba-dcerpcd. This is a stand-alone anonymous
>> read-only server.
>>
>> Is it something to worry about?  It smells like samba isn't working
>> properly.
> 
> This could be something as simple as the directory being created as
> '/run/samba/ncalrpc/np/epmapper' and being searched for as
> '/run/samba/ncalrpc/np/EPMAPPER'. Which may or may not matter,
> depending on just what is supposed to end up in the
'emapper/EMAPPER'
> directory. Interestingly, I have '/run/samba/ncalcrpc/np/emapper'
and
> '/run/samba/ncalrpc/EPMAPPER', I wonder if I should ?
> 
> To me, this sounds like a bug, should the directory be created as
> '/run/samba/ncalrpc/np/EPMAPPER' or should it be searched for as
> '/run/samba/ncalrpc/np/epmapper' ?
I tried (sym)linking one to the other the first time it happened, - it
didn't work. I don't remember the error at that time though.  Think it
was with 4.16 still.  Lemme try it again..
>> If yes, how can I fix it?
> 
> As a workaround, you could try setting 'log level = 0'.
Nope, definitely not, - as I wrote before, this message fills in the
logs and *other* important messages are hidden in the flood as the
result.  I want to know if something bad happens, not to hide errors, -
this is why I asked in the first place.  I can change debug level of
this very message to be something larger than current 0 and recompile,
*that* would be real workaround.

But I'd rather find the root cause and fix it instead.

...
> http://www.dcerpc.org/
> 
>
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15
> 
> https://wiki.samba.org/index.php/DCERPC
I've one name forever associated with samba & dcerpc in my mind -
Luke Kenneth Casson Leighton.  I think he was the one who created
dcerpc.org. And he was the strong advocate to rewrite most things
in samba (samba2 at the time, iirc) to use dcerpc in late 1990s..
with lots of emails on samba mailing lists, and with a lot of
resistance around that.  Dunno where he is now..

/mjt