[Samba] Samba-LDAP with 100%CPU with connections in CLOSE_WAIT

[Andrew Bartlett]

On Tue, 2022-09-20 at 16:16 +0200, Steffen via samba wrote:
> On 19.09.22 19:24, Jeremy Allison wrote:
> > On Mon, Sep 19, 2022 at 05:20:04PM +0200, Steffen via samba wrote:
> > > Hi,
> > > 
> > > since some time we are facing a small problem:
> > > 
> > > 
> > > We are using samba (4.15.9-15) as AD-DC. As clients we have some
> > > NetAPP-FAS running which doing the auth. via LDAP. On NetApp
> > > timeouts for LDAP are set to 3sec per default.
> > > 
> > > Some queries seem to need more time to answer so the client tries
> > > to close the connection but the (samba-)server-part leaves the
> > > socket open in CLOSE_WAIT.
> > > 
> > > In some of such cases the corresponding process (ldap-worker)
> > > runs forever(?) with 100% cpu. A strace shows the ldap-worker
> > > pushing some info (the answer?)  to the socket. If one let it go
> > > the server slows down gradually while more and more connections
> > > stay in CLOSE_WAIT.
> > 
> > Can you post an strace, followed by a stack backtrace
> > from gdb of an ldap-worker process in such a state.
> > 
> > That would help debug - thanks !
> 
> just two remarks:
> 
> a) Do you think a bt from a no-debug-version  is enough?
> 
> b) .. because i have setup some timeouts a little bit higher maybe we
> have to wait a few days (2 or 3) ..

The more detail the better, honestly.  So if you can install a build
with debug symbols, that will get us a better backtrace, and if you can
get the FlameGraph, even better.

Even without the timeouts set a flame graph will likely still show
where we are hot, if the queries are made with any regularity. 

Andrew Bartlett
-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions