samba smbd process looping : Samba 2.2.1

[Boswell Andrew Dr (ITCS) s139]

Hi Samba and Samba-ntdom lists,

We have been running Samba 2.2.1 since it came out July 11th on a cluster of
Compaq Tru 64 machines.  

Since our students returned last week (using NT workstations in our labs.),
we have been having a problem of looping Samba processes occuring and
hogging CPU eg from a typical ps, 14 mins of CPU:
 
 PSR USER     RUSER       PID   PPID %CPU %MEM   VSZ  RSS        TIME
STARTED   NI COMMAND
   0 <user> root      31846    517 33.5  0.6 6.51M 1.8M    14:23.99 13:05:23
10 smbd

Across 4 servers, we've had 11 incidents of this in the last 24 hours.  

It is quite probable that this has been occuring for a while (ie since
2.2.1) but we have only noticed now with hundreds of students using the
system.
A trace on the processes shows:

cpca5 # trace -p 9504
Tracing process /proc/09504
fcntl (10, 9, 0x11fffeac0) = 0
fcntl (10, 9, 0x11fffeac0) = 0
fcntl (10, 9, 0x11fffeac0) = 0
fcntl (10, 9, 0x11fffeac0) = 0
fcntl (10, 9, 0x11fffeac0) = 0
fcntl (10, 9, 0x11fffeac0) = 0
fcntl (10, 9, 0x11fffeac0) = 0
....
etc - it just goes on & on like this with no other calls that I can see.
Some sort of file locking?

It has been difficult to relate the incidents to particular applications
running on the Windows client machines as if things go slow the students
will just tend to leave the machine.   However, yesterday, I did manage to
relate one case yesterday to a user running a VirusScan over their files on
the Samba share - this was the only access to the drive they had made.
Stopping the Virus Scanner didn't stop the looping process. If the process
was killed before the Virus Scanner was stopped, it restarted.  However,
once the Vuris Scanner was stopped, the process was killed and didn't
restart.  Strange.  Although, the runaway process appears to be
disconnected, it is not completely. 

Does anyone know / can help with:
- the reason for this
- end user applications likely to cause it.  I suspect its more general than
the Virus Scanner.
- preventative measures

I have put up crontab scripts to kill the processes after 10 mins of CPU,
but even this hits the servers before the scripts cut in.

With thanks in advance


Andrew   

=========================================
Dr Andrew Boswell	              email : A.Boswell at uea.ac.uk	
School Liaison Consultant       phone : +44-1603-593856
IT and Computing Services       fax   : +44-1603-593467
University of East Anglia	  Room  : ITCS 0.09A
Norwich, NR4 7TJ, UK