[Samba] nmbd causing very high CPU utilization

[Windsor Dave (AdW/MOE2.1)]

On HP-UX 11, tusc is the truss equivilent, but on HP-UX 10.20,
trace corresponds to truss.  I'm in the process of trying to
get trace working - I keep getting bad address errors, no
matter what process I attempt to trace.  I've never tried to
use strace - on my system the man page describes it as
"strace - write STREAMS event trace messages to standard output".
Perhaps not the same thing?

As for the unexpected.tdb, the size is increasing - it will go for
long periods where the size doesn't increase but the modification
time does, then the size will increase.  It is currently at 
163840 bytes, if that's meaningful.

Best Regards,

Dave Windsor
AdW/MOE2.12
Team Leader, Test Systems Engineering
Robert Bosch Corporation
Anderson, SC, USA
Voice: (864) 260-8459
Fax:   (864) 260-8142
email: mailto:Dave.Windsor at us.bosch.com



-----Original Message-----
From: jra at samba.org [mailto:jra at samba.org]
Sent: Wednesday, June 26, 2002 4:18 PM
To: Windsor Dave (AdW/MOE2.1)
Cc: 'samba at samba.org'
Subject: Re: [Samba] nmbd causing very high CPU utilization


On Wed, Jun 26, 2002 at 03:51:54PM -0400, Windsor Dave (AdW/MOE2.1) wrote:
> Does anyone have any idea what can cause nmbd to begin gobbling CPU?
> We are running Samba 2.2.4 on HP-UX 10.20, having upgraded from Samba
> 2.0.10 about a month ago.  Our clients are a mixture of NT 4.0 and Win2K.
> Today, we have begun to see widespread client drive disconnections, and
> nmbd is averaging 60%+ CPU usage with peaks up to 100%.  We have heard
> reports of network problems at our site affecting clients that do not 
> connect to my HP/Samba servers, so I'm wondering if the high CPU usage 
> is a reflection of nmbd trying to cope with problems or a
> symptom that they might be causing them instead.  There seems to be
nothing
> out of the ordinary in the nmbd log, but my client smbd logs are full of
the
> infamous "Connection reset by peer" messages.  I have my site IS group
> investigating this (I'm in an engineering group, but we normally provide
> production IS support ourselves except for site-wide network issues), but
> have not heard from them yet.
> 
> This particular server supports production at my manufacturing site, so
> I cannot easily shut it down.

Can you do the equivalent of an strace or truss onnmbd under HPUX 10.x ?
If so that may tell you what it is doing. Is the unexpected packet
database in unexpected.tdb growing ?

Jeremy.