[Samba] need win2k help

Tony Ricker rickera2 at SLU.EDU
Mon Mar 4 14:38:18 GMT 2002 

All,
	I have a Redhat linux 7.2 with samba 2.2.1a-4 acting as a PDC. Win9x
machines can log on fine. I am having trouble with a win2k box. I have
received replies to previous posts yet none of the suggestions help or
my problem is something different. Attached is the log a the win2k box,
and I can not put my finger on the problem. On the win2k side the error
is "user does not exist" yet here is the relevant info:

- smbpasswd root entry (password DOES NOT match /etc/passwd)
[root at sifl samba]# cat /etc/samba/smbpasswd | grep root
root:0:9ED488E58B54748F97CA2AA55C0F3449:26B7517FC9B12BDC30F8B11C82BAC3DF:[U         
]:LCT-3C83F248:

-passwd root entry
[root at sifl samba]# cat /etc/passwd | grep root
root:x:0:0:root:/root:/bin/bash

-machine user account
[root at sifl samba]# cat /etc/samba/smbpasswd | grep PMOIMAGE
PMOIMAGE$:649:37BF4D6034D200A117306D272A9441BB:319856137E6F014903795C0D5B2458F1:[U         
]:LCT-3C83A1BC:win2k

I hope someone can decipher the logs and pinpoint my issue. I appreciate
the time.

Cheers,
Tony
-------------- next part --------------
[2002/03/04 16:17:02, 5] passdb/smbpass.c:getsmbfilepwent(373)
  getsmbfilepwent: returning passwd entry for user root, uid 0
[2002/03/04 16:17:02, 5] passdb/smbpass.c:getsmbfilepwent(423)
  getsmbfilepwent: end of file reached.
[2002/03/04 16:17:02, 3] smbd/sec_ctx.c:pop_sec_ctx(423)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 samr_io_r_open_user 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0000 data1: 00000000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0004 data2: 00000000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          0008 data3: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          000a data4: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8s(573)
          000c data5: 00 00 00 00 00 00 00 00 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      0014 status: c0000064
[2002/03/04 16:17:02, 5] rpc_server/srv_samr.c:api_samr_open_user(393)
  samr_open_user: 393
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe.c:api_rpcTNP(1226)
  api_rpcTNP: called api_samr_rpc successfully
[2002/03/04 16:17:02, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(417)
  free_pipe_context: destroying talloc pool of size 0
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 smb_io_rpc_hdr hdr
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0000 major     : 05
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0001 minor     : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0002 pkt_type  : 02
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0003 flags     : 03
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0004 pack_type0: 10
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0005 pack_type1: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0006 pack_type2: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0007 pack_type3: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0008 frag_len  : 0030
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      000a auth_len  : 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      000c call_id   : 00000005
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000010 smb_io_rpc_hdr_resp resp
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      0010 alloc_hint: 00000018
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0014 context_id: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0016 cancel_ct : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0017 reserved  : 00
[2002/03/04 16:17:02, 5] smbd/ipc.c:copy_trans_params_and_data(63)
  copy_trans_params_and_data: params[0..0] data[0..48]
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=104
  smb_com=0x25
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=1
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=212
  smb_uid=100
  smb_mid=2496
  smt_wct=10
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[0]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[1]=48 (0x30)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[2]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[3]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[4]=56 (0x38)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[5]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[6]=48 (0x30)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[7]=56 (0x38)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[8]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[9]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=49
[2002/03/04 16:17:02, 3] smbd/process.c:process_smb(837)
  Transaction 41 of length 124
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=120
  smb_com=0x25
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=2055
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=212
  smb_uid=100
  smb_mid=2560
  smt_wct=16
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[0]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[1]=44 (0x2C)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[2]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[3]=1024 (0x400)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[4]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[5]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[6]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[7]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[8]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[9]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[10]=76 (0x4C)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[11]=44 (0x2C)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[12]=76 (0x4C)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[13]=2 (0x2)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[14]=38 (0x26)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[15]=28731 (0x703B)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=53
[2002/03/04 16:17:02, 3] smbd/process.c:switch_message(650)
  switch message SMBtrans (pid 27755)
[2002/03/04 16:17:02, 4] smbd/uid.c:become_user(119)
  Skipping become_user - already user
[2002/03/04 16:17:02, 3] smbd/ipc.c:reply_trans(484)
  trans <\PIPE\> data=44 params=0 setup=2
[2002/03/04 16:17:02, 5] smbd/ipc.c:reply_trans(504)
  calling named_pipe
[2002/03/04 16:17:02, 3] smbd/ipc.c:named_pipe(336)
  named pipe command on <> name
[2002/03/04 16:17:02, 5] smbd/ipc.c:api_fd_reply(277)
  api_fd_reply
[2002/03/04 16:17:02, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(952)
  search for pipe pnum=703b
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(955)
  pipe name samr pnum=703b (pipes_open=2)
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(955)
  pipe name lsarpc pnum=7036 (pipes_open=2)
[2002/03/04 16:17:02, 3] smbd/ipc.c:api_fd_reply(298)
  Got API command 0x26 on pipe "samr" (pnum 703b)000000 smb_io_rpc_hdr 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0000 major     : 05
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0001 minor     : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0002 pkt_type  : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0003 flags     : 03
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0004 pack_type0: 10
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0005 pack_type1: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0006 pack_type2: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0007 pack_type3: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0008 frag_len  : 002c
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      000a auth_len  : 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      000c call_id   : 00000006
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(360)
  unmarshall_rpc_header: using little-endian RPC
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 smb_io_rpc_hdr_req req
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      0000 alloc_hint: 00000014
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0004 context_id: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0006 opnum     : 0001
[2002/03/04 16:17:02, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(417)
  free_pipe_context: destroying talloc pool of size 0
[2002/03/04 16:17:02, 3] rpc_server/srv_pipe.c:api_pipe_request(1163)
  Doing \PIPE\samr
[2002/03/04 16:17:02, 4] rpc_server/srv_pipe.c:api_rpcTNP(1188)
  api_rpcTNP: api_samr_rpc op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 samr_io_q_close_hnd 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0000 data1: 00000000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0004 data2: 00000007
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          0008 data3: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          000a data4: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8s(573)
          000c data5: 5e f2 83 3c 6b 6c 00 00 
[2002/03/04 16:17:02, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(150)
  Found policy hnd[0] [000] 00 00 00 00 07 00 00 00  00 00 00 00 5E F2 83 3C  ........ ....^..<
[2002/03/04 16:17:02, 4] lib/util.c:dump_data(1489)
  [010] 6B 6C 00 00                                       kl.. 
[2002/03/04 16:17:02, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(186)
  Closed policy
[2002/03/04 16:17:02, 5] rpc_server/srv_samr_nt.c:_samr_close_hnd(455)
  samr_reply_close_hnd: 455
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 samr_io_r_close_hnd 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0000 data1: 00000000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0004 data2: 00000000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          0008 data3: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          000a data4: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8s(573)
          000c data5: 00 00 00 00 00 00 00 00 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      0014 status: 00000000
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe.c:api_rpcTNP(1226)
  api_rpcTNP: called api_samr_rpc successfully
[2002/03/04 16:17:02, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(417)
  free_pipe_context: destroying talloc pool of size 0
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 smb_io_rpc_hdr hdr
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0000 major     : 05
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0001 minor     : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0002 pkt_type  : 02
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0003 flags     : 03
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0004 pack_type0: 10
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0005 pack_type1: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0006 pack_type2: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0007 pack_type3: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0008 frag_len  : 0030
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      000a auth_len  : 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      000c call_id   : 00000006
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000010 smb_io_rpc_hdr_resp resp
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      0010 alloc_hint: 00000018
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0014 context_id: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0016 cancel_ct : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0017 reserved  : 00
[2002/03/04 16:17:02, 5] smbd/ipc.c:copy_trans_params_and_data(63)
  copy_trans_params_and_data: params[0..0] data[0..48]
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=104
  smb_com=0x25
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=1
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=212
  smb_uid=100
  smb_mid=2560
  smt_wct=10
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[0]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[1]=48 (0x30)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[2]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[3]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[4]=56 (0x38)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[5]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[6]=48 (0x30)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[7]=56 (0x38)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[8]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[9]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=49
[2002/03/04 16:17:02, 3] smbd/process.c:process_smb(837)
  Transaction 42 of length 124
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=120
  smb_com=0x25
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=2055
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=212
  smb_uid=100
  smb_mid=2624
  smt_wct=16
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[0]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[1]=44 (0x2C)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[2]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[3]=1024 (0x400)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[4]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[5]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[6]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[7]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[8]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[9]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[10]=76 (0x4C)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[11]=44 (0x2C)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[12]=76 (0x4C)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[13]=2 (0x2)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[14]=38 (0x26)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[15]=28731 (0x703B)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=53
[2002/03/04 16:17:02, 3] smbd/process.c:switch_message(650)
  switch message SMBtrans (pid 27755)
[2002/03/04 16:17:02, 4] smbd/uid.c:become_user(119)
  Skipping become_user - already user
[2002/03/04 16:17:02, 3] smbd/ipc.c:reply_trans(484)
  trans <\PIPE\> data=44 params=0 setup=2
[2002/03/04 16:17:02, 5] smbd/ipc.c:reply_trans(504)
  calling named_pipe
[2002/03/04 16:17:02, 3] smbd/ipc.c:named_pipe(336)
  named pipe command on <> name
[2002/03/04 16:17:02, 5] smbd/ipc.c:api_fd_reply(277)
  api_fd_reply
[2002/03/04 16:17:02, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(952)
  search for pipe pnum=703b
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(955)
  pipe name samr pnum=703b (pipes_open=2)
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(955)
  pipe name lsarpc pnum=7036 (pipes_open=2)
[2002/03/04 16:17:02, 3] smbd/ipc.c:api_fd_reply(298)
  Got API command 0x26 on pipe "samr" (pnum 703b)000000 smb_io_rpc_hdr 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0000 major     : 05
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0001 minor     : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0002 pkt_type  : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0003 flags     : 03
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0004 pack_type0: 10
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0005 pack_type1: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0006 pack_type2: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0007 pack_type3: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0008 frag_len  : 002c
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      000a auth_len  : 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      000c call_id   : 00000007
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(360)
  unmarshall_rpc_header: using little-endian RPC
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 smb_io_rpc_hdr_req req
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      0000 alloc_hint: 00000014
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0004 context_id: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0006 opnum     : 0001
[2002/03/04 16:17:02, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(417)
  free_pipe_context: destroying talloc pool of size 0
[2002/03/04 16:17:02, 3] rpc_server/srv_pipe.c:api_pipe_request(1163)
  Doing \PIPE\samr
[2002/03/04 16:17:02, 4] rpc_server/srv_pipe.c:api_rpcTNP(1188)
  api_rpcTNP: api_samr_rpc op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 samr_io_q_close_hnd 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0000 data1: 00000000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0004 data2: 00000006
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          0008 data3: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          000a data4: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8s(573)
          000c data5: 5e f2 83 3c 6b 6c 00 00 
[2002/03/04 16:17:02, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(150)
  Found policy hnd[0] [000] 00 00 00 00 06 00 00 00  00 00 00 00 5E F2 83 3C  ........ ....^..<
[2002/03/04 16:17:02, 4] lib/util.c:dump_data(1489)
  [010] 6B 6C 00 00                                       kl.. 
[2002/03/04 16:17:02, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(186)
  Closed policy
[2002/03/04 16:17:02, 5] rpc_server/srv_samr_nt.c:_samr_close_hnd(455)
  samr_reply_close_hnd: 455
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 samr_io_r_close_hnd 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0000 data1: 00000000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0004 data2: 00000000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          0008 data3: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          000a data4: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8s(573)
          000c data5: 00 00 00 00 00 00 00 00 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      0014 status: 00000000
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe.c:api_rpcTNP(1226)
  api_rpcTNP: called api_samr_rpc successfully
[2002/03/04 16:17:02, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(417)
  free_pipe_context: destroying talloc pool of size 0
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 smb_io_rpc_hdr hdr
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0000 major     : 05
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0001 minor     : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0002 pkt_type  : 02
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0003 flags     : 03
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0004 pack_type0: 10
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0005 pack_type1: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0006 pack_type2: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0007 pack_type3: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0008 frag_len  : 0030
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      000a auth_len  : 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      000c call_id   : 00000007
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000010 smb_io_rpc_hdr_resp resp
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      0010 alloc_hint: 00000018
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0014 context_id: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0016 cancel_ct : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0017 reserved  : 00
[2002/03/04 16:17:02, 5] smbd/ipc.c:copy_trans_params_and_data(63)
  copy_trans_params_and_data: params[0..0] data[0..48]
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=104
  smb_com=0x25
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=1
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=212
  smb_uid=100
  smb_mid=2624
  smt_wct=10
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[0]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[1]=48 (0x30)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[2]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[3]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[4]=56 (0x38)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[5]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[6]=48 (0x30)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[7]=56 (0x38)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[8]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[9]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=49
[2002/03/04 16:17:02, 3] smbd/process.c:process_smb(837)
  Transaction 43 of length 45
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=41
  smb_com=0x4
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=2055
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=65279
  smb_uid=100
  smb_mid=2688
  smt_wct=3
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[0]=28731 (0x703B)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[1]=65535 (0xFFFF)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[2]=65535 (0xFFFF)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=0
[2002/03/04 16:17:02, 3] smbd/process.c:switch_message(650)
  switch message SMBclose (pid 27755)
[2002/03/04 16:17:02, 4] smbd/uid.c:become_user(119)
  Skipping become_user - already user
[2002/03/04 16:17:02, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(952)
  search for pipe pnum=703b
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(955)
  pipe name samr pnum=703b (pipes_open=2)
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(955)
  pipe name lsarpc pnum=7036 (pipes_open=2)
[2002/03/04 16:17:02, 5] smbd/pipes.c:reply_pipe_close(257)
  reply_pipe_close: pnum:703b
[2002/03/04 16:17:02, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(915)
  closed pipe name samr pnum=703b (pipes_open=1)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=35
  smb_com=0x4
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=1
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=65279
  smb_uid=100
  smb_mid=2688
  smt_wct=0
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=0
[2002/03/04 16:17:02, 3] smbd/process.c:process_smb(837)
  Transaction 44 of length 124
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=120
  smb_com=0x25
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=2055
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=212
  smb_uid=100
  smb_mid=2752
  smt_wct=16
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[0]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[1]=44 (0x2C)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[2]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[3]=1024 (0x400)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[4]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[5]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[6]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[7]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[8]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[9]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[10]=76 (0x4C)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[11]=44 (0x2C)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[12]=76 (0x4C)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[13]=2 (0x2)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[14]=38 (0x26)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[15]=28726 (0x7036)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=53
[2002/03/04 16:17:02, 3] smbd/process.c:switch_message(650)
  switch message SMBtrans (pid 27755)
[2002/03/04 16:17:02, 4] smbd/uid.c:become_user(119)
  Skipping become_user - already user
[2002/03/04 16:17:02, 3] smbd/ipc.c:reply_trans(484)
  trans <\PIPE\> data=44 params=0 setup=2
[2002/03/04 16:17:02, 5] smbd/ipc.c:reply_trans(504)
  calling named_pipe
[2002/03/04 16:17:02, 3] smbd/ipc.c:named_pipe(336)
  named pipe command on <> name
[2002/03/04 16:17:02, 5] smbd/ipc.c:api_fd_reply(277)
  api_fd_reply
[2002/03/04 16:17:02, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(952)
  search for pipe pnum=7036
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(955)
  pipe name lsarpc pnum=7036 (pipes_open=1)
[2002/03/04 16:17:02, 3] smbd/ipc.c:api_fd_reply(298)
  Got API command 0x26 on pipe "lsarpc" (pnum 7036)000000 smb_io_rpc_hdr 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0000 major     : 05
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0001 minor     : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0002 pkt_type  : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0003 flags     : 03
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0004 pack_type0: 10
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0005 pack_type1: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0006 pack_type2: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0007 pack_type3: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0008 frag_len  : 002c
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      000a auth_len  : 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      000c call_id   : 00000004
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(360)
  unmarshall_rpc_header: using little-endian RPC
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 smb_io_rpc_hdr_req req
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      0000 alloc_hint: 00000014
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0004 context_id: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0006 opnum     : 0000
[2002/03/04 16:17:02, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(417)
  free_pipe_context: destroying talloc pool of size 0
[2002/03/04 16:17:02, 3] rpc_server/srv_pipe.c:api_pipe_request(1163)
  Doing \PIPE\lsarpc
[2002/03/04 16:17:02, 4] rpc_server/srv_pipe.c:api_rpcTNP(1188)
  api_rpcTNP: api_ntlsa_rpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 lsa_io_q_close 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0000 data1: 00000000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0004 data2: 00000001
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          0008 data3: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          000a data4: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8s(573)
          000c data5: 5d f2 83 3c 6b 6c 00 00 
[2002/03/04 16:17:02, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(150)
  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 5D F2 83 3C  ........ ....]..<
[2002/03/04 16:17:02, 4] lib/util.c:dump_data(1489)
  [010] 6B 6C 00 00                                       kl.. 
[2002/03/04 16:17:02, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(150)
  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 5D F2 83 3C  ........ ....]..<
[2002/03/04 16:17:02, 4] lib/util.c:dump_data(1489)
  [010] 6B 6C 00 00                                       kl.. 
[2002/03/04 16:17:02, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(186)
  Closed policy
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 lsa_io_r_close 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0000 data1: 00000000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
          0004 data2: 00000000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          0008 data3: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
          000a data4: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8s(573)
          000c data5: 00 00 00 00 00 00 00 00 
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      0014 status: 00000000
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe.c:api_rpcTNP(1226)
  api_rpcTNP: called api_ntlsa_rpc successfully
[2002/03/04 16:17:02, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(417)
  free_pipe_context: destroying talloc pool of size 0
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000000 smb_io_rpc_hdr hdr
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0000 major     : 05
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0001 minor     : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0002 pkt_type  : 02
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0003 flags     : 03
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0004 pack_type0: 10
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0005 pack_type1: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0006 pack_type2: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0007 pack_type3: 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0008 frag_len  : 0030
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      000a auth_len  : 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      000c call_id   : 00000004
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_debug(63)
  000010 smb_io_rpc_hdr_resp resp
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint32(547)
      0010 alloc_hint: 00000018
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint16(518)
      0014 context_id: 0000
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0016 cancel_ct : 00
[2002/03/04 16:17:02, 5] rpc_parse/parse_prs.c:prs_uint8(489)
      0017 reserved  : 00
[2002/03/04 16:17:02, 5] smbd/ipc.c:copy_trans_params_and_data(63)
  copy_trans_params_and_data: params[0..0] data[0..48]
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=104
  smb_com=0x25
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=1
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=212
  smb_uid=100
  smb_mid=2752
  smt_wct=10
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[0]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[1]=48 (0x30)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[2]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[3]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[4]=56 (0x38)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[5]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[6]=48 (0x30)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[7]=56 (0x38)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[8]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[9]=0 (0x0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=49
[2002/03/04 16:17:02, 3] smbd/process.c:process_smb(837)
  Transaction 45 of length 45
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=41
  smb_com=0x4
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=2055
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=65279
  smb_uid=100
  smb_mid=2816
  smt_wct=3
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[0]=28726 (0x7036)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[1]=65535 (0xFFFF)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(302)
  smb_vwv[2]=65535 (0xFFFF)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=0
[2002/03/04 16:17:02, 3] smbd/process.c:switch_message(650)
  switch message SMBclose (pid 27755)
[2002/03/04 16:17:02, 4] smbd/uid.c:become_user(119)
  Skipping become_user - already user
[2002/03/04 16:17:02, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(952)
  search for pipe pnum=7036
[2002/03/04 16:17:02, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(955)
  pipe name lsarpc pnum=7036 (pipes_open=1)
[2002/03/04 16:17:02, 5] smbd/pipes.c:reply_pipe_close(257)
  reply_pipe_close: pnum:7036
[2002/03/04 16:17:02, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(915)
  closed pipe name lsarpc pnum=7036 (pipes_open=0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=35
  smb_com=0x4
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=1
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=65279
  smb_uid=100
  smb_mid=2816
  smt_wct=0
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=0
[2002/03/04 16:17:02, 3] smbd/process.c:process_smb(837)
  Transaction 46 of length 39
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=35
  smb_com=0x71
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=2055
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=65279
  smb_uid=100
  smb_mid=2880
  smt_wct=0
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=0
[2002/03/04 16:17:02, 3] smbd/process.c:switch_message(650)
  switch message SMBtdis (pid 27755)
[2002/03/04 16:17:02, 3] smbd/sec_ctx.c:set_sec_ctx(316)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2002/03/04 16:17:02, 5] smbd/uid.c:unbecome_user(216)
  unbecome_user now uid=(0,0) gid=(0,0)
[2002/03/04 16:17:02, 3] smbd/sec_ctx.c:set_sec_ctx(316)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2002/03/04 16:17:02, 5] smbd/uid.c:unbecome_user(216)
  unbecome_user now uid=(0,0) gid=(0,0)
[2002/03/04 16:17:02, 3] smbd/service.c:close_cnum(644)
  pmoimage (165.134.134.9) closed connection to service IPC$
[2002/03/04 16:17:02, 3] smbd/connection.c:yield_connection(50)
  Yielding connection to IPC$
[2002/03/04 16:17:02, 3] smbd/sec_ctx.c:set_sec_ctx(316)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2002/03/04 16:17:02, 5] smbd/uid.c:unbecome_user(216)
  unbecome_user now uid=(0,0) gid=(0,0)
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(285)
  size=35
  smb_com=0x71
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=1
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(293)
  smb_tid=1
  smb_pid=65279
  smb_uid=100
  smb_mid=2880
  smt_wct=0
[2002/03/04 16:17:02, 5] lib/util.c:show_msg(308)
  smb_bcc=0
[2002/03/04 16:17:02, 3] smbd/process.c:timeout_processing(1062)
  end of file from client
[2002/03/04 16:17:02, 3] smbd/sec_ctx.c:set_sec_ctx(316)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2002/03/04 16:17:02, 5] smbd/uid.c:unbecome_user(216)
  unbecome_user now uid=(0,0) gid=(0,0)
[2002/03/04 16:17:02, 2] smbd/server.c:exit_server(448)
  Closing connections
[2002/03/04 16:17:02, 3] smbd/connection.c:yield_connection(50)
  Yielding connection to 
[2002/03/04 16:17:02, 3] smbd/server.c:exit_server(483)
  Server exit (normal exit)

More information about the samba mailing list