[Samba] Closing sessions and smbstatus

[Steve Rippl]

On Mon, 2008-10-20 at 21:10 +0200, Vlastimil Šetka wrote:
> > Hi,
> >
> > When are client sessions closed?  
> >
> > Let me explain what I'm trying to do...  we're in a School district and
> > we try to stop kids logging more than once.  They way I did this before
> > was to dump the active sessions from our previous Server2003 fileserver
> > into a file once a minute and process it with a Perl script to check who
> > was connected from where, rebooting machines remotely as needed!  This
> > work well enough with the odd 'hung' session causing minor problems.
> >   
> I'm in exactly the same situation. The school, PDC for ~100 computers, 
> hundreds of users.
> We need to track the logon / logoff. I can't find any usable tools so I 
> made my own system.
> I found that most reliable is the smbstatus output. Windows do strange 
> thinks with connections during domain logons so use of preexec script is 
> complicated.
> By the Perl script I run smbstatus every 5 seconds, scan the changes 
> from previous run and write it to the MySQL DB. That's all woks fine.
> > So now I'm trying to do the same thing with our new Samba (3.0.31)
> > fileserver using the output from smbstatus.  However, in many cases
> > sessions are still in there long after the user has logged out of the
> > machine.  I'm even seeing two sessions for different people on the same
> > machine with the same pid number!  How is this working?  Why are not all
> > sessions ending when the user logs off?  Am I going to be able to use
> > this for what I'm trying to do?!!
> >   
> I have some problems with this too. See this thread:
>   [Samba] smbstatus - switched off computers are sometimes showed
>   http://lists.samba.org/archive/samba/2008-September/143701.html
> 
> Now I get some new experience with it. The main problem is that samba 
> sometimes doesn't update the sessionid.tdb file when the process exits. 
> This records is not showed in smbstatus output, because smbstatus checks 
> if the PID exists. I patched the smbstatus so it showed me that there is 
> the records with no related PID. Then, maybe after 1 day or so, this PID 
> is used for other proccess and I can see the "ghost" logon in my 
> tracking system (and in most cases logoff at next run - after 5 seconds).
> On the list is now the thread "[Samba] processes not closing" where is 
> described some self-repair function related do sessionid.tdf file. The 
> samba process when writing to this file should check all records and 
> delete it if the PID doesn't exist. It will be nice but In my situation 
> it doesn't work. Maybe it's because of Samba version (3.0.24, official 
> Debian Etch package).

But checking our server I find that the processes DO still exist!  So
I'm getting a user session in smbstatus with a specific PID and when I
ps -ef | grep PID there is the smbd process still running, yet the user
has long since logged out (days ago)?!  It's not just that the .tbd file
hasn't been updated, it's that the /usr/local/bin/smbd process is still
running.  A restart of Samba clears them all up immediately, but why are
they hanging around when the client is gone?  Is this just happening to
me on our particular setup or is this normal behavior?

Thanks.