[Samba] smbstatus - switched off computers are sometimes showed

[Vlastimil Šetka]

Volker Lendecke wrote:
> On Fri, Sep 19, 2008 at 10:02:02PM +0200, Vlastimil Šetka wrote:
>  
>> I have a Samba server configured as PDC for ~100 computers. It's 
>> version 3.0.24 running on Debian Etch (distribution package).
>>
>> I want to write a tool for user logon/logoff tracking. Because 
>> parsing log files is hard job (windows frequently disconnets or 
>> connects during user session or etc.) I decide to use smbstatus 
>> output which seem to be reliable.
>>
>> So I run smbstatus binary every 10 seconds, parse the output and all 
>> is fine. But sometimes in the smbstatus output is show computer which 
>> is several hours switched off. At the next run (after 10s) this 
>> record is not presented. Sometimes this "ghost" record is shown for 
>> ~30 seconds.
>>     
> Does that smbd still exist? If computers are just switched
> off then Samba might not notice.
>   
I plan to check it but it's complicated because the "ghost" record is 
presented only for several seconds. I have to log the PID and related 
"ps" output.
Smbstatus checks if the proccess with the PID still exists. So if it's 
showed the smbd probably exists.
The computer is really switched off for several hours when this issue is 
presented. I also check the log file and there is no activity at this 
time. Today there were two "ghost" records for two different users on 
one computer - this computer is switched off for > 24 hours and this two 
users were loged in during last 3 days.
>> Example:
>>
>> 11:10:21 - MACHINE1/USER1 - is in smbstatus
>> ... constantly is in smbstatus
>> 12:14:11 - MACHINE1/USER1 - is NOT in smbstatus
>> 12:15:21 - MACHINE1/USER2 - is in smbstatus
>> ...
>> 12:45:31 - MACHINE1/USER2 - is NOT in smbstatus
>> Now the MACHINE1 is switched off.
>> 18:16:21 - MACHINE1/USER1 - is in smbstatus !! (and the MACHINE1 is 
>> switched off several hours!)
>> 18:16:31 - MACHINE1/USER1 - is NOT in smbstatus
>>
>> Sometimes (cca twice a day) smbstatus return error output like this:
>>  tdb(/var/run/samba/sessionid.tdb): rec_read bad magic 0xd9fee666 at 
>> offset=116988
>>     
> This is normal. Smbstatus reads the tdb files in read-only
> mode. This implies no locking which in turn might lead to
> smbstatus reading an inconsistent tdb file.
>   
Yes. In sources I notice that no locking is used. Smbstatus only reads 
the file so it's OK. I also want to use INOTIFY on sessionid.tdb file 
but it's not usable because smbd has the file constantly open for write.
> Volker