[Samba] Log entries with truncated service names

Matthew Dickinson matt-samba at alpha345.com
Tue Oct 6 19:55:52 MDT 2009



I'm seeing lots (~500k per day) of log entries like:
smbd[13939]: itlab-pc06 (::ffff: couldn't find service it261

In this case, the last character of the request is truncated - it should be

I'm seeing the same/similar issue to

I've dismissed this over the last few weeks as a minor inconvenience, but
I'm now convinced that it's affecting the performance of the Windows client
machines that are connecting to it - a 30 second operation on local disk,
takes upwards of 5 mins over a network connection, generating thousands of
entries similar to the above.

This isn't unique - over the last 16 business hours (it's in a lab in a
university dept.), there have been ~900k similar entries. It's also not just
for this particular share, it's on all of the "home" shares that have been
accessed, and also all of the 4 "defined" shares in smb.conf. Also, it's
across many different hosts, and affecting different Windows OS's. My
primary testing has been using Windows7 - I have a lab of 33 machines with
this OS, but I believe I've also seen this from Windows XP and Vista hosts.

Also, it's not restricted to this particular host:
Turing (RHEL5) - tried versions samba-3.0.33-3.14.el5 samba3x-3.3.5-0.40.el5
Babbage (RHEL4) exhibits the same, samba-3.0.33-0.17.el4

Babbage which has higher use (in the last 48 hours), has seen a total of 150
different host/service combinations from the logs, across different networks
with different clients and different OS's.

I've got output from "log level = 10" from turing, and I've got a tcpdump
from the server end with the communication with one of the machines.
Interestingly, the truncated request is visible in wireshark. I'd rather not
share the complete set of logs publically on the list, but will send
off-list to others (that and they're ~2MB).

Please let me know any further debugging steps that are necessary.



More information about the samba mailing list