[Samba] Log entries with truncated service names

John H Terpstra - Samba Team jht at samba.org
Tue Oct 6 20:22:53 MDT 2009

On 10/06/2009 08:55 PM, Matthew Dickinson wrote:
> Hi,
> Situation:
> I'm seeing lots (~500k per day) of log entries like:
> smbd[13939]: itlab-pc06 (::ffff: couldn't find service it261
> In this case, the last character of the request is truncated - it should be
> it2610
> I'm seeing the same/similar issue to
> http://lists.samba.org/archive/samba/2009-March/147277.html
> I've dismissed this over the last few weeks as a minor inconvenience, but
> I'm now convinced that it's affecting the performance of the Windows client
> machines that are connecting to it - a 30 second operation on local disk,
> takes upwards of 5 mins over a network connection, generating thousands of
> entries similar to the above.
> This isn't unique - over the last 16 business hours (it's in a lab in a
> university dept.), there have been ~900k similar entries. It's also not just
> for this particular share, it's on all of the "home" shares that have been
> accessed, and also all of the 4 "defined" shares in smb.conf. Also, it's
> across many different hosts, and affecting different Windows OS's. My
> primary testing has been using Windows7 - I have a lab of 33 machines with
> this OS, but I believe I've also seen this from Windows XP and Vista hosts.
> Also, it's not restricted to this particular host:
> Turing (RHEL5) - tried versions samba-3.0.33-3.14.el5 samba3x-3.3.5-0.40.el5
> Babbage (RHEL4) exhibits the same, samba-3.0.33-0.17.el4
> Babbage which has higher use (in the last 48 hours), has seen a total of 150
> different host/service combinations from the logs, across different networks
> with different clients and different OS's.
> I've got output from "log level = 10" from turing, and I've got a tcpdump
> from the server end with the communication with one of the machines.
> Interestingly, the truncated request is visible in wireshark. I'd rather not
> share the complete set of logs publically on the list, but will send
> off-list to others (that and they're ~2MB).
> Please let me know any further debugging steps that are necessary.
> Thanks,
> Matthew

Please file a bug report on https://bugzilla.samba.org and upload the
logfiles as part of the bug report.  Also, please provide as much info
as necessary so that one of the Samba developers can reproduce the
problem.  Thanks.

- John Terpstra

More information about the samba mailing list