[Samba] Can Constant Failed Connection Attempts Crash a Server?

[Andy Liebman]

On 11/24/2010 03:47 PM, Volker Lendecke wrote:
> On Wed, Nov 24, 2010 at 03:03:33PM -0500, Andy Liebman wrote:
>> You suggested previously this might be a kernel bug, or that the
>> failed attempts might be using up some scarce resource (memory? open
>> files? what did you have in mind?) Assuming we can reproduce this
>> issue, what do you suggest would be the best way to start debugging
>> it?  I don't think running Samba with more logging or debugging is
>> going to help.  Suppose we can continually run vmstat and write the
>> results to a log file.  Anything else you can think of?
> That is one. Another one is to run "top" in batch mode and
> send stdout to a file. From there you might monitor swap
> space and see if used swap increases. If it does, see what
> process grows.
>
> If you have a constantly growing smbd, send it the
>
> smbcontrol<smbd-pid>  pool-usage
>
> message and send us the output.
>
> Volker
Hello Volker,

We have not been able to reproduce this problem in house, but we 
continue to have several servers in the field that are freezing up 
whenever we get these hundreds of thousands of unsuccessful connection 
attempts.  Sometimes it can take weeks to crash.  Sometimes it's days.  
We tried getting traces but servers keep getting rebooted without 
getting  data.

As we have continued to research the problem, we have found several 
other postings from the Samba list that mention similar issues.  I don't 
see that any of them were ever resolved.

http://lists.samba.org/archive/samba/2009-March/147197.html
http://lists.samba.org/archive/samba/2009-October/150998.html
http://lists.samba.org/archive/samba/2009-October/151583.html

There's even one about Samba on OS X
http://groups.google.com/group/macenterprise/browse_thread/thread/d525472792058b71?pli=1

The second link clearly mentions degraded performance as the 
unsuccessful connection attempts come in.  Somebody named John replied 
that the Samba version was too old -- 3.0.7.  But then the reporter came 
back and said he upgraded to 3.3.x and still had the problem.

There is a Microsoft KB article on truncated names, but it seems like 
it's probably unrelated:
http://support.microsoft.com/kb/896725

This came from Andrew Bartlett back in 2005
http://lists.samba.org/archive/samba/2005-October/112881.html

Something is going on here.  What more can we do to investigate it? If 
it's a Microsoft Windows installation going haywire on the network, how 
do we tame it?

Regards,
Andy Liebman