[Samba] Samba 4.1.7 seems slow when calculating access rights

[Petr MOTEJLEK]

Hello everyone,

I am not sure if I phrased the subject properly, but that's basically how I understand what's happening.

What I have is a CentOS 6.5 box with the Sernet samba-4.1 repository and Samba 4.1.7 AD DC installed and up and running. I have a couple of Windows XP clients connected to the active directory.

We used to have the original CentOS-packaged Samba3 on this particular server, but because we would like to migrate our Windows XPs to something newer and going for AD before doing the client upgrade seemed like a good idea :), we went for that. So, this weekend I've completely reinstalled Samba (uninstalling Samba 3, installing Samba 4.17 and manually recreating all our users and groups in the new AD). Currently everything seems to work fine - my users are able to log in, get their roaming profile and use all the resources they used to use before, BUT...

Our IS (information system) which is hosted on one of the Samba 4.1.7 shares, seems to be now running terribly slow. For example, the startup time with our old Samba 3 used to be up to 10 seconds. Now, with Samba 4.1.7 it takes up over 1 minute (and my users hate me for that). I've been doing some debugging and unfortunately I did not find any error message anywhere. What I gathered so far was that the IS is during the startup fetching a lot of smaller files (icons I think) and when it's starting up, the associated smbd process eats a lot of CPU during that time. By looking at network utilization and disk utilization, they are hardly doing anything during the startup, so it seems like smbd is slowing things down just by calculating stuff, but why and what? :)

When I (out of desperation) set the force user = root on the particular share on which the IS resides and restarted Samba, voila - the smbd processes now eat way less CPU and the startup time for the IS is not back at about 5 secs. Interestingly enough, our old Samba 3 on the same server, used nt acls and posix acls (which I think I have kind of overridden when I forced all users to act as root) and all that too, so even though those features seem like something to blame, they were present before and they were not causing any havoc at all.

I understand that anyone willing to help me will require a lot of information from me, please don't hesitate to ask for anything. Even though I don't like it, I can keep the force user = root parameter on the share for a while, but I want to get rid of that as soon as possible, on the same hand. So I will try to provide as much detail as you guys want.

Thank you all and have a nice day,
Petr MOTEJLEK