On Wed, Jan 11, 2017 at 08:29:25AM +1100, John Gardeniers wrote: > >strace -ttT -o /tmp/smbd.strace -f -p <smbd-pid> ? > There are multiple smbd processes, so I'm going to assume you mean the Ok, you did trace the worker smbd. Can you try disabling the full_audit module? This might impose some load. Volker