[Samba] Windows 10 spawning thousands of child processes on Samba 4.3.11 server

[Asbjorn Taugbol]

I have 10 Windows 10 clients connecting to Ubuntu 16.04 with Samba version
4.3.11-Ubuntu. Each client has one smbd process, but I notice the number of
child processes is exploding into 40.000+ the next day after a restart. I
reckon this is not normal. Server load is < 0.1 but client applications are
misbehaving and crashing.

The problems started when moving from an old Ubuntu 10.04 to a newer 16.04.

root# smbstatus |wc -l
42831
root# smbstatus |head

Samba version 4.3.11-Ubuntu
PID     Username      Group         Machine            Protocol Version
------------------------------------------------------------------------------
2810      nobody        nogroup       10.10.1.73   (ipv4:10.10.1.73:49915)
Unknown (0x0311)
2810      nobody        nogroup       10.10.1.73   (ipv4:10.10.1.73:49915)
Unknown (0x0311)
2810      nobody        nogroup       10.10.1.73   (ipv4:10.10.1.73:49915)
Unknown (0x0311)
2810      nobody        nogroup       10.10.1.73   (ipv4:10.10.1.73:49915)
Unknown (0x0311)
2810      nobody        nogroup       10.10.1.73   (ipv4:10.10.1.73:49915)
Unknown (0x0311)

root# ps aux|grep 2810
product+  2810  0.1  0.6 446904 110308 ?       S    May21   2:29
/usr/sbin/smbd -D

There are several thousands of these nobody/nogroup processes per
connection. The number of files and folders per connection is ~100. They
typically look like this:

2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   rad/fift   Mon May 22 20:06:28 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   rad/fift   Mon May 22 20:08:08 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   rad/fift   Mon May 22 20:08:08 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   rad/fift   Mon May 22 20:09:08 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   rad/fift   Mon May 22 20:09:08 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   rad/fift   Mon May 22 20:10:08 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   rad/fift   Mon May 22 20:10:08 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   rad/fift   Mon May 22 20:14:08 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   rad/fift   Mon May 22 20:14:08 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   fifttemp/log   Sun May 21 16:31:52 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   fifttemp/log   Sun May 21 16:31:52 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   fifttemp/log   Sun May 21 16:31:52 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   fifttemp/log   Mon May 22 19:00:46 2017
2810         1001       DENY_NONE  0x100081    RDONLY     NONE
/home/production   fifttemp/log   Mon May 22 19:00:46 2017


/var/log/samba log files reveal nothing of interest afaik.

Client side info:

PS C:\Users\admin> Get-SmbConnection

ServerName ShareName      UserName     Credential   Dialect NumOpens
---------- ---------      --------     ----------   ------- --------
10.10.1.6  production     WIN8\admin WIN8\admin 3.1.1   1

Putting this in smb.conf did not help:
deadtime = 90


Some alternatives I am considering:
1) Force WIN10 clients to use SMBv1.
2) Restart samba at regular intervals (daily).
3) Downgrade Samba (not happy with this one, would like to keep vanilla
Ubuntu)

Any suggestions?

Thanks!

-Asbjorn