[Samba] samba AD DC eats memory

[Andrew Bartlett]

I should say, while it is good to fix, I don't think the fix below is
the main issue.  Your logs show Samba has loaded its schema from the DB
10 times, and each of those is 2MB.  I think that is why the processes
are so large, but it could be something else also.

Do you have custom schema loaded?

Thanks,

Andrew Bartlett

On Thu, 2020-02-27 at 11:51 +1300, Andrew Bartlett wrote:
> Thanks!
> 
> I've got a fix for one issue seen here.
> 
> I'd love to credit you with a fix.  Please let me know what name and
> any affiliation (eg company) you would like listed.
> 
> There will probably be more to come, and if you can try and get me
> the
> report for any other large processes that would be awesome. 
> 
> See
> 
> BUG: https://bugzilla.samba.org/show_bug.cgi?id=14299
> 
> MR: https://gitlab.com/samba-team/samba/-/merge_requests/1168
> 
> Andrew Bartlett
> 
> On Wed, 2020-02-26 at 14:15 +0300, Alex wrote:
> > Tweaking timeout value did the trick:
> 
> (log files removed)
> 
> > Please, let me know if you still need me to run samba under
> > valgrind
> > 
> > > > > If you can't, then please use 'samba-tool processes' to line
> > > > > up
> > > > > pids
> > > > > with names.
> > > > 
> > > > [root at vm-dc3 var]# samba-tool processes
> > > >  Service:                          PID
> > > > --------------------------------------
> > > > cldap_server                      1529
> > > > dnssrv                            1555
> > > > dnsupdate                         1553
> > > > kccsrv                            1548
> > > > kdc_server                        1533
> > > > kdc_server(worker 3)              1552
> > > > kdc_server(worker 0)              1540
> > > > kdc_server(worker 1)              1544
> > > > kdc_server(worker 2)              1549
> > > > ldap_server                       1525
> > > > ldap_server(worker 1)             1569
> > > > ldap_server(worker 2)             1571
> > > > ldap_server(worker 0)             1567
> > > > ldap_server(worker 3)             1573
> > > > nbt_server                        1517
> > > > notify-daemon                     1563
> > > > rpc_server                        1514
> > > > rpc_server(worker 2)              1528
> > > > rpc_server(worker 0)              1520
> > > > rpc_server(worker 1)              1524
> > > > rpc_server(worker 3)              1532
> > > > samba                             1508
> > > > winbind_server                    1547
> > > > 
> > > > > Then, please run the smbcontrol not against 'all' (which
> > > > > hasn't
> > > > > got
> > > > > all
> > > > > the processes, clearly only returned data from eight), but
> > > > > against
> > > > > each
> > > > > of the largest processes individually, and put them in
> > > > > distinct
> > > > > files
> > > > > for me?
> > > > 
> > > > sorted by swap: https://paste.ee/p/w6TL5
> > > > 
> > > > I tried to grab pool-usage for PIDs 1540, 1552 and 1555 and got
> > > > "No
> > > > replies
> > > > received" for each of them.
> > > > 
> > > > sorted by rss: https://paste.ee/p/Rjsgw
> > > > 
> > > > pool-usage for the PID 1520 returns the same "no replies"
> > > > 
> > > > Let me know if you need anything else.
> > > 
> > > It looks to me that the worst of the issue in the KDC.
> > > You could run Samba under valgrind:
> > > PYMALLOC=malloc valgrind --trace-children=yes bin/samba -i
> > > You could also try giving that pool-usage longer to run with the
> > > --
> > > timeout option to smbcontrol, as the default timeout is 10
> > > seconds.
> > > smbcontrol --timeout 60 ...
> > 
> > 
-- 
Andrew Bartlett
https://samba.org/~abartlet/
Authentication Developer, Samba Team         https://samba.org
Samba Development and Support, Catalyst IT - Expert Open Source
Solutions
https://catalyst.net.nz/services/samba