[Samba] smbd process hangs irregularly

Fri Dec 12 12:00:41 UTC 2025

Hi folks,

Please, see hardware specs and smb.conf below the message.

I have got problems with smbd hanging at irregular intervals. When smbd 
hangs, it consumes most of the cpu cycles, and the server becomes quite 
unresponsive. The server can work for 2 weeks with no problems, and the 
problem can also occur a few times during the same day. I cannot deduce 
anything that triggers the problems. No network problems, the DCs work 
as expected.

The only solution to solve the problem is to restart smbd.

The problems started after installing Samba 4.22.2 from Bookworm 
backports, and continuing under Samba 4.23.3 from Trixie backports, 
though not as frequent as under Debian 12.

There are about 4 - 6 simultaneous users connected to Samba shares on 
the server. It's mainly used for storing workstation profiles, CAD 
drawings, and Adobe InDesign projects. Many files may be open at a time, 
and the file sizes are mostly below 100 MB. Files can stay open for a 
whole workday, 8 - 9 hours. All clients are Windows 11 workstations.

Don't get excited by the fact that the domain ends with .LOCAL. It's a 
very old domain that started as an NT4 domain more than 20 years ago. It 
was converted  to a AD domain 10 years ago, and has been working without 
major problems since then. There are NO zero config devices in the 
network, so the .local in the domain name should be OK.

The server is very lightly loaded. I have never seen the server 
exhausting available memory, not even coming close to available memory. 
The drives are all NVMe gen 4, and network connection 2x10 Gbit/s over LDAP.

In the journal, the following log entries are repeatedly recurring when 
problems occur:

Nov 26 12:54:07 srvfast rpcd_classic[46927]: [2025/11/26 
12:54:07.068293,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg)
Nov 26 12:54:07 srvfast rpcd_classic[46927]:  svcctl_init_winreg: Could 
not open SYSTEM\CurrentControlSet\Services - 
NT_STATUS_CONNECTION_DISCONNECTED
Nov 26 12:54:07 srvfast rpcd_classic[46927]: [2025/11/26 
12:54:07.069179,  0, effective(0, 0), real(0, 0)] 
librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server)
Nov 26 12:54:07 srvfast rpcd_classic[46927]:  dcesrv_init_ep_server: 
Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL
Nov 26 12:54:07 srvfast rpcd_classic[46927]: [2025/11/26 
12:54:07.069915,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:954(register_ep_server)
Nov 26 12:54:07 srvfast rpcd_classic[46927]:  register_ep_server: 
dcesrv_init_ep_server(svcctl) failed: NT_STATUS_UNSUCCESSFUL
Nov 26 12:54:07 srvfast rpcd_classic[46927]: [2025/11/26 
12:54:07.070645,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:1227(rpc_worker_main)
Nov 26 12:54:07 srvfast rpcd_classic[46927]:   rpc_worker_main: 
register_ep_server failed: NT_STATUS_UNSUCCESSFUL
Nov 26 12:54:11 srvfast rpcd_classic[46926]: [2025/11/26 
12:54:11.829782,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg)
Nov 26 12:54:11 srvfast rpcd_classic[46926]:  svcctl_init_winreg: Could 
not open SYSTEM\CurrentControlSet\Services - 
NT_STATUS_CONNECTION_DISCONNECTED
Nov 26 12:54:11 srvfast rpcd_classic[46926]: [2025/11/26 
12:54:11.830773,  0, effective(0, 0), real(0, 0)] 
librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server)
Nov 26 12:54:11 srvfast rpcd_classic[46926]:  dcesrv_init_ep_server: 
Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL
Nov 26 12:54:11 srvfast rpcd_classic[46926]: [2025/11/26 
12:54:11.831672,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:954(register_ep_server)
Nov 26 12:54:11 srvfast rpcd_classic[46926]:  register_ep_server: 
dcesrv_init_ep_server(svcctl) failed: NT_STATUS_UNSUCCESSFUL
Nov 26 12:54:11 srvfast rpcd_classic[46926]: [2025/11/26 
12:54:11.832437,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:1227(rpc_worker_main)
Nov 26 12:54:11 srvfast rpcd_classic[46926]:   rpc_worker_main: 
register_ep_server failed: NT_STATUS_UNSUCCESSFUL
Nov 26 12:54:28 srvfast rpcd_classic[46957]: [2025/11/26 
12:54:28.921915,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg)
Nov 26 12:54:28 srvfast rpcd_classic[46957]:  svcctl_init_winreg: Could 
not open SYSTEM\CurrentControlSet\Services - 
NT_STATUS_CONNECTION_DISCONNECTED
Nov 26 12:54:28 srvfast rpcd_classic[46959]: [2025/11/26 
12:54:28.922598,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg)
Nov 26 12:54:28 srvfast rpcd_classic[46957]: [2025/11/26 
12:54:28.922959,  0, effective(0, 0), real(0, 0)] 
librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server)
Nov 26 12:54:28 srvfast rpcd_classic[46959]:  svcctl_init_winreg: Could 
not open SYSTEM\CurrentControlSet\Services - 
NT_STATUS_CONNECTION_DISCONNECTED
Nov 26 12:54:28 srvfast rpcd_classic[46958]: [2025/11/26 
12:54:28.923139,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg)
Nov 26 12:54:28 srvfast rpcd_classic[46957]:  dcesrv_init_ep_server: 
Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL
Nov 26 12:54:28 srvfast rpcd_classic[46958]:  svcctl_init_winreg: Could 
not open SYSTEM\CurrentControlSet\Services - 
NT_STATUS_CONNECTION_DISCONNECTED
Nov 26 12:54:28 srvfast rpcd_classic[46956]: [2025/11/26 
12:54:28.923859,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg)
Nov 26 12:54:28 srvfast rpcd_classic[46957]: [2025/11/26 
12:54:28.924098,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:954(register_ep_server)
Nov 26 12:54:28 srvfast rpcd_classic[46956]:  svcctl_init_winreg: Could 
not open SYSTEM\CurrentControlSet\Services - 
NT_STATUS_CONNECTION_DISCONNECTED
Nov 26 12:54:28 srvfast rpcd_classic[46959]: [2025/11/26 
12:54:28.924138,  0, effective(0, 0), real(0, 0)] 
librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server)
Nov 26 12:54:28 srvfast rpcd_classic[46957]:  register_ep_server: 
dcesrv_init_ep_server(svcctl) failed: NT_STATUS_UNSUCCESSFUL
Nov 26 12:54:28 srvfast rpcd_classic[46958]: [2025/11/26 
12:54:28.924295,  0, effective(0, 0), real(0, 0)] 
librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server)
Nov 26 12:54:28 srvfast rpcd_classic[46959]:  dcesrv_init_ep_server: 
Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL
Nov 26 12:54:28 srvfast rpcd_classic[46958]:  dcesrv_init_ep_server: 
Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL
Nov 26 12:54:28 srvfast rpcd_classic[46957]: [2025/11/26 
12:54:28.924945,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:1227(rpc_worker_main)

If somebody has got a clue what's going on, I would be grateful to get 
help how to address the problems.

Best regards,

Peter

*Hardware*

HPE ProLiant DL-325 Gen10 Plus v2

CPU: AMD EPYC 74F3 24-Core (48 threads)

RAM: 32 GB

Network connection: 2x10 Gbit/s over LDAP

Drives: NVMe gen. 4

* OS *
Debian 13.2, with Samba 4.23.3-Debian-4.23.3+dfsg-1~bpo13+1

* AD DCs *
2x AD DC running Debian 13.2 with Samba 4.23.3-Debian-4.23.3+dfsg-1~bpo13+1

* smb.conf *
[global]
# Prior to version 4.23.0+dfsg-4, debian samba package carried 
usershare.patch
# patch which changed default value for "usershare max share" parameter
         usershare max shares = 100
         client signing = required
         debug uid = Yes
         dedicated keytab file = /etc/krb5.keytab
         disable netbios = Yes
         disable spoolss = Yes
         kerberos method = secrets and keytab
         log level = 1
         panic action = /usr/share/samba/panic-action %d
         printcap name = /dev/null
         realm = RULLE.LOCAL
         restrict anonymous = 2
         security = ADS
         server role = member server
         smb ports = 445
         template homedir = /home/%U
         template shell = /sbin/nologin
         winbind use default domain = yes
         timestamp logs = Yes
         username map = /etc/samba/user.map
         min domain uid = 0
         winbind enum groups = Yes
         winbind enum users = Yes
         winbind refresh tickets = Yes
         workgroup = RULLE
         idmap config rulle : range = 10000-99999
         idmap config rulle : backend = rid
         idmap config * : range = 3000-9999
         idmap config * : backend = tdb
         map acl inherit = Yes
         vfs objects = acl_xattr
         hide unreadable = yes
         veto files = /.bash_logout/.bash_profile/.bash_history/.bashrc/

[Homes$]
         readonly = no
         path = /data/samba/homes
         csc policy = disable

[Profiles$]
         readonly = no
         path = /data/samba/profiles
         csc policy = disable

[Users$]
         readonly = no
         path = /data/samba/users
         csc policy = disable

[Share1]
         readonly = no
         path = /data/samba/share1

[Share2]
         readonly = no
         path = /data/samba/share2

....

[ShareN]

         readonly = no
         path = /data/samba/sharen