smbd: NotifyChangeDirectory: NETWORK_ERROR (need help)

[Jeremy Allison]

On Fri, Apr 14, 2023 at 10:15:55AM +0300, Michael Tokarev via samba-technical wrote:
>I tried to debug an interesting issue today.
>
>The thing is that some applications, for example FarManager (farmanager.com),
>will enable change notifications on the directories they keep "current",
>including the case when this directory is on a remote samba server.
>And sometimes, it ends up in list of files on the samba panel to become
>empty with the error message:
>
> Error: Cannot read folder contents
> 0x00000003 - The system cannot find the path specified.
>
>This happens only on samba so far, and it didn't occur with older samba
>version (I can't say which, maybe 4.16, but 4.13 for sure).  I can click
>on "Ok" and tell it to re-read the directory, which works, until after
>some more time the whole thing happens again.  What's interesting here
>is that the directory in question is *not* actually modified, not this
>one neither any file/dir inside it, so if anything, this notification
>is false.  Also, I don't see any inotify filedescriptors in lsof output
>of this smbd process.
>
>So I started from tracing far.exe, but this one gave nothing really interesting.
>Here's what ProcMon.exe (from sysinternals) shows for it:
>
> 13.04.2023 16:09:24,2428431 Far.exe 11600 NotifyChangeDirectory \\tsrv\mjt-adm\ NETWORK ERROR \
>    Filter: FILE_NOTIFY_CHANGE_FILE_NAME, ...
>
>So system call NotifyChangeDirectory returned NETWORK ERROR.  After this,
>far.exe immediately displays the above error message without issuing other
>system calls.

I'm guessing ProcMon.exe doesn't give you the SMB2 message id,
which would allow you to discover exactly what packet causes
the problem.

Without that, how synchronized are the times on client and
server ? If they're close, use the ProcMon.exe reported
time to look at the wireshark trace around that time.