samba errors is syslog

ryanoa · 11-06-2006, 10:06 PM

Hi,

I'm getting these samba errors reported in syslog and I can't figure out where they are stemming from.

Code:

Nov  6 19:40:15 slack1 smbd[2384]: [2006/11/06 19:40:15, 0] lib/util_sock.c:get_peer_addr(1229) 
Nov  6 19:40:15 slack1 smbd[2384]:   getpeername failed. Error was Transport endpoint is not connected 
Nov  6 19:40:15 slack1 smbd[8537]: [2006/11/06 19:40:15, 0] lib/util_sock.c:get_peer_addr(1229) 
Nov  6 19:40:15 slack1 smbd[8537]:   getpeername failed. Error was Transport endpoint is not connected 
Nov  6 19:40:15 slack1 smbd[8537]: [2006/11/06 19:40:15, 0] lib/util_sock.c:get_peer_addr(1229) 
Nov  6 19:40:15 slack1 smbd[8537]:   getpeername failed. Error was Transport endpoint is not connected 
Nov  6 19:40:15 slack1 smbd[8537]: [2006/11/06 19:40:15, 0] lib/access.c:check_access(327) 
Nov  6 19:40:15 slack1 smbd[8537]: [2006/11/06 19:40:15, 0] lib/util_sock.c:get_peer_addr(1229) 
Nov  6 19:40:15 slack1 smbd[8537]:   getpeername failed. Error was Transport endpoint is not connected 
Nov  6 19:40:15 slack1 smbd[8537]:   Denied connection from  (0.0.0.0) 
Nov  6 19:40:15 slack1 smbd[8537]: [2006/11/06 19:40:15, 0] lib/util_sock.c:get_peer_addr(1229) 
Nov  6 19:40:15 slack1 smbd[8537]:   getpeername failed. Error was Transport endpoint is not connected 
Nov  6 19:40:15 slack1 smbd[8537]:   Connection denied from 0.0.0.0 
Nov  6 19:40:15 slack1 smbd[8537]: [2006/11/06 19:40:15, 0] lib/util_sock.c:write_data(562) 
Nov  6 19:40:15 slack1 smbd[8537]:   write_data: write failure in writing to client 0.0.0.0. Error Connection reset by peer 
Nov  6 19:40:15 slack1 smbd[8537]: [2006/11/06 19:40:15, 0] lib/util_sock.c:send_smb(769) 
Nov  6 19:40:15 slack1 smbd[8537]:   Error writing 5 bytes to client. -1. 
(Connection reset by peer)

I have no idea why it would be getting a connection from an ip adress of 0.0.0.0
There is also a samba.0.0.0.0 log that has the same errors.

Any ideas?

Alien Bob · 11-07-2006, 04:23 PM

This usually happens because Windows clients will connect on both ports 139 and 445. When one connection succeeds, the other one is immediately closed.

So, this error message is harmless and can be ignored. You could also configure your Samba to only listen on one port using the "smb ports" option in /etc/smb.conf.

The "0.0.0.0" address is listed because Samba tries to get the IP address from the connecting client computer using the "getpeername" call, but the connection is closed before it can retrieve the correct IP address. This is logged as coming from "0.0.0.0".

Eric

ryanoa · 11-07-2006, 08:44 PM

Thanks for the response Eric,

After a little more research it is making sense to me now.

I'll have to look into the port option. Would that get rid of those error messages? Now that I know they can be ignored, no big deal, but they are filling up my syslog daily and I would like to keep it a little cleaner

Ryan

nekkutta · 03-27-2008, 12:25 PM

trying to track down causes for errors in my log file, and I'm kinda confused my log file was filling up with the iptables LOG info but then I noticed something, I didn't get any of the smbd getpeername failed entries while my firewall was up. but when my firewall goes down (BTW I'm using alien bobs script and only activate it while my dialup ppp0 connection is live and bring it down when the ppp0 drops connection) then I get flooded with the getpeername failed entries.

now, I had not encountered any of these errors until after I started using my slack 12 box as a router/gateway for the dialup connection.

is it possible there is an entry in the /proc/sys/net/ that is interferring with samba when the iptables are flushed?

grrr.... I wish I could learn all this networking stuff easily.

nekkutta