Hi forum,

Here are the symptoms:

Periodically, and especially when our dual-quad-core file servers are under load, the Windows Server 2003 systems report:
With log level turned up to 6 in smb.conf, the only thing logged at the exact moment of failure is:
(no exaggeration, it's all At's and Carat's and an arbitrary seeming number of 'em. A Google search for even the phonetic 'at'+'carat' doesn't return a thing...)
...which leads me to many various docs, including a KB which indicates NTBackup has such and such an issue with the blob of data that certain apps send instead of chunking it out, and to assuage the issue one can simply increase PagedPoolSize etc, and at this point I'm near to insane with the babysitting and restarting samba when my monitors report they can't get the directory listing any longer.

Configuration is fairly simple. Here's my smb.conf sans anything that might get me in trouble:
...plus some share definitions which basically look like:
DNS is functional, CentOS is up to date on one system, but the same issue occurs on a RHEL4 system with a completely different version of samba, so I guess the fact that CentOS is current is immaterial.

I've done tcpdump's and captured the packets that are being transmitted at the time of the failure between the linux and windows systems and there are no errors (like invalid checksums, or otherwise transport issues).

Thanks in advance...


A

Just as an additional bit, I just had the issue and tested from Windows 2000 Server (sp4, up to date, blah, blah) and the issue occurs there too.

A

You might get some useful information from sar. It is in the sysstats package. Once you install sar you have got to configure it to collect data on a regular basis, such as every ten minutes. It will keep enormous amounts of data about every little thing going on in the kernel. You have to tell it to do that. The default configuration may be nearly useless on your distribution; it is on mine.

Once you have sar data collector running it should provide a really great snapshot of system resources at the time of the next failure. You may have to be clever about what you ask sar to tell you. It has lots of parameters because it can show you lots of different things.

I would first suspect that the insufficient resources could be memory or network buffers. Fixing one of those could require you to recompile the kernel.

Keep us up to date on this. It sounds really interesting.

There may be useful information at www.samba.org. I don't know.

Just to follow up on this post:

By changing the following, I have been able to reduce the amount we are seeing this particular issue 99%.

security = user
encrypt passwords = yes
bind interfaces only = yes
interfaces = ip.of.this.system 127.0.0.1

#Although the next two were already present in my config, I changed the system to use a RO account and an RW account. {shrugs} Not sure if it has anything to do with the error going away, but it does control write access...
guest account = roaccount
map to guest = bad user