Volker Lendecke wrote:
On Fri, Sep 19, 2008 at 10:02:02PM +0200, Vlastimil Šetka wrote:
I have a Samba server configured as PDC for ~100 computers. It's
version 3.0.24 running on Debian Etch (distribution package).
I want to write a tool for user logon/logoff tracking. Because
parsing log files is hard job (windows frequently disconnets or
connects during user session or etc.) I decide to use smbstatus
output which seem to be reliable.
So I run smbstatus binary every 10 seconds, parse the output and all
is fine. But sometimes in the smbstatus output is show computer which
is several hours switched off. At the next run (after 10s) this
record is not presented. Sometimes this "ghost" record is shown for
~30 seconds.
Does that smbd still exist? If computers are just switched
off then Samba might not notice.
I plan to check it but it's complicated because the "ghost" record is
presented only for several seconds. I have to log the PID and related
"ps" output.
Smbstatus checks if the proccess with the PID still exists. So if it's
showed the smbd probably exists.
The computer is really switched off for several hours when this issue is
presented. I also check the log file and there is no activity at this
time. Today there were two "ghost" records for two different users on
one computer - this computer is switched off for > 24 hours and this two
users were loged in during last 3 days.
Example:
11:10:21 - MACHINE1/USER1 - is in smbstatus
... constantly is in smbstatus
12:14:11 - MACHINE1/USER1 - is NOT in smbstatus
12:15:21 - MACHINE1/USER2 - is in smbstatus
...
12:45:31 - MACHINE1/USER2 - is NOT in smbstatus
Now the MACHINE1 is switched off.
18:16:21 - MACHINE1/USER1 - is in smbstatus !! (and the MACHINE1 is
switched off several hours!)
18:16:31 - MACHINE1/USER1 - is NOT in smbstatus
Sometimes (cca twice a day) smbstatus return error output like this:
tdb(/var/run/samba/sessionid.tdb): rec_read bad magic 0xd9fee666 at
offset=116988
This is normal. Smbstatus reads the tdb files in read-only
mode. This implies no locking which in turn might lead to
smbstatus reading an inconsistent tdb file.
Yes. In sources I notice that no locking is used. Smbstatus only reads
the file so it's OK. I also want to use INOTIFY on sessionid.tdb file
but it's not usable because smbd has the file constantly open for write.
Volker
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
