date:20130805

Re: [Samba] Samba 4 Slow Performance

2013-08-05 Thread Matthieu Patou

On 07/27/2013 08:20 AM, Kinglok, Fong wrote:

Dear all,

After using samba 3 for two years, I have just spent totally one week finishing
setting up a samba 4 file system in my working school. There are about 200
computers, 80+ staff, 1000 students and 10 printers. The AD was properly
setup, mandatory profile and one GPO policy (which is printer download trust)
is effective for all users. Logon script is for mapping four shares and 10
printers from the file server. Also, I have setup two additional DCs (with AD
replication and DHCP server) for two other subnets in the hope to speed up the
logon process.

The benefits of Samba 4 are clear: more robust file serving (supporting the
windows ACL), speedy printing (with the help of point and printer driver) and
administration of AD through with windows remote admin tool. However, logon
speed is just far from good.

In the days of Samba 3.6, users can logon the system within 20 seconds, even
with more than 80 users logon in the same time (two classes students login
during computer lesson). Now, with only one user logging in (who is me), it
takes nearly 60 seconds to do the logon. I have tried disabling drive and
printer mapping in logon script and applying a registry hack (note 1) shorten
the profile waiting time in windows 7 client side but it makes no difference in
logon speed.

I have taken a look on the document in sambaXP 2013:
http://sambaxp.org/fileadmin/user_upload/SambaXP2013-DATA/thu/track1/Matthieu_Patou-Smaller_Faster_Scalier.pdf

and two thread in samba-technical mailing list:
https://lists.samba.org/archive/samba-technical/2013-January/089755.html
https://lists.samba.org/archive/samba-technical/2013-May/092332.html

It seems that samba team is doing some great work in spotting the unindexed
search in LDB as one of block in performance. Certainly, I can wait for the
new version 4.0.X for the boost of performance. However, I am in deep panic
when lessons are going to be launched on 1st September 2013 here in Hong Kong.
Are there any patches so that I can a hot / dirty fix?

I don't think the problem is in the database in your case, can you do a
tcpdump trace starting just before the client is logging on and stopping
it after the logon (ie the 60 sec or so), see
https://wiki.samba.org/index.php/Capture_Packets on how to the tcpdump
capture.

With this trace we should be able to see where is the delay.
Matthieu.

--
Matthieu Patou
Samba Team
http://samba.org

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

Re: [Samba] Managing a Samba4 AD DC using a Win7 workstation

2013-08-05 Thread Emmanuel Lesouef

Le Fri, 2 Aug 2013 16:52:56 +0200,
Georg Bretschneider georg+mailinglists.sa...@georgb.de a écrit :

 Hi,
 
 are you sure you started the management software as a domain admin?
 (You know, right click and then start as.) Since you joined your
 client to the AD, there shouldn't be a problem. Can you resolve the
 domain name?
 
 
 Bye
 Georg

Hi Georg.

Yes I launched the management software as a domain admin because I'm
logged in the Win7 workstation as the domain administrator account.

I can also resole and ping the domain controller.

Thanks for your help.

-- 
Emmanuel Lesouef
CRBN/DSI/SITI
e: e.leso...@crbn.fr
gpg keyid : FCAB0C55


signature.asc
Description: PGP signature
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Joining DC

2013-08-05 Thread Andrew Bartlett

On Mon, 2013-08-05 at 16:03 +1200, Andrew Bartlett wrote:
 On Fri, 2013-08-02 at 13:58 +1000, Alex Ferrara wrote:
  I am having some trouble joining a new samba4 server as a DC. I am pretty 
  sure this stems from trying to use OpenChange and subsequently removing it. 
  The new samba4 machine is running 4.0.7 and the existing is running 4.0.1. 
  I am a little hesitant to do an in-place upgrade of the last working DC, so 
  I wanted a replica to fall back on in case things go bad.
 
  On the existing DC logs
  
  [2013/08/02 13:53:04,  0] 
  ../source4/rpc_server/drsuapi/getncchanges.c:220(get_nc_changes_build_object)
../source4/rpc_server/drsuapi/getncchanges.c:220: Failed to find 
  attribute in schema for attrid 2786216 mentioned in replPropertyMetaData of 
  CN=Recipient Update Service 
  (DOMAIN)\0ADEL:cbf078d9-a0ff-4609-a05b-743816af619d,CN=Deleted 
  Objects,CN=Configuration,DC=domain,DC=local
 
 This is really interesting.  We are fighting with this in our automated
 testing, but we assumed it was due to runtime schema changes.  Presuming
 you have restarted Samba since the last schema change, this points as a
 more sinister issue.  
 
 Can you take a clone of this sever, and on an isolated network upgrade
 this to git master, and try to join another git master server to it? 
 
 If that fails in the same way, we may wish to get a dump of this object
 (and potentially the database via a secure route) so we can investigate
 further. 

Can you show me the output of 'dbcheck --cross-ncs' with this patch?  

Please do this on a backup of the domain.

Don't run dbcheck --fix because I know the test and fix is at least
partially bogus, but I'm just curious to see what this shows up. 

Thanks,

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org
Samba Developer, Catalyst IT   http://catalyst.net.nz

From 172888cf867739bd69f17789c49a2e1710ffe478 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett abart...@samba.org
Date: Mon, 5 Aug 2013 19:13:15 +1200
Subject: [PATCH] dbcheck: FIXME Try and find replication metadata that does
 not match the sent objects

The issue with the test is that if an attribute is deleted, then it needs to be in the metadata, but not have any
values.  The important test should actually be that we can at least translate each metadata entry.

Andrew Bartlett
---
 python/samba/dbchecker.py |   52 +++--
 1 file changed, 46 insertions(+), 6 deletions(-)

diff --git a/python/samba/dbchecker.py b/python/samba/dbchecker.py
index 8b175c2..0317824 100644
--- a/python/samba/dbchecker.py
+++ b/python/samba/dbchecker.py
@@ -606,6 +606,19 @@ newSuperior: %s % (str(from_dn), str(to_rdn), str(to_base)))
   Failed to fix metadata for attribute %s % attr):
 self.report(Fixed metadata for attribute %s % attr)
 
+def fix_extra_metadata(self, dn, attr):
+'''remove replPropertyMetaData elements for a single attribute for a
+object. This is used to fix extra replPropertyMetaData elements'''
+res = self.samdb.search(base = dn, scope=ldb.SCOPE_BASE, attrs = [attr],
+controls = [search_options:1:2, show_recycled:1])
+msg = res[0]
+nmsg = ldb.Message()
+nmsg.dn = dn
+nmsg[attr] = ldb.MessageElement([], ldb.FLAG_MOD_REPLACE, attr)
+if self.do_modify(nmsg, [relax:0, provision:0, show_recycled:1],
+  Failed to remove extra metadata for not-existing attribute %s % attr):
+self.report(Removed extra metadata for attribute %s % attr)
+
 def ace_get_effective_inherited_type(self, ace):
 if ace.flags  security.SEC_ACE_FLAG_INHERIT_ONLY:
 return None
@@ -900,6 +913,12 @@ newSuperior: %s % (str(from_dn), str(to_rdn), str(to_base)))
 if attrname == 'dn':
 continue
 
+flag = self.samdb_schema.get_systemFlags_from_lDAPDisplayName(attrname)
+if (not flag  dsdb.DS_FLAG_ATTR_NOT_REPLICATED
+and not flag  dsdb.DS_FLAG_ATTR_IS_CONSTRUCTED
+and not self.samdb_schema.get_linkId_from_lDAPDisplayName(attrname)):
+list_attrs_seen.append(str(attrname).lower())
+
 if str(attrname).lower() == 'replpropertymetadata':
 list_attrs_from_md = self.process_metadata(obj[attrname])
 got_repl_property_meta_data = True
@@ -956,12 +975,6 @@ newSuperior: %s % (str(from_dn), str(to_rdn), str(to_base)))
 error_count += 1
 continue
 
-flag = self.samdb_schema.get_systemFlags_from_lDAPDisplayName(attrname)
-if (not flag  dsdb.DS_FLAG_ATTR_NOT_REPLICATED
-and not flag  dsdb.DS_FLAG_ATTR_IS_CONSTRUCTED
-and not self.samdb_schema.get_linkId_from_lDAPDisplayName(attrname)):
-

41 matches

Mail list logo