How to kill smbd process automatically

[senthil_kumar_1]

Hi All,

We are running samba server in RHEL 4.

We are seeing following lot of smbd process still running those are started in past 4 months...

# ps -ef | grep -i "smbd -D"

root       300  2930  0 Sep12 ?        00:00:00 smbd -D
root       303  2930  0 Aug11 ?        00:00:00 smbd -D
root       311  2930  0 Oct07 ?        00:00:00 smbd -D
root       328  2930  0 Aug04 ?        00:00:00 smbd -D
root       342  2930  0 Aug06 ?        00:00:00 smbd -D
root       390  2930  0 Aug11 ?        00:00:00 smbd -D
root      2097  2930  0 Jul28 ?        00:00:00 smbd -D
root      2162  2930  0 Sep04 ?        00:00:00 smbd -D
root      2163  2930  0 Jul28 ?        00:00:00 smbd -D
root      2166  2930  0 Aug22 ?        00:00:00 smbd -D
root      2211  2930  0 Aug26 ?        00:00:00 smbd -D
root      2271  2930  0 Sep16 ?        00:00:00 smbd -D
root      2305  2930  0 Sep04 ?        00:00:00 smbd -D
root      2315  2930  0 Aug26 ?        00:00:00 smbd -D
root      2380  2930  0 Aug10 ?        00:00:00 smbd -D
root      2393  2930  0 Aug31 ?        00:00:00 smbd -D
root      2405  2930  0 Sep16 ?        00:00:00 smbd -D
root      2432  2930  0 Jul26 ?        00:00:00 smbd -D
root      2460  2930  0 Aug29 ?        00:00:00 smbd -D
root      2505  2930  0 Aug10 ?        00:00:00 smbd -D
root      2518  2930  0 Sep08 ?        00:00:00 smbd -D
root      2530  2930  0 Aug29 ?        00:00:00 smbd -D
root      2537  2930  0 Sep21 ?        00:00:00 smbd -D
root      2539  2930  0 Jul26 ?        00:00:00 smbd -D
root      2579  2930  0 Jul22 ?        00:00:00 smbd -D
root      2589  2930  0 Aug17 ?        00:00:00 smbd -D
root      5569  2930  0 Sep15 ?        00:00:00 smbd -D
root      5570  2930  0 Jul22 ?        00:00:00 smbd -D

Like above I am seeing about 1500 process...

My Questions:

1)I think these process are opened if any users are opening samba shares, am I correct?

2)Why these process are not auto killed?

3)How to kill these process automatically once if we close samba shares?

4)what is the impact if these are keep opened?

[Matti_Kurkela]

1.) Yes. From the smbd man page:

" A session is created whenever a client requests one. Each client gets a copy of the server [ = a smbd process] for each session. This copy then services all connections made by the client during that session. When all connections from its client are closed, the copy of the server for that client terminates."

So, it looks like you have some long-running client connections there.

2.) The clients are probably still active, keeping the sessions from expiring. Or if you can confirm the clients are gone, you should check the patch level of your RHEL 4.

3.) Use the "smbstatus" command (if RHEL 4 has it) to see the client associated with each process to see where the connections are coming from and what is the share they're trying to access.Then decide if killing them is appropriate or not.

4.) If the sessions are not actively doing anything and you're not running out of memory/swap or PID number slots, there should be very little impact.

[senthil_kumar_1]

Hi Matti,

In some other server, I have seen one smb process PID "22001" ran by root user using the command "ps -ef | grep -i smb | more", but in the output of "smbstatus" PID " 22001" is owned by the user "seiq4u"

For example:

# ps -ef | grep -i smb | more
root 22001 5761 0 00:59 ? 00:00:00 /usr/sbin/smbd -D -s /etc/samba/smb.conf



#smbstatus

Samba version 3.0.36-0.5.5-2195-SUSE-CODE10
PID Username Group Machine
-------------------------------------------------------------------
22001 seiq4u dd 10.250.1.36 (10.250.1.36)


Service pid machine Connected at
-------------------------------------------------------
home 22001 10.250.1.36 Tue Nov 29 00:59:37 2011
emd 22001 10.250.1.36 Tue Nov 29 00:59:36 2011

My Questions:

1)Why the command "ps -ef | grep -i smb" is showing that the PID "22001" is owned by root instead of "seiq4u"?

2)Is there any script / (some thing like that) to find all the process they are not in the output of smbstatus command

[Matti_Kurkela]

1.)

> In some other server, I have seen one smb process PID "22001" ran by root user using the command "ps -ef | grep -i smb | more", but in the output of "smbstatus" PID " 22001" is owned by the user "seiq4u"

Not "owned by" but currently serving the user "seiq4u".

The filesystem conventions of the Windows systems are not 100% compatible with Unix/Linux systems: some things that are available for root users only on Unix/Linux can be available for regular users on Windows, and vice versa. To eliminate/hide these differences, the Samba processes must run as root, so that they can override the Unix/Linux limitations when required/allowed by the Samba configuration settings to achieve the maximally Windows-like user experience. (yuck :-)

Even though the smbd process runs as root, it does not mean the Windows user is allowed to do anything through it: the smbd process will still implement all the appropriate access restrictions.

2.) I don't know of such a script. If you feel you need one, perhaps you could make one?

At least on my system, even when there are no active Samba sessions, thare are two smbd processes running: the "master" smbd process (identifiable by the PID file /var/run/samba/smbd.pid) and one child smbd process that has been prepared in advance so that it will be immediately ready to serve as soon as a request arrives.

If you have a large number of smbd processes that are not included in the smbstatus listing (let's call them "ghost" smbd processes), something may be wrong: you might want to pick a time when there are only a few legitimate users logged in, and then stop Samba, make sure all smbd processes have died (kill them manually if not, e.g. using "pkill smbd" and then "pkill -9 smbd" if necessary), then restart Samba. Then wait and see if the ghost smbd's start to accumulate again over time.

If the accumulation of ghost smbd processes happens again, you might want to check if your Linux distribution has updated Samba packages available, and update them when possible.

[Michael Steele_2]

Network application like Samba use "...keep alive..." and "....max connections..." parameters in their config file.  Smb.conf for samba.  You can clearly see this with "...netstat...".

You have have a problem with users trying to get access if all the connections are filled.  That's what keep alive does, maintain the connection.  That's so the user doesn't have to go through a long connection process to establish samba every transaction.

Adding "deadtime = 1" to smb.conf kept the netstat table manageable.  A value of 5 may be more appropriate for general use.

There are alot of complaints about this problem with samba on linux.