topic Re: How to kill smbd process automatically in Operating System - Linux

How to kill smbd process automatically

senthil_kumar_1 — Thu, 17 Nov 2011 14:42:52 GMT

Hi All,

We are running samba server in RHEL 4.

We are seeing following lot of smbd process still running those are started in past 4 months...

# ps -ef | grep -i "smbd -D"

root       300 2930 0 Sep12 ?        00:00:00 smbd -D
root       303 2930 0 Aug11 ?        00:00:00 smbd -D
root       311 2930 0 Oct07 ?        00:00:00 smbd -D
root       328 2930 0 Aug04 ?        00:00:00 smbd -D
root       342 2930 0 Aug06 ?        00:00:00 smbd -D
root       390 2930 0 Aug11 ?        00:00:00 smbd -D
root      2097 2930 0 Jul28 ?        00:00:00 smbd -D
root      2162 2930 0 Sep04 ?        00:00:00 smbd -D
root      2163 2930 0 Jul28 ?        00:00:00 smbd -D
root      2166 2930 0 Aug22 ?        00:00:00 smbd -D
root      2211 2930 0 Aug26 ?        00:00:00 smbd -D
root      2271 2930 0 Sep16 ?        00:00:00 smbd -D
root      2305 2930 0 Sep04 ?        00:00:00 smbd -D
root      2315 2930 0 Aug26 ?        00:00:00 smbd -D
root      2380 2930 0 Aug10 ?        00:00:00 smbd -D
root      2393 2930 0 Aug31 ?        00:00:00 smbd -D
root      2405 2930 0 Sep16 ?        00:00:00 smbd -D
root      2432 2930 0 Jul26 ?        00:00:00 smbd -D
root      2460 2930 0 Aug29 ?        00:00:00 smbd -D
root      2505 2930 0 Aug10 ?        00:00:00 smbd -D
root      2518 2930 0 Sep08 ?        00:00:00 smbd -D
root      2530 2930 0 Aug29 ?        00:00:00 smbd -D
root      2537 2930 0 Sep21 ?        00:00:00 smbd -D
root      2539 2930 0 Jul26 ?        00:00:00 smbd -D
root      2579 2930 0 Jul22 ?        00:00:00 smbd -D
root      2589 2930 0 Aug17 ?        00:00:00 smbd -D
root      5569 2930 0 Sep15 ?        00:00:00 smbd -D
root      5570 2930 0 Jul22 ?        00:00:00 smbd -D

Like above I am seeing about 1500 process...

My Questions:

1)I think these process are opened if any users are opening samba shares, am I correct?

2)Why these process are not auto killed?

3)How to kill these process automatically once if we close samba shares?

4)what is the impact if these are keep opened?

Re: How to kill smbd process automatically

Matti_Kurkela — Sun, 20 Nov 2011 11:48:54 GMT

1.) Yes. From the smbd man page:

" A session is created whenever a client requests one. Each client gets a copy of the server [ = a smbd process] for each session. This copy then services all connections made by the client during that session. When all connections from its client are closed, the copy of the server for that client terminates."

So, it looks like you have some long-running client connections there.

2.) The clients are probably still active, keeping the sessions from expiring. Or if you can confirm the clients are gone, you should check the patch level of your RHEL 4.

3.) Use the "smbstatus" command (if RHEL 4 has it) to see the client associated with each process to see where the connections are coming from and what is the share they're trying to access.Then decide if killing them is appropriate or not.

4.) If the sessions are not actively doing anything and you're not running out of memory/swap or PID number slots, there should be very little impact.

Re: How to kill smbd process automatically

senthil_kumar_1 — Tue, 29 Nov 2011 14:53:53 GMT

Hi Matti,

In some other server, I have seen one smb process PID "22001" ran by root user using the command "ps -ef | grep -i smb | more", but in the output of "smbstatus" PID " 22001" is owned by the user "seiq4u"

For example:

# ps -ef | grep -i smb | more
root 22001 5761 0 00:59 ? 00:00:00 /usr/sbin/smbd -D -s /etc/samba/smb.conf

#smbstatus

Samba version 3.0.36-0.5.5-2195-SUSE-CODE10
PID Username Group Machine
-------------------------------------------------------------------
22001 seiq4u dd 10.250.1.36 (10.250.1.36)

Service pid machine Connected at
-------------------------------------------------------
home 22001 10.250.1.36 Tue Nov 29 00:59:37 2011
emd 22001 10.250.1.36 Tue Nov 29 00:59:36 2011

My Questions:

1)Why the command "ps -ef | grep -i smb" is showing that the PID "22001" is owned by root instead of "seiq4u"?

2)Is there any script / (some thing like that) to find all the process they are not in the output of smbstatus command

Re: How to kill smbd process automatically

Matti_Kurkela — Thu, 01 Dec 2011 00:04:45 GMT

1.)

> In some other server, I have seen one smb process PID "22001" ran by root user using the command "ps -ef | grep -i smb | more", but in the output of "smbstatus" PID " 22001" is owned by the user "seiq4u"

Not "owned by" but currently serving the user "seiq4u".

The filesystem conventions of the Windows systems are not 100% compatible with Unix/Linux systems: some things that are available for root users only on Unix/Linux can be available for regular users on Windows, and vice versa. To eliminate/hide these differences, the Samba processes must run as root, so that they can override the Unix/Linux limitations when required/allowed by the Samba configuration settings to achieve the maximally Windows-like user experience. (yuck :-)

Even though the smbd process runs as root, it does not mean the Windows user is allowed to do anything through it: the smbd process will still implement all the appropriate access restrictions.

2.) I don't know of such a script. If you feel you need one, perhaps you could make one?

At least on my system, even when there are no active Samba sessions, thare are two smbd processes running: the "master" smbd process (identifiable by the PID file /var/run/samba/smbd.pid) and one child smbd process that has been prepared in advance so that it will be immediately ready to serve as soon as a request arrives.

If you have a large number of smbd processes that are not included in the smbstatus listing (let's call them "ghost" smbd processes), something may be wrong: you might want to pick a time when there are only a few legitimate users logged in, and then stop Samba, make sure all smbd processes have died (kill them manually if not, e.g. using "pkill smbd" and then "pkill -9 smbd" if necessary), then restart Samba. Then wait and see if the ghost smbd's start to accumulate again over time.

If the accumulation of ghost smbd processes happens again, you might want to check if your Linux distribution has updated Samba packages available, and update them when possible.

Re: How to kill smbd process automatically

Michael Steele_2 — Tue, 06 Dec 2011 03:10:01 GMT

Network application like Samba use "...keep alive..." and "....max connections..." parameters in their config file. Smb.conf for samba. You can clearly see this with "...netstat...".

You have have a problem with users trying to get access if all the connections are filled. That's what keep alive does, maintain the connection. That's so the user doesn't have to go through a long connection process to establish samba every transaction.

Adding "deadtime = 1" to smb.conf kept the netstat table manageable. A value of 5 may be more appropriate for general use.

There are alot of complaints about this problem with samba on linux.