CIFS and WINS issue

[Jeff_Traigle]

We've recently installed some HP-UX systems runnign Samba for customers who do not have a corresponding Windows application server. In order to allow these systems to be available in the Network Neighborhood, we set the local_master variable to true in smb.conf. Our Windows guru is seeing the following performance problem now:

1) Some of the Samba servers have the LOCAL_MASTER set to true
2) When the Samba service starts, and at regular intervals thereafter, they register a <1E> record in the WINS database for the JDOSSN domain.
3) The <1E> record is a group name, and as such it should contain multiple values. When the Samba servers register, however, they are not being appended to the record. Instead, the record is being overwritten each time a Samba server sends a name registration request.
4) Because the <1E> record is constantly being overwritten, it does not contain entries for the domain controllers JDOSSNDC01 & JDOSSNDC02. This is causing significant slowness when logging in, browsing the network, and connecting to shared folders. The slowness is intermittent, because NetBIOS names are cached for 10 minutes.
5) Static entries are not overwritten by dynamic name registrations, so I created a static <1E> record with the address of the PDC emulator (JDOSSNDC01). This resolved the problems with slowness, but I have no idea how it will affect the Samba servers. We need to check and see if we can still browse the shares on the Unix boxes.

B8725AA HP CIFS Server A.01.10 is used. (Based on Samba 2.2.8a.) Anyone seen anything like this before?

[Jeff_Traigle]

BTW... Windows Server 2003 on the Windows side of the equation.

[Steven E. Protter]

Having more than one machine in "the hood" the network neighborhood as Master Browser has caused me problems in a Pure Windows Environment.

The should only be one Master browser in a single workgroup. That should be the Primary Domain Controller.

If you change your environment to meet that standard in my opinion, you should still be able to browse the Unix boxes and not have this problem.

SEP

[Jeff_Traigle]

Ok... let's be sure we have our terms correct here...

There is only one Domain Master Browser in only one Domain and it is the PDC. None of the Samba boxes have domain master set to false in all cases. (I knew that would wreak havoc. :) We enabled the Samba servers to be the Local Master Browser because they were the only servers in their respective subnets. As I understand it, there must be a Local Master Browser in each subnet if browsing is to work.

[Thomas Bianco]

You mention you set the samba servers to be the local masters, as they are the only servers on the subnet and the xDC is on another network.

If I understand this correctly, your Samba servers are not connected to the Domain browser. This is not good.

Microsoft often uses the analogy of a busload of schoolchildren being watched and counted by the local master browser (a teacher) and using a walkie-talkie to call this info into the Domain master browser (the xDC, a principal).

The other half of this: WINS eliminates all need for browsing.

Here is what I would suggest:
1) Remove the master browser setting from the UNIX systems (preferably set them to never master browsing, even if elected)
2) Make SURE all of your clients are configured to read the wins server FIRST. (H-node)
3) Remove the JDOSSN records from the wins server and do a NBTSTAT /RR on the xDC

This will cause one of the clients to become local browse master for that subnet, but it won't matter, as WINS will always be checked first, and browsing will only be used as a last resort.

[Alzhy]

I would disable your SAMBA servers so local_master is set to FALSE. If your PDC also serves as WINS server, I will add the PDC's IP address to each SAMBA server so and set use WINS to true and pint WINS to the WINS server.

This is regardless of whatever Security (domain, server, user, share) you are implementing on your Samba servers.

HTH.

[Jeff_Traigle]

Thomas,

> If I understand this correctly, your Samba
> servers are not connected to the Domain
> browser. This is not good.

Not sure what you mean by this. If the Samba server is set to be the local master browser for it's subnet and is configured to use the PDC for the domain as the WINS server, aren't they connected? (The wins server and password server settings are the only options in smb.conf that you can specify addresses for that I know of... and they are both set to the IP address of the PDC.)

> The other half of this: WINS eliminates
> all need for browsing.

True. WINS was working perfectly fine before we made the Samba servers local master browsers. We could connect to shares successfully. However, for some reason that I'm not sure about, our Windows admin/engineer requested that browsing be enabled if possible. (I think it had something to do with problems with some software installations at customer sites... they could hack around it by modifying some INI file, but it wasn't a very nice way to approach a solution... I was brand new to the group when this came up a couple of months ago and I'm still trying to understand some aspects of the environment.)

> This will cause one of the clients to
> become local browse master for that
> subnet, but it won't matter, as WINS will
> always be checked first, and browsing will
> only be used as a last resort.

The problem is there are no clients in the subnet either. This is a hosted environment with a separate subnet for each customer. In the cases where the Samba server is the only server in the subnet, it's the only possible local master browser to communicate with the domain master browser.

Of course, as I read his comments again this morning, is this even a browser issue or just a WINS issue between Samba and Win2k3? I'm no Windows guru by any stretch of anyones wildest imagination, but, if the 1E record he mentions is related to WINS registrations, making the Samba server strictly a WINS client shouldn't make any difference at all... the problem should still occur.

[Jeff_Traigle]

Just thought I would post a follow-up on this issue. Our newest WIndows person looked into the problem and it appears he found the answer.

Like all of the servers in this environment, the Doman Controller is multi-homed. NetBIOS was bound to both interfaces. Removing it from the secondary interface allowed the browse list to be updated properly and now all of the Samba servers are present in the list.