CIFS/samba write_data: write failure in writing to client

[maslo64]

Hello all,
I have issue with samba/CIFS server. Connections from clients are losts from time to time and messages from samba log are not very descriptive.

Server : HP-UX 11.23, ia64
Clients: Windows 2003 Enterprise x64

[global]
workgroup = CIFS
server string = Samba Server
security = user
encrypt passwords = Yes
syslog = 0
log file = /var/opt/samba/log.%m
max log size = 1000
read only = No
create mask = 0664
case sensitive = Yes
dos filetime resolution = Yes
oplocks = No
smb ports = 139
disable spoolss = yes
load printers = no
mangled names = no
change notify timeout = 0
domain master = no
enhanced browsing = no
preferred master = no
local master = No


sap501 (10.217.64.11) closed connection to service interface
[2008/12/17 03:21:11, 0] lib/util_sock.c:write_data(556)
write_data: write failure in writing to client 10.217.64.11. Error Broken pipe
[2008/12/17 03:21:11, 0] lib/util_sock.c:send_smb(756)
Error writing 39 bytes to client. -1. (Broken pipe)
[2008/12/17 03:21:11, 1] smbd/service.c:close_cnum(889)
sap501 (10.217.64.11) closed connection to service archive

There is no firewall between hosts.

Thank you for your help.

[Matti_Kurkela]

The samba server does not really have very much to go on here: apparently the _client_ sap501 suddenly decided it didn't want to talk with your server any more, and hung up its connections "in mid-sentence".

Perhaps the client was being rebooted because of a Windows security update? Or maybe its anti-virus software was being picky and required all connections to be shut down while the new virus database update was being installed?

Without knowing what was happening at the client side, it may be impossible to find out more.

MK

[maslo64]

Hello ,
We have 2 clusters with heavy load on samba which are SAP Central Instances. There are many windows SAP Applications servers. This happening during the day , without any maitenance window. There is no such think like antivirus problem or reboot. Strange think on this is sometimes it happend once a day or once a week. But sometimes it happend five times per hour and SMB shares are not accessible.