[2006/05/09 08:51:57, 6] param/loadparm.c:(2947) lp_file_list_changed() file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 [2006/05/09 08:51:57, 2] lib/interface.c:(81) added interface ip=15.70.194.216 bcast=15.70.194.255 nmask=255.255.255.0 [2006/05/09 08:51:57, 5] lib/util.c:(260) Netbios name list:- my_netbios_names[0]="CHEVY" [2006/05/09 08:51:57, 3] lib/util.c:(2177) set_maxfiles: setrlimit for RLIMIT_NOFILE for 10020 max files failed with error Invalid argument [2006/05/09 08:51:57, 1] smbd/files.c:(196) file_init: Information only: requested 10000 open files, 4076 are available. [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/05/09 08:51:57, 3] smbd/uid.c:(392) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:51:57, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:51:57, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(950) Trying to load: smbpasswd [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(94) Attempting to register passdb backend smbpasswd [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(107) Successfully added passdb backend 'smbpasswd' [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(94) Attempting to register passdb backend tdbsam [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(107) Successfully added passdb backend 'tdbsam' [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(94) Attempting to register passdb backend guest [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(107) Successfully added passdb backend 'guest' [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(822) Attempting to find an passdb backend to match smbpasswd (smbpasswd) [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(843) Found pdb backend smbpasswd [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(846) pdb backend smbpasswd has a valid init [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(822) Attempting to find an passdb backend to match guest (guest) [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(843) Found pdb backend guest [2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(846) pdb backend guest has a valid init [2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(1371) smbpasswd_getsampwrid: search by sid: S-1-5-21-4112424572-1378032116-4237619202-501 [2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(1322) getsampwnam (smbpasswd): search by name: nobody [2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(184) startsmbfilepwent_internal: opening file /usr/local/samba/private/smbpasswd [2006/05/09 08:51:57, 5] passdb/pdb_smbpasswd.c:(487) getsmbfilepwent: returning passwd entry for user pavan, uid 205 [2006/05/09 08:51:57, 5] passdb/pdb_smbpasswd.c:(539) getsmbfilepwent: end of file reached. [2006/05/09 08:51:57, 7] passdb/pdb_smbpasswd.c:(301) endsmbfilepwent_internal: closed password file. [2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(616) pdb_set_username: setting username nobody, was [2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(697) pdb_set_full_name: setting full name nobody, was [2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(643) pdb_set_domain: setting domain CHEVY, was [2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(543) pdb_set_user_sid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-501 [2006/05/09 08:51:57, 10] passdb/pdb_compat.c:(72) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-501 from rid 501 [2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(579) pdb_set_group_sid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-514 [2006/05/09 08:51:57, 10] passdb/pdb_compat.c:(99) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-514 from rid 514 [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/05/09 08:51:57, 3] smbd/uid.c:(392) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:51:57, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:51:57, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:51:57, 10] lib/system_smbd.c:(167) sys_getgrouplist: user [nobody] [2006/05/09 08:51:57, 10] lib/system_smbd.c:(175) sys_getgrouplist(): disabled winbindd for group lookup [user == nobody] [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2006/05/09 08:51:57, 3] smbd/uid.c:(392) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/05/09 08:51:57, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:51:57, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:51:57, 8] lib/system_smbd.c:(49) remove_duplicate_gids: Enter 2 gids [2006/05/09 08:51:57, 8] lib/system_smbd.c:(67) remove_duplicate_gids: Exit 1 gids [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2006/05/09 08:51:57, 3] smbd/uid.c:(392) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/05/09 08:51:57, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:51:57, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:51:57, 10] passdb/passdb.c:(1244) local_gid_to_sid: Fall back to algorithmic mapping: 65534 -> S-1-5-21-4112424572-1378032116-4237619202-132069 [2006/05/09 08:51:57, 10] passdb/lookup_sid.c:(406) gid_to_sid: local 65534 -> S-1-5-21-4112424572-1378032116-4237619202-132069 [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:51:57, 10] lib/privileges.c:(565) grant_privilege: S-1-1-0 original privilege mask: SE_PRIV 0x0 0x0 0x0 0x0 new privilege mask: SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:51:57, 10] lib/privileges.c:(565) grant_privilege: S-1-5-32-544 original privilege mask: SE_PRIV 0x0 0x0 0x0 0x0 new privilege mask: SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:51:57, 10] lib/privileges.c:(565) grant_privilege: S-1-5-32-548 original privilege mask: SE_PRIV 0x0 0x0 0x0 0x0 new privilege mask: SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:51:57, 10] lib/privileges.c:(565) grant_privilege: S-1-5-32-549 original privilege mask: SE_PRIV 0x0 0x0 0x0 0x0 new privilege mask: SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:51:57, 10] lib/privileges.c:(565) grant_privilege: S-1-5-32-550 original privilege mask: SE_PRIV 0x0 0x0 0x0 0x0 new privilege mask: SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:51:57, 10] lib/privileges.c:(565) grant_privilege: S-1-5-32-551 original privilege mask: SE_PRIV 0x0 0x0 0x0 0x0 new privilege mask: SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:51:57, 10] auth/auth_util.c:(437) NT user token of user S-1-5-21-4112424572-1378032116-4237619202-501 contains 6 SIDs SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-501 SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-514 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-32-546 SID[ 5]: S-1-5-21-4112424572-1378032116-4237619202-132069 SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:51:57, 5] auth/auth_util.c:(896) make_server_info_sam: made server info for user nobody -> nobody [2006/05/09 08:51:57, 3] smbd/server.c:(840) loaded services [2006/05/09 08:51:57, 3] smbd/server.c:(855) Becoming a daemon. [2006/05/09 08:51:57, 8] lib/util.c:(1820) fcntl_lock 9 8 0 1 2 [2006/05/09 08:51:57, 8] lib/util.c:(1855) fcntl_lock: Lock call successful [2006/05/09 08:51:57, 5] tdb/tdbutil.c:(772) tdb(unnamed): tdb_brlock failed (fd=10) at offset 4 rw_type=2 lck_type=8: Permission denied [2006/05/09 08:51:57, 2] lib/tallocmsg.c:(61) Registered MSG_REQ_POOL_USAGE [2006/05/09 08:51:57, 2] lib/dmallocmsg.c:(71) Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED [2006/05/09 08:51:57, 5] lib/gencache.c:(59) Opening cache file at /usr/local/samba/var/locks/gencache.tdb [2006/05/09 08:51:57, 5] libsmb/namecache.c:(57) namecache_enable: enabling netbios namecache, timeout 660 seconds [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM] with subkey [SOFTWARE] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE] with subkey [Microsoft] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft] with subkey [Windows NT] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT] with subkey [CurrentVersion] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] with subkey [Print] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] with subkey [Printers] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM] with subkey [SOFTWARE] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE] with subkey [Microsoft] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft] with subkey [Windows NT] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT] with subkey [CurrentVersion] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] with subkey [Ports] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Control\Print] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM] with subkey [SYSTEM] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Control] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control] with subkey [Print] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Print] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM] with subkey [SYSTEM] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Services] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services] with subkey [LanmanServer] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer] with subkey [Shares] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM] with subkey [SYSTEM] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Services] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services] with subkey [Eventlog] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM] with subkey [SOFTWARE] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE] with subkey [Microsoft] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft] with subkey [Windows NT] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT] with subkey [CurrentVersion] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] with subkey [Perflib] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM] with subkey [SOFTWARE] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE] with subkey [Microsoft] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft] with subkey [Windows NT] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT] with subkey [CurrentVersion] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] with subkey [Perflib] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib] with subkey [009] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM] with subkey [SYSTEM] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Control] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control] with subkey [Print] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Print] with subkey [Monitors] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM] with subkey [SYSTEM] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Control] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control] with subkey [ProductOptions] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM] with subkey [SYSTEM] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Control] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control] with subkey [Terminal Server] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server] with subkey [DefaultUserConfiguration] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM] with subkey [SYSTEM] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Services] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services] with subkey [TcpIp] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\TcpIp] with subkey [Parameters] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM] with subkey [SYSTEM] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Services] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services] with subkey [Netlogon] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\Netlogon] with subkey [Parameters] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKU] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKU] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKCR] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKCR] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKPD] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKPD] with subkey [NULL] [2006/05/09 08:51:57, 6] registry/reg_db.c:(104) init_registry_data: Adding [HKPT] [2006/05/09 08:51:57, 10] registry/reg_db.c:(129) init_registry_data: Storing key [HKPT] with subkey [NULL] [2006/05/09 08:51:57, 10] registry/reg_db.c:(562) regdb_fetch_values: Looking for value of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports] [2006/05/09 08:51:57, 8] registry/reg_db.c:(514) specific: [Samba Printer Port], len: 2 [2006/05/09 08:51:57, 10] registry/reg_db.c:(562) regdb_fetch_values: Looking for value of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2006/05/09 08:51:57, 8] registry/reg_db.c:(514) specific: [DefaultSpoolDirectory], len: 70 [2006/05/09 08:51:57, 10] registry/reg_db.c:(562) regdb_fetch_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog] [2006/05/09 08:51:57, 8] registry/reg_db.c:(514) specific: [DisplayName], len: 20 [2006/05/09 08:51:57, 8] registry/reg_db.c:(514) specific: [ErrorControl], len: 4 [2006/05/09 08:51:57, 10] registry/reg_db.c:(562) regdb_fetch_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog] [2006/05/09 08:51:57, 8] registry/reg_db.c:(514) specific: [DisplayName], len: 20 [2006/05/09 08:51:57, 8] registry/reg_db.c:(514) specific: [ErrorControl], len: 4 [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(61) reghook_cache_add: Adding key [/HKLM/SYSTEM/CurrentControlSet/Control/Print] [2006/05/09 08:51:57, 8] lib/adt_tree.c:(201) pathtree_add: Enter [2006/05/09 08:51:57, 10] lib/adt_tree.c:(267) pathtree_add: Successfully added node [HKLM/SYSTEM/CurrentControlSet/Control/Print] to tree [2006/05/09 08:51:57, 8] lib/adt_tree.c:(270) pathtree_add: Exit [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(61) reghook_cache_add: Adding key [/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Print/Printers] [2006/05/09 08:51:57, 8] lib/adt_tree.c:(201) pathtree_add: Enter [2006/05/09 08:51:57, 10] lib/adt_tree.c:(267) pathtree_add: Successfully added node [HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Print/Printers] to tree [2006/05/09 08:51:57, 8] lib/adt_tree.c:(270) pathtree_add: Exit [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(61) reghook_cache_add: Adding key [/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Ports] [2006/05/09 08:51:57, 8] lib/adt_tree.c:(201) pathtree_add: Enter [2006/05/09 08:51:57, 10] lib/adt_tree.c:(267) pathtree_add: Successfully added node [HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Ports] to tree [2006/05/09 08:51:57, 8] lib/adt_tree.c:(270) pathtree_add: Exit [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(61) reghook_cache_add: Adding key [/HKLM/SYSTEM/CurrentControlSet/Services/LanmanServer/Shares] [2006/05/09 08:51:57, 8] lib/adt_tree.c:(201) pathtree_add: Enter [2006/05/09 08:51:57, 10] lib/adt_tree.c:(267) pathtree_add: Successfully added node [HKLM/SYSTEM/CurrentControlSet/Services/LanmanServer/Shares] to tree [2006/05/09 08:51:57, 8] lib/adt_tree.c:(270) pathtree_add: Exit [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/05/09 08:51:57, 3] smbd/uid.c:(392) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:51:57, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:51:57, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(1322) getsampwnam (smbpasswd): search by name: root [2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(184) startsmbfilepwent_internal: opening file /usr/local/samba/private/smbpasswd [2006/05/09 08:51:57, 5] passdb/pdb_smbpasswd.c:(487) getsmbfilepwent: returning passwd entry for user pavan, uid 205 [2006/05/09 08:51:57, 5] passdb/pdb_smbpasswd.c:(539) getsmbfilepwent: end of file reached. [2006/05/09 08:51:57, 7] passdb/pdb_smbpasswd.c:(301) endsmbfilepwent_internal: closed password file. [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:51:57, 4] passdb/passdb.c:(1145) local_uid_to_sid: User root [uid == 0] has no samba account [2006/05/09 08:51:57, 8] passdb/passdb.c:(1107) algorithmic_uid_to_sid: falling back to RID algorithm [2006/05/09 08:51:57, 10] passdb/passdb.c:(1110) algorithmic_uid_to_sid: uid (0) -> SID S-1-5-21-4112424572-1378032116-4237619202-1000. [2006/05/09 08:51:57, 10] passdb/passdb.c:(1153) local_uid_to_sid: uid (0) -> SID S-1-5-21-4112424572-1378032116-4237619202-1000 (root). [2006/05/09 08:51:57, 10] passdb/lookup_sid.c:(364) uid_to_sid: local 0 -> S-1-5-21-4112424572-1378032116-4237619202-1000 [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/05/09 08:51:57, 3] smbd/uid.c:(392) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:51:57, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:51:57, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:51:57, 10] passdb/passdb.c:(1244) local_gid_to_sid: Fall back to algorithmic mapping: 1 -> S-1-5-21-4112424572-1378032116-4237619202-1003 [2006/05/09 08:51:57, 10] passdb/lookup_sid.c:(406) gid_to_sid: local 1 -> S-1-5-21-4112424572-1378032116-4237619202-1003 [2006/05/09 08:51:57, 10] auth/auth_util.c:(437) NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1000 contains 6 SIDs SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1000 SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1003 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SID[ 5]: S-1-5-32-544 SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:51:57, 10] registry/reg_db.c:(248) regdb_open: incrementing refcount (1) [2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services] [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) pathtree_find: Exit [2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) registry_access_check: using root's token [2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-32-544 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 [2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) se_access_check: access (f003f) granted. [2006/05/09 08:51:57, 10] registry/reg_db.c:(248) regdb_open: incrementing refcount (2) [2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\Spooler] [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/Spooler] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/Spooler] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) pathtree_find: Exit [2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) registry_access_check: using root's token [2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-32-544 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 [2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) se_access_check: access (f003f) granted. [2006/05/09 08:51:57, 10] registry/reg_db.c:(592) regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Spooler] [2006/05/09 08:51:57, 10] registry/reg_db.c:(279) regdb_close: decrementing refcount (2) [2006/05/09 08:51:57, 10] registry/reg_db.c:(248) regdb_open: incrementing refcount (2) [2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\Spooler\Security] [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/Spooler/Security] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/Spooler/Security] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) pathtree_find: Exit [2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) registry_access_check: using root's token [2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-32-544 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 [2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) se_access_check: access (f003f) granted. [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(84) 000000 sec_io_desc sec_desc [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0000 revision : 0001 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0002 type : 8004 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0004 off_owner_sid: 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0008 off_grp_sid : 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 000c off_sacl : 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0010 off_dacl : 00000014 [2006/05/09 08:51:57, 6] rpc_parse/parse_prs.c:(84) 000014 sec_io_acl dacl [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0014 revision: 0002 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0018 num_aces : 00000004 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 00001c sec_io_ace ace_list[00]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 001c type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 001d flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000020 sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0020 mask: 0002018d [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000024 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0024 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0025 num_auths : 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0026 id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0027 id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0028 id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0029 id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 002a id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 002b id_auth[5] : 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 002c sub_auths : 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 001e size : 0014 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 000030 sec_io_ace ace_list[01]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0030 type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0031 flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000034 sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0034 mask: 000201fd [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000038 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0038 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0039 num_auths : 02 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003a id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003b id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003c id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003d id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003e id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003f id_auth[5] : 05 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 0040 sub_auths : 00000020 00000223 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0032 size : 0018 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 000048 sec_io_ace ace_list[02]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0048 type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0049 flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 00004c sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 004c mask: 000f01ff [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000050 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0050 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0051 num_auths : 02 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0052 id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0053 id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0054 id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0055 id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0056 id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0057 id_auth[5] : 05 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 0058 sub_auths : 00000020 00000225 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 004a size : 0018 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 000060 sec_io_ace ace_list[03]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0060 type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0061 flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000064 sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0064 mask: 000f01ff [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000068 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0068 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0069 num_auths : 02 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006a id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006b id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006c id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006d id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006e id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006f id_auth[5] : 05 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 0070 sub_auths : 00000020 00000220 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0062 size : 0018 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0016 size : 0064 [2006/05/09 08:51:57, 10] registry/reg_db.c:(592) regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Spooler\Security] [2006/05/09 08:51:57, 10] registry/reg_db.c:(279) regdb_close: decrementing refcount (2) [2006/05/09 08:51:57, 10] registry/reg_db.c:(248) regdb_open: incrementing refcount (2) [2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\NETLOGON] [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/NETLOGON] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/NETLOGON] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) pathtree_find: Exit [2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) registry_access_check: using root's token [2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-32-544 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 [2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) se_access_check: access (f003f) granted. [2006/05/09 08:51:57, 10] registry/reg_db.c:(592) regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\NETLOGON] [2006/05/09 08:51:57, 10] registry/reg_db.c:(279) regdb_close: decrementing refcount (2) [2006/05/09 08:51:57, 10] registry/reg_db.c:(248) regdb_open: incrementing refcount (2) [2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\NETLOGON\Security] [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/NETLOGON/Security] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/NETLOGON/Security] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) pathtree_find: Exit [2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) registry_access_check: using root's token [2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-32-544 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 [2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) se_access_check: access (f003f) granted. [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(84) 000000 sec_io_desc sec_desc [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0000 revision : 0001 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0002 type : 8004 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0004 off_owner_sid: 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0008 off_grp_sid : 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 000c off_sacl : 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0010 off_dacl : 00000014 [2006/05/09 08:51:57, 6] rpc_parse/parse_prs.c:(84) 000014 sec_io_acl dacl [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0014 revision: 0002 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0018 num_aces : 00000004 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 00001c sec_io_ace ace_list[00]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 001c type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 001d flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000020 sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0020 mask: 0002018d [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000024 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0024 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0025 num_auths : 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0026 id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0027 id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0028 id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0029 id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 002a id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 002b id_auth[5] : 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 002c sub_auths : 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 001e size : 0014 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 000030 sec_io_ace ace_list[01]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0030 type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0031 flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000034 sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0034 mask: 000201fd [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000038 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0038 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0039 num_auths : 02 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003a id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003b id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003c id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003d id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003e id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003f id_auth[5] : 05 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 0040 sub_auths : 00000020 00000223 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0032 size : 0018 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 000048 sec_io_ace ace_list[02]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0048 type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0049 flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 00004c sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 004c mask: 000f01ff [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000050 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0050 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0051 num_auths : 02 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0052 id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0053 id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0054 id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0055 id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0056 id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0057 id_auth[5] : 05 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 0058 sub_auths : 00000020 00000225 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 004a size : 0018 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 000060 sec_io_ace ace_list[03]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0060 type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0061 flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000064 sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0064 mask: 000f01ff [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000068 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0068 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0069 num_auths : 02 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006a id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006b id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006c id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006d id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006e id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006f id_auth[5] : 05 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 0070 sub_auths : 00000020 00000220 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0062 size : 0018 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0016 size : 0064 [2006/05/09 08:51:57, 10] registry/reg_db.c:(592) regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\NETLOGON\Security] [2006/05/09 08:51:57, 10] registry/reg_db.c:(279) regdb_close: decrementing refcount (2) [2006/05/09 08:51:57, 10] registry/reg_db.c:(248) regdb_open: incrementing refcount (2) [2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry] [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/RemoteRegistry] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/RemoteRegistry] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) pathtree_find: Exit [2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) registry_access_check: using root's token [2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-32-544 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 [2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) se_access_check: access (f003f) granted. [2006/05/09 08:51:57, 10] registry/reg_db.c:(592) regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry] [2006/05/09 08:51:57, 10] registry/reg_db.c:(279) regdb_close: decrementing refcount (2) [2006/05/09 08:51:57, 10] registry/reg_db.c:(248) regdb_open: incrementing refcount (2) [2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry\Security] [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/RemoteRegistry/Security] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/RemoteRegistry/Security] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) pathtree_find: Exit [2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) registry_access_check: using root's token [2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-32-544 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 [2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) se_access_check: access (f003f) granted. [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(84) 000000 sec_io_desc sec_desc [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0000 revision : 0001 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0002 type : 8004 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0004 off_owner_sid: 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0008 off_grp_sid : 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 000c off_sacl : 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0010 off_dacl : 00000014 [2006/05/09 08:51:57, 6] rpc_parse/parse_prs.c:(84) 000014 sec_io_acl dacl [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0014 revision: 0002 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0018 num_aces : 00000004 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 00001c sec_io_ace ace_list[00]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 001c type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 001d flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000020 sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0020 mask: 0002018d [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000024 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0024 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0025 num_auths : 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0026 id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0027 id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0028 id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0029 id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 002a id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 002b id_auth[5] : 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 002c sub_auths : 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 001e size : 0014 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 000030 sec_io_ace ace_list[01]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0030 type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0031 flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000034 sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0034 mask: 000201fd [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000038 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0038 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0039 num_auths : 02 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003a id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003b id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003c id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003d id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003e id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003f id_auth[5] : 05 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 0040 sub_auths : 00000020 00000223 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0032 size : 0018 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 000048 sec_io_ace ace_list[02]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0048 type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0049 flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 00004c sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 004c mask: 000f01ff [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000050 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0050 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0051 num_auths : 02 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0052 id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0053 id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0054 id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0055 id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0056 id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0057 id_auth[5] : 05 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 0058 sub_auths : 00000020 00000225 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 004a size : 0018 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 000060 sec_io_ace ace_list[03]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0060 type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0061 flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000064 sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0064 mask: 000f01ff [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000068 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0068 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0069 num_auths : 02 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006a id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006b id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006c id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006d id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006e id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006f id_auth[5] : 05 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 0070 sub_auths : 00000020 00000220 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0062 size : 0018 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0016 size : 0064 [2006/05/09 08:51:57, 10] registry/reg_db.c:(592) regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry\Security] [2006/05/09 08:51:57, 10] registry/reg_db.c:(279) regdb_close: decrementing refcount (2) [2006/05/09 08:51:57, 10] registry/reg_db.c:(248) regdb_open: incrementing refcount (2) [2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\WINS] [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/WINS] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/WINS] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) pathtree_find: Exit [2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) registry_access_check: using root's token [2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-32-544 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 [2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) se_access_check: access (f003f) granted. [2006/05/09 08:51:57, 10] registry/reg_db.c:(592) regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\WINS] [2006/05/09 08:51:57, 10] registry/reg_db.c:(279) regdb_close: decrementing refcount (2) [2006/05/09 08:51:57, 10] registry/reg_db.c:(248) regdb_open: incrementing refcount (2) [2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\WINS\Security] [2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/WINS/Security] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/WINS/Security] [2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) pathtree_find: Exit [2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) registry_access_check: using root's token [2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) [2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-32-544 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 [2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) se_access_check: access (f003f) granted. [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(84) 000000 sec_io_desc sec_desc [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0000 revision : 0001 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0002 type : 8004 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0004 off_owner_sid: 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0008 off_grp_sid : 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 000c off_sacl : 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0010 off_dacl : 00000014 [2006/05/09 08:51:57, 6] rpc_parse/parse_prs.c:(84) 000014 sec_io_acl dacl [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0014 revision: 0002 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0018 num_aces : 00000004 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 00001c sec_io_ace ace_list[00]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 001c type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 001d flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000020 sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0020 mask: 0002018d [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000024 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0024 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0025 num_auths : 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0026 id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0027 id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0028 id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0029 id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 002a id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 002b id_auth[5] : 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 002c sub_auths : 00000000 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 001e size : 0014 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 000030 sec_io_ace ace_list[01]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0030 type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0031 flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000034 sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0034 mask: 000201fd [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000038 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0038 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0039 num_auths : 02 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003a id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003b id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003c id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003d id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003e id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 003f id_auth[5] : 05 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 0040 sub_auths : 00000020 00000223 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0032 size : 0018 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 000048 sec_io_ace ace_list[02]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0048 type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0049 flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 00004c sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 004c mask: 000f01ff [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000050 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0050 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0051 num_auths : 02 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0052 id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0053 id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0054 id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0055 id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0056 id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0057 id_auth[5] : 05 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 0058 sub_auths : 00000020 00000225 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 004a size : 0018 [2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) 000060 sec_io_ace ace_list[03]: [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0060 type : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0061 flags: 00 [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000064 sec_io_access info [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) 0064 mask: 000f01ff [2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) 000068 smb_io_dom_sid trustee [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0068 sid_rev_num: 01 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 0069 num_auths : 02 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006a id_auth[0] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006b id_auth[1] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006c id_auth[2] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006d id_auth[3] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006e id_auth[4] : 00 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) 006f id_auth[5] : 05 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) 0070 sub_auths : 00000020 00000220 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0062 size : 0018 [2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) 0016 size : 0064 [2006/05/09 08:51:57, 10] registry/reg_db.c:(592) regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\WINS\Security] [2006/05/09 08:51:57, 10] registry/reg_db.c:(279) regdb_close: decrementing refcount (2) [2006/05/09 08:51:57, 10] registry/reg_db.c:(279) regdb_close: decrementing refcount (1) [2006/05/09 08:51:57, 10] registry/reg_db.c:(279) regdb_close: decrementing refcount (0) [2006/05/09 08:51:57, 10] printing/nt_printing.c:(689) update_c_setprinter: c_setprinter = 0 [2006/05/09 08:51:57, 5] smbd/connection.c:(170) claiming 0 [2006/05/09 08:51:57, 3] printing/printing.c:(1379) start_background_queue: Starting background LPQ thread [2006/05/09 08:51:57, 10] lib/util_sock.c:(835) bind succeeded on port 445 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_KEEPALIVE = 8 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_REUSEADDR = 4 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_BROADCAST = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_NODELAY = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_KEEPCNT = 8 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_KEEPIDLE = 7200 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_KEEPINTVL = 75 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option IPTOS_LOWDELAY = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option IPTOS_THROUGHPUT = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_REUSEPORT = 512 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_SNDBUF = 61440 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_RCVBUF = 61440 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_SNDLOWAT = 8192 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_RCVLOWAT = 1 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_SNDTIMEO = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_RCVTIMEO = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_KEEPALIVE = 8 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_REUSEADDR = 4 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_BROADCAST = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_NODELAY = 4 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_KEEPCNT = 8 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_KEEPIDLE = 7200 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_KEEPINTVL = 75 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option IPTOS_LOWDELAY = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option IPTOS_THROUGHPUT = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_REUSEPORT = 512 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_SNDBUF = 61440 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_RCVBUF = 61440 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_SNDLOWAT = 8192 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_RCVLOWAT = 1 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_SNDTIMEO = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_RCVTIMEO = 0 [2006/05/09 08:51:57, 10] lib/util_sock.c:(835) bind succeeded on port 139 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_KEEPALIVE = 8 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_REUSEADDR = 4 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_BROADCAST = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_NODELAY = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_KEEPCNT = 8 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_KEEPIDLE = 7200 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_KEEPINTVL = 75 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option IPTOS_LOWDELAY = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option IPTOS_THROUGHPUT = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_REUSEPORT = 512 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_SNDBUF = 61440 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_RCVBUF = 61440 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_SNDLOWAT = 8192 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_RCVLOWAT = 1 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_SNDTIMEO = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_RCVTIMEO = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_KEEPALIVE = 8 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_REUSEADDR = 4 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_BROADCAST = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_NODELAY = 4 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_KEEPCNT = 8 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_KEEPIDLE = 7200 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option TCP_KEEPINTVL = 75 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option IPTOS_LOWDELAY = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option IPTOS_THROUGHPUT = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_REUSEPORT = 512 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_SNDBUF = 61440 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_RCVBUF = 61440 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_SNDLOWAT = 8192 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_RCVLOWAT = 1 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_SNDTIMEO = 0 [2006/05/09 08:51:57, 5] lib/util_sock.c:(206) socket option SO_RCVTIMEO = 0 [2006/05/09 08:51:57, 2] smbd/server.c:(336) waiting for a connection [2006/05/09 08:51:57, 5] printing/printing.c:(1389) start_background_queue: background LPQ thread started [2006/05/09 08:51:57, 5] smbd/connection.c:(170) claiming smbd lpq backend 0 [2006/05/09 08:51:57, 5] printing/printing.c:(1400) start_background_queue: background LPQ thread waiting for messages [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_KEEPALIVE = 8 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_REUSEADDR = 4 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_BROADCAST = 0 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option TCP_NODELAY = 0 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option TCP_KEEPCNT = 8 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option TCP_KEEPIDLE = 7200 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option TCP_KEEPINTVL = 75 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option IPTOS_LOWDELAY = 0 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option IPTOS_THROUGHPUT = 0 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_REUSEPORT = 512 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_SNDBUF = 61440 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_RCVBUF = 61440 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_SNDLOWAT = 536 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_RCVLOWAT = 1 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_SNDTIMEO = 0 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_RCVTIMEO = 0 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_KEEPALIVE = 8 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_REUSEADDR = 4 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_BROADCAST = 0 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option TCP_NODELAY = 4 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option TCP_KEEPCNT = 8 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option TCP_KEEPIDLE = 7200 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option TCP_KEEPINTVL = 75 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option IPTOS_LOWDELAY = 0 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option IPTOS_THROUGHPUT = 0 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_REUSEPORT = 512 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_SNDBUF = 61440 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_RCVBUF = 61440 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_SNDLOWAT = 536 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_RCVLOWAT = 1 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_SNDTIMEO = 0 [2006/05/09 08:52:19, 5] lib/util_sock.c:(206) socket option SO_RCVTIMEO = 0 [2006/05/09 08:52:19, 6] param/loadparm.c:(2947) lp_file_list_changed() file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 [2006/05/09 08:52:19, 3] smbd/oplock.c:(871) open_oplock_ipc: initializing messages. [2006/05/09 08:52:19, 4] lib/time.c:(142) TimeInit: Serverzone is -19800 [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 133 [2006/05/09 08:52:19, 3] lib/access.c:(291) only_ipaddrs_in_list: list has non-ip address (.india.hp.com) [2006/05/09 08:52:19, 3] lib/access.c:(316) check_access: hostnames in host allow/deny list. [2006/05/09 08:52:19, 2] lib/access.c:(322) Allowed connection from nt218201.india.hp.com (15.76.218.201) [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x85 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 0 of length 137 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=133 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51283 smb_tid=0 smb_pid=65279 smb_uid=0 smb_mid=0 smt_wct=0 smb_bcc=98 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 02 50 43 20 4E 45 54 57 4F 52 4B 20 50 52 4F 47 .PC NETW ORK PROG [010] 52 41 4D 20 31 2E 30 00 02 4C 41 4E 4D 41 4E 31 RAM 1.0. .LANMAN1 [020] 2E 30 00 02 57 69 6E 64 6F 77 73 20 66 6F 72 20 .0..Wind ows for [030] 57 6F 72 6B 67 72 6F 75 70 73 20 33 2E 31 61 00 Workgrou ps 3.1a. [040] 02 4C 4D 31 2E 32 58 30 30 32 00 02 4C 41 4E 4D .LM1.2X0 02..LANM [050] 41 4E 32 2E 31 00 02 4E 54 20 4C 4D 20 30 2E 31 AN2.1..N T LM 0.1 [060] 32 00 2. [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBnegprot (pid 404565) conn 0x0 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:19, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:19, 3] smbd/negprot.c:(486) Requested protocol [PC NETWORK PROGRAM 1.0] [2006/05/09 08:52:19, 3] smbd/negprot.c:(486) Requested protocol [LANMAN1.0] [2006/05/09 08:52:19, 3] smbd/negprot.c:(486) Requested protocol [Windows for Workgroups 3.1a] [2006/05/09 08:52:19, 3] smbd/negprot.c:(486) Requested protocol [LM1.2X002] [2006/05/09 08:52:19, 3] smbd/negprot.c:(486) Requested protocol [LANMAN2.1] [2006/05/09 08:52:19, 3] smbd/negprot.c:(486) Requested protocol [NT LM 0.12] [2006/05/09 08:52:19, 10] lib/util.c:(2033) set_remote_arch: Client arch is 'Win2K' [2006/05/09 08:52:19, 6] param/loadparm.c:(2947) lp_file_list_changed() file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 [2006/05/09 08:52:19, 5] smbd/connection.c:(170) claiming 0 [2006/05/09 08:52:19, 6] param/loadparm.c:(2947) lp_file_list_changed() file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 [2006/05/09 08:52:19, 3] smbd/negprot.c:(357) using SPNEGO [2006/05/09 08:52:19, 3] smbd/negprot.c:(579) Selected protocol NT LM 0.12 [2006/05/09 08:52:19, 5] smbd/negprot.c:(585) negprot index=5 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=127 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=65279 smb_uid=0 smb_mid=0 smt_wct=17 smb_vwv[ 0]= 5 (0x5) smb_vwv[ 1]=12803 (0x3203) smb_vwv[ 2]= 256 (0x100) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 65 (0x41) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 256 (0x100) smb_vwv[ 7]=21760 (0x5500) smb_vwv[ 8]= 1580 (0x62C) smb_vwv[ 9]=64768 (0xFD00) smb_vwv[10]=32995 (0x80E3) smb_vwv[11]=32896 (0x8080) smb_vwv[12]=12711 (0x31A7) smb_vwv[13]= 6087 (0x17C7) smb_vwv[14]=50803 (0xC673) smb_vwv[15]=46593 (0xB601) smb_vwv[16]= 254 (0xFE) smb_bcc=58 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 63 68 65 76 79 00 00 00 00 00 00 00 00 00 00 00 chevy... ........ [010] 60 28 06 06 2B 06 01 05 05 02 A0 1E 30 1C A0 0E `(..+... ....0... [020] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A3 0A 0...+... ..7..... [030] 30 08 A0 06 1B 04 4E 4F 4E 45 0.....NO NE [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 236 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0xec [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 1 of length 240 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=236 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=0 smb_pid=65279 smb_uid=0 smb_mid=48000 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 236 (0xEC) smb_vwv[ 2]=16644 (0x4104) smb_vwv[ 3]= 50 (0x32) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 74 (0x4A) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 212 (0xD4) smb_vwv[11]=40960 (0xA000) smb_bcc=177 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 60 48 06 06 2B 06 01 05 05 02 A0 3E 30 3C A0 0E `H..+... ...>0<.. [010] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A2 2A 0...+... ..7....* [020] 04 28 4E 54 4C 4D 53 53 50 00 01 00 00 00 97 82 .(NTLMSS P....... [030] 08 E2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [040] 00 00 05 01 28 0A 00 00 00 0F 00 57 00 69 00 6E ....(... ...W.i.n [050] 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 00 30 .d.o.w.s . .2.0.0 [060] 00 32 00 20 00 53 00 65 00 72 00 76 00 69 00 63 .2. .S.e .r.v.i.c [070] 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 32 .e. .P.a .c.k. .2 [080] 00 20 00 32 00 36 00 30 00 30 00 00 00 57 00 69 . .2.6.0 .0...W.i [090] 00 6E 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 .n.d.o.w .s. .2.0 [0A0] 00 30 00 32 00 20 00 35 00 2E 00 31 00 00 00 00 .0.2. .5 ...1.... [0B0] 00 . [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBsesssetupX (pid 404565) conn 0x0 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:19, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:19, 3] smbd/sesssetup.c:(822) wct=12 flg2=0xc807 [2006/05/09 08:52:19, 2] smbd/sesssetup.c:(772) setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. [2006/05/09 08:52:19, 3] smbd/sesssetup.c:(633) Doing spnego session setup [2006/05/09 08:52:19, 3] smbd/sesssetup.c:(663) NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] [2006/05/09 08:52:19, 10] lib/util.c:(2033) set_remote_arch: Client arch is 'WinXP' [2006/05/09 08:52:19, 10] smbd/password.c:(182) register_vuid: allocated vuid = 100 [2006/05/09 08:52:19, 3] smbd/sesssetup.c:(525) Got OID 1 3 6 1 4 1 311 2 2 10 [2006/05/09 08:52:19, 3] smbd/sesssetup.c:(528) Got secblob of size 40 [2006/05/09 08:52:19, 5] auth/auth.c:(485) Making default auth method list for standalone security=user, encrypt passwords = yes [2006/05/09 08:52:19, 5] auth/auth.c:(45) Attempting to register auth backend rhosts [2006/05/09 08:52:19, 5] auth/auth.c:(57) Successfully added auth method 'rhosts' [2006/05/09 08:52:19, 5] auth/auth.c:(45) Attempting to register auth backend hostsequiv [2006/05/09 08:52:19, 5] auth/auth.c:(57) Successfully added auth method 'hostsequiv' [2006/05/09 08:52:19, 5] auth/auth.c:(45) Attempting to register auth backend sam [2006/05/09 08:52:19, 5] auth/auth.c:(57) Successfully added auth method 'sam' [2006/05/09 08:52:19, 5] auth/auth.c:(45) Attempting to register auth backend sam_ignoredomain [2006/05/09 08:52:19, 5] auth/auth.c:(57) Successfully added auth method 'sam_ignoredomain' [2006/05/09 08:52:19, 5] auth/auth.c:(45) Attempting to register auth backend unix [2006/05/09 08:52:19, 5] auth/auth.c:(57) Successfully added auth method 'unix' [2006/05/09 08:52:19, 5] auth/auth.c:(45) Attempting to register auth backend winbind [2006/05/09 08:52:19, 5] auth/auth.c:(57) Successfully added auth method 'winbind' [2006/05/09 08:52:19, 5] auth/auth.c:(45) Attempting to register auth backend smbserver [2006/05/09 08:52:19, 5] auth/auth.c:(57) Successfully added auth method 'smbserver' [2006/05/09 08:52:19, 5] auth/auth.c:(45) Attempting to register auth backend trustdomain [2006/05/09 08:52:19, 5] auth/auth.c:(57) Successfully added auth method 'trustdomain' [2006/05/09 08:52:19, 5] auth/auth.c:(45) Attempting to register auth backend ntdomain [2006/05/09 08:52:19, 5] auth/auth.c:(57) Successfully added auth method 'ntdomain' [2006/05/09 08:52:19, 5] auth/auth.c:(45) Attempting to register auth backend guest [2006/05/09 08:52:19, 5] auth/auth.c:(57) Successfully added auth method 'guest' [2006/05/09 08:52:19, 5] auth/auth.c:(388) load_auth_module: Attempting to find an auth method to match guest [2006/05/09 08:52:19, 5] auth/auth.c:(413) load_auth_module: auth method guest has a valid init [2006/05/09 08:52:19, 5] auth/auth.c:(388) load_auth_module: Attempting to find an auth method to match sam [2006/05/09 08:52:19, 5] auth/auth.c:(413) load_auth_module: auth method sam has a valid init [2006/05/09 08:52:19, 3] libsmb/ntlmssp.c:(63) Got NTLMSSP neg_flags=0xe2088297 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_NEGOTIATE_OEM NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_LM_KEY NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EXCH NTLMSSP_NEGOTIATE_56 [2006/05/09 08:52:19, 5] auth/auth.c:(95) auth_get_challenge: module guest did not want to specify a challenge [2006/05/09 08:52:19, 5] auth/auth.c:(95) auth_get_challenge: module sam did not want to specify a challenge [2006/05/09 08:52:19, 5] auth/auth.c:(135) auth_context challenge created by random [2006/05/09 08:52:19, 5] auth/auth.c:(136) challenge is: [2006/05/09 08:52:19, 5] lib/util.c:(2058) [000] BD E8 AC 7D BD 2D 5F F8 ...}.-_. [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=290 smb_com=0x73 smb_rcls=22 smb_reh=0 smb_err=49152 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=65279 smb_uid=100 smb_mid=48000 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 189 (0xBD) smb_bcc=247 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] A1 81 BA 30 81 B7 A0 03 0A 01 01 A1 0C 06 0A 2B ...0.... .......+ [010] 06 01 04 01 82 37 02 02 0A A2 81 A1 04 81 9E 4E .....7.. .......N [020] 54 4C 4D 53 53 50 00 02 00 00 00 0A 00 0A 00 30 TLMSSP.. .......0 [030] 00 00 00 B5 82 8A 60 BD E8 AC 7D BD 2D 5F F8 00 ......`. ..}.-_.. [040] 00 00 00 00 00 00 00 64 00 64 00 3A 00 00 00 43 .......d .d.:...C [050] 00 48 00 45 00 56 00 59 00 02 00 0A 00 43 00 48 .H.E.V.Y .....C.H [060] 00 45 00 56 00 59 00 01 00 0A 00 43 00 48 00 45 .E.V.Y.. ...C.H.E [070] 00 56 00 59 00 04 00 18 00 69 00 6E 00 64 00 69 .V.Y.... .i.n.d.i [080] 00 61 00 2E 00 68 00 70 00 2E 00 63 00 6F 00 6D .a...h.p ...c.o.m [090] 00 03 00 24 00 63 00 68 00 65 00 76 00 79 00 2E ...$.c.h .e.v.y.. [0A0] 00 69 00 6E 00 64 00 69 00 61 00 2E 00 68 00 70 .i.n.d.i .a...h.p [0B0] 00 2E 00 63 00 6F 00 6D 00 00 00 00 00 55 00 6E ...c.o.m .....U.n [0C0] 00 69 00 78 00 00 00 53 00 61 00 6D 00 62 00 61 .i.x...S .a.m.b.a [0D0] 00 20 00 33 00 2E 00 30 00 2E 00 32 00 31 00 63 . .3...0 ...2.1.c [0E0] 00 00 00 57 00 4F 00 52 00 4B 00 47 00 52 00 4F ...W.O.R .K.G.R.O [0F0] 00 55 00 50 00 00 00 .U.P... [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 358 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x166 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 2 of length 362 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=358 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=0 smb_pid=65279 smb_uid=100 smb_mid=48064 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 358 (0x166) smb_vwv[ 2]=16644 (0x4104) smb_vwv[ 3]= 50 (0x32) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 196 (0xC4) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 212 (0xD4) smb_vwv[11]=40960 (0xA000) smb_bcc=299 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] A1 81 C1 30 81 BE A2 81 BB 04 81 B8 4E 54 4C 4D ...0.... ....NTLM [010] 53 53 50 00 03 00 00 00 18 00 18 00 78 00 00 00 SSP..... ....x... [020] 18 00 18 00 90 00 00 00 16 00 16 00 48 00 00 00 ........ ....H... [030] 0A 00 0A 00 5E 00 00 00 10 00 10 00 68 00 00 00 ....^... ....h... [040] 10 00 10 00 A8 00 00 00 15 82 88 62 05 01 28 0A ........ ...b..(. [050] 00 00 00 0F 41 00 53 00 49 00 41 00 50 00 41 00 ....A.S. I.A.P.A. [060] 43 00 49 00 46 00 49 00 43 00 70 00 61 00 76 00 C.I.F.I. C.p.a.v. [070] 61 00 6E 00 4E 00 54 00 32 00 31 00 38 00 32 00 a.n.N.T. 2.1.8.2. [080] 30 00 31 00 DC 61 60 1C 65 FB 38 FC 00 00 00 00 0.1..a`. e.8..... [090] 00 00 00 00 00 00 00 00 00 00 00 00 3E 8F 59 A6 ........ ....>.Y. [0A0] FE C9 4E E3 3E BE A4 13 9D 32 AB 5D 77 AB 70 C5 ..N.>... .2.]w.p. [0B0] 04 E4 13 E5 FD 9E 8B D6 01 08 CD B9 5A 7C 56 EE ........ ....Z|V. [0C0] 4A 67 BB 91 00 57 00 69 00 6E 00 64 00 6F 00 77 Jg...W.i .n.d.o.w [0D0] 00 73 00 20 00 32 00 30 00 30 00 32 00 20 00 53 .s. .2.0 .0.2. .S [0E0] 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 50 .e.r.v.i .c.e. .P [0F0] 00 61 00 63 00 6B 00 20 00 32 00 20 00 32 00 36 .a.c.k. .2. .2.6 [100] 00 30 00 30 00 00 00 57 00 69 00 6E 00 64 00 6F .0.0...W .i.n.d.o [110] 00 77 00 73 00 20 00 32 00 30 00 30 00 32 00 20 .w.s. .2 .0.0.2. [120] 00 35 00 2E 00 31 00 00 00 00 00 .5...1.. ... [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBsesssetupX (pid 404565) conn 0x0 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:19, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:19, 3] smbd/sesssetup.c:(822) wct=12 flg2=0xc807 [2006/05/09 08:52:19, 2] smbd/sesssetup.c:(772) setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. [2006/05/09 08:52:19, 3] smbd/sesssetup.c:(633) Doing spnego session setup [2006/05/09 08:52:19, 3] smbd/sesssetup.c:(663) NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] [2006/05/09 08:52:19, 3] libsmb/ntlmssp.c:(661) Got user=[pavan] domain=[ASIAPACIFIC] workstation=[NT218201] len1=24 len2=24 [2006/05/09 08:52:19, 5] auth/auth_ntlmssp.c:(66) auth_context challenge set by NTLMSSP callback (NTLM2) [2006/05/09 08:52:19, 5] auth/auth_ntlmssp.c:(67) challenge is: [2006/05/09 08:52:19, 5] lib/util.c:(2058) [000] 30 67 A2 E8 9F 98 02 95 0g...... [2006/05/09 08:52:19, 6] param/loadparm.c:(2947) lp_file_list_changed() file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 [2006/05/09 08:52:19, 5] auth/auth_util.c:(162) make_user_info_map: Mapping user [ASIAPACIFIC]\[pavan] from workstation [NT218201] [2006/05/09 08:52:19, 5] auth/auth_util.c:(69) attempting to make a user_info for pavan (pavan) [2006/05/09 08:52:19, 5] auth/auth_util.c:(79) making strings for pavan's user_info struct [2006/05/09 08:52:19, 5] auth/auth_util.c:(121) making blobs for pavan's user_info struct [2006/05/09 08:52:19, 10] auth/auth_util.c:(139) made an encrypted user_info for pavan (pavan) [2006/05/09 08:52:19, 3] auth/auth.c:(218) check_ntlm_password: Checking password for unmapped user [ASIAPACIFIC]\[pavan]@[NT218201] with the new password interface [2006/05/09 08:52:19, 3] auth/auth.c:(221) check_ntlm_password: mapped user is: [CHEVY]\[pavan]@[NT218201] [2006/05/09 08:52:19, 10] auth/auth.c:(230) check_ntlm_password: auth_context challenge created by NTLMSSP callback (NTLM2) [2006/05/09 08:52:19, 10] auth/auth.c:(233) challenge is: [2006/05/09 08:52:19, 5] lib/util.c:(2058) [000] 30 67 A2 E8 9F 98 02 95 0g...... [2006/05/09 08:52:19, 10] auth/auth.c:(259) check_ntlm_password: guest had nothing to say [2006/05/09 08:52:19, 8] lib/util.c:(1879) is_myname("CHEVY") returns 1 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/05/09 08:52:19, 3] smbd/uid.c:(392) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:52:19, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:19, 10] passdb/pdb_smbpasswd.c:(1322) getsampwnam (smbpasswd): search by name: pavan [2006/05/09 08:52:19, 10] passdb/pdb_smbpasswd.c:(184) startsmbfilepwent_internal: opening file /usr/local/samba/private/smbpasswd [2006/05/09 08:52:19, 5] passdb/pdb_smbpasswd.c:(487) getsmbfilepwent: returning passwd entry for user pavan, uid 205 [2006/05/09 08:52:19, 7] passdb/pdb_smbpasswd.c:(301) endsmbfilepwent_internal: closed password file. [2006/05/09 08:52:19, 10] passdb/pdb_smbpasswd.c:(1344) getsampwnam (smbpasswd): found by name: pavan [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(616) pdb_set_username: setting username pavan, was [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(697) pdb_set_full_name: setting full name pavan, was [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(832) pdb_set_unix_homedir: setting home dir /usr/users/pavan, was NULL [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(643) pdb_set_domain: setting domain CHEVY, was [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(543) pdb_set_user_sid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-1410 [2006/05/09 08:52:19, 10] passdb/pdb_compat.c:(72) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-1410 from rid 1410 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2006/05/09 08:52:19, 3] smbd/uid.c:(392) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/05/09 08:52:19, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(579) pdb_set_group_sid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-1031 [2006/05/09 08:52:19, 10] passdb/pdb_compat.c:(99) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-1031 from rid 1031 [2006/05/09 08:52:19, 4] lib/substitute.c:(359) Home server: chevy [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(751) pdb_set_profile_path: setting profile path \\chevy\pavan\profile, was [2006/05/09 08:52:19, 4] lib/substitute.c:(359) Home server: chevy [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(805) pdb_set_homedir: setting home dir \\chevy\pavan, was [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(778) pdb_set_dir_drive: setting dir drive , was NULL [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(724) pdb_set_logon_script: setting logon script , was [2006/05/09 08:52:19, 10] lib/account_pol.c:(332) account_policy_get: name: password history, val: 0 [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(616) pdb_set_username: setting username pavan, was [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(643) pdb_set_domain: setting domain CHEVY, was [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(670) pdb_set_nt_username: setting nt username , was [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(697) pdb_set_full_name: setting full name pavan, was [2006/05/09 08:52:19, 4] lib/substitute.c:(359) Home server: chevy [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(805) pdb_set_homedir: setting home dir \\chevy\pavan, was [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(778) pdb_set_dir_drive: setting dir drive , was NULL [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(724) pdb_set_logon_script: setting logon script , was [2006/05/09 08:52:19, 4] lib/substitute.c:(359) Home server: chevy [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(751) pdb_set_profile_path: setting profile path \\chevy\pavan\profile, was [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(884) pdb_set_workstations: setting workstations , was [2006/05/09 08:52:19, 10] lib/account_pol.c:(332) account_policy_get: name: password history, val: 0 [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(543) pdb_set_user_sid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-1410 [2006/05/09 08:52:19, 10] passdb/pdb_compat.c:(72) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-1410 from rid 1410 [2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(579) pdb_set_group_sid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-1031 [2006/05/09 08:52:19, 10] passdb/pdb_compat.c:(99) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-1031 from rid 1031 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 9] passdb/passdb.c:(2337) pdb_update_autolock_flag: Account pavan not autolocked, no check needed [2006/05/09 08:52:19, 4] libsmb/ntlm_check.c:(326) ntlm_password_check: Checking NT MD4 password [2006/05/09 08:52:19, 4] auth/auth_sam.c:(123) sam_account_ok: Checking SMB password for user pavan [2006/05/09 08:52:19, 5] auth/auth_sam.c:(104) logon_hours_ok: user pavan allowed to logon at this time (Tue May 9 08:52:19 2006 ) [2006/05/09 08:52:19, 10] lib/util_pw.c:(98) Got pavan from pwnam_cache [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/05/09 08:52:19, 3] smbd/uid.c:(392) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:52:19, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:19, 10] lib/system_smbd.c:(167) sys_getgrouplist: user [pavan] [2006/05/09 08:52:19, 10] lib/system_smbd.c:(175) sys_getgrouplist(): disabled winbindd for group lookup [user == pavan] [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2006/05/09 08:52:19, 3] smbd/uid.c:(392) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/05/09 08:52:19, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:19, 8] lib/system_smbd.c:(49) remove_duplicate_gids: Enter 2 gids [2006/05/09 08:52:19, 8] lib/system_smbd.c:(67) remove_duplicate_gids: Exit 1 gids [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2006/05/09 08:52:19, 3] smbd/uid.c:(392) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/05/09 08:52:19, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:52:19, 10] passdb/passdb.c:(1244) local_gid_to_sid: Fall back to algorithmic mapping: 15 -> S-1-5-21-4112424572-1378032116-4237619202-1031 [2006/05/09 08:52:19, 10] passdb/lookup_sid.c:(406) gid_to_sid: local 15 -> S-1-5-21-4112424572-1378032116-4237619202-1031 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 10] auth/auth_util.c:(437) NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 contains 5 SIDs SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:52:19, 5] auth/auth_util.c:(896) make_server_info_sam: made server info for user pavan -> pavan [2006/05/09 08:52:19, 3] auth/auth.c:(267) check_ntlm_password: sam authentication for user [pavan] succeeded [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/05/09 08:52:19, 3] smbd/uid.c:(392) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:52:19, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 5] auth/auth.c:(293) check_ntlm_password: PAM Account for user [pavan] succeeded [2006/05/09 08:52:19, 2] auth/auth.c:(302) check_ntlm_password: authentication for user [pavan] -> [pavan] -> [pavan] succeeded [2006/05/09 08:52:19, 5] auth/auth_util.c:(1485) attempting to free (and zero) a user_info structure [2006/05/09 08:52:19, 10] auth/auth_util.c:(1488) structure was created for pavan [2006/05/09 08:52:19, 10] auth/auth_ntlmssp.c:(119) Got NT session key of length 16 [2006/05/09 08:52:19, 10] auth/auth_ntlmssp.c:(126) Got LM session key of length 16 [2006/05/09 08:52:19, 10] libsmb/ntlmssp.c:(728) ntlmssp_server_auth: Created NTLM2 session key. [2006/05/09 08:52:19, 3] libsmb/ntlmssp_sign.c:(338) NTLMSSP Sign/Seal - Initialising with flags: [2006/05/09 08:52:19, 3] libsmb/ntlmssp.c:(63) Got NTLMSSP neg_flags=0x60088235 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_SEAL NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EXCH [2006/05/09 08:52:19, 10] smbd/password.c:(182) register_vuid: allocated vuid = 101 [2006/05/09 08:52:19, 10] smbd/password.c:(252) register_vuid: (205,15) pavan pavan CHEVY guest=0 [2006/05/09 08:52:19, 3] smbd/password.c:(257) User name: pavan Real name: pavan [2006/05/09 08:52:19, 3] smbd/password.c:(276) UNIX uid 205 is UNIX user pavan, and will be vuid 101 [2006/05/09 08:52:19, 7] param/loadparm.c:(4343) lp_servicenumber: couldn't find pavan [2006/05/09 08:52:19, 3] smbd/password.c:(304) Adding homes service for user 'pavan' using home directory: '/usr/users/pavan' [2006/05/09 08:52:19, 8] param/loadparm.c:(2445) add_a_service: Creating snum = 5 for pavan [2006/05/09 08:52:19, 10] param/loadparm.c:(2492) hash_a_service: hashing index 5 for service name pavan [2006/05/09 08:52:19, 3] param/loadparm.c:(2538) adding home's share [pavan] for user 'pavan' at '/usr/users/pavan' [2006/05/09 08:52:19, 6] param/loadparm.c:(2947) lp_file_list_changed() file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=110 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=65279 smb_uid=101 smb_mid=48064 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 9 (0x9) smb_bcc=67 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] A1 07 30 05 A0 03 0A 01 00 55 00 6E 00 69 00 78 ..0..... .U.n.i.x [010] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3 [020] 00 2E 00 30 00 2E 00 32 00 31 00 63 00 00 00 57 ...0...2 .1.c...W [030] 00 4F 00 52 00 4B 00 47 00 52 00 4F 00 55 00 50 .O.R.K.G .R.O.U.P [040] 00 00 00 ... [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 76 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x4c [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 3 of length 80 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=76 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=0 smb_pid=65279 smb_uid=101 smb_mid=48128 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 76 (0x4C) smb_vwv[ 2]= 8 (0x8) smb_vwv[ 3]= 1 (0x1) smb_bcc=33 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 00 5C 00 5C 00 43 00 48 00 45 00 56 00 59 00 5C .\.\.C.H .E.V.Y.\ [010] 00 49 00 50 00 43 00 24 00 00 00 3F 3F 3F 3F 3F .I.P.C.$ ...????? [020] 00 . [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBtconX (pid 404565) conn 0x0 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:19, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:19, 4] smbd/reply.c:(660) Client requested device type [?????] for share [IPC$] [2006/05/09 08:52:19, 5] smbd/service.c:(860) making a connection to 'normal' service ipc$ [2006/05/09 08:52:19, 3] lib/access.c:(291) only_ipaddrs_in_list: list has non-ip address (.india.hp.com) [2006/05/09 08:52:19, 3] lib/access.c:(316) check_access: hostnames in host allow/deny list. [2006/05/09 08:52:19, 2] lib/access.c:(322) Allowed connection from nt218201.india.hp.com (15.76.218.201) [2006/05/09 08:52:19, 5] lib/username.c:(290) Finding user pavan [2006/05/09 08:52:19, 5] lib/username.c:(234) Trying _Get_Pwnam(), username as lowercase is pavan [2006/05/09 08:52:19, 10] lib/util_pw.c:(98) Got pavan from pwnam_cache [2006/05/09 08:52:19, 5] lib/username.c:(266) Get_Pwnam_internals did find user [pavan]! [2006/05/09 08:52:19, 3] smbd/service.c:(488) Connect path is '/tmp' for service [IPC$] [2006/05/09 08:52:19, 4] rpc_server/srv_srvsvc_nt.c:(240) get_share_security: using default secdesc for IPC$ [2006/05/09 08:52:19, 10] lib/util_seaccess.c:(175) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2006/05/09 08:52:19, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x00000002, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410. [2006/05/09 08:52:19, 3] lib/util_seaccess.c:(250) [2006/05/09 08:52:19, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 [2006/05/09 08:52:19, 5] lib/util_seaccess.c:(308) se_access_check: access (2) granted. [2006/05/09 08:52:19, 3] smbd/vfs.c:(216) Initialising default vfs hooks [2006/05/09 08:52:19, 5] smbd/connection.c:(170) claiming IPC$ 0 [2006/05/09 08:52:19, 10] smbd/uid.c:(124) is_share_read_only_for_user: share IPC$ is read-only for unix user pavan [2006/05/09 08:52:19, 4] rpc_server/srv_srvsvc_nt.c:(240) get_share_security: using default secdesc for IPC$ [2006/05/09 08:52:19, 10] lib/util_seaccess.c:(175) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2006/05/09 08:52:19, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x00000001, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410. [2006/05/09 08:52:19, 3] lib/util_seaccess.c:(250) [2006/05/09 08:52:19, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1 [2006/05/09 08:52:19, 5] lib/util_seaccess.c:(308) se_access_check: access (1) granted. [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 5] auth/auth_util.c:(437) NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 contains 5 SIDs SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 205 Primary group is 15 and contains 1 supplementary groups Group[ 0]: 15 [2006/05/09 08:52:19, 5] smbd/uid.c:(308) change_to_user uid=(0,205) gid=(0,15) [2006/05/09 08:52:19, 3] smbd/service.c:(693) nt218201 (15.76.218.201) connect to service IPC$ initially as user pavan (uid=205, gid=15) (pid 404565) [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:19, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:19, 3] smbd/reply.c:(707) tconX service=IPC$ [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=48 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48128 smt_wct=3 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 1 (0x1) smb_bcc=7 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 49 50 43 00 00 00 00 IPC.... [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 100 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x64 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 4 of length 104 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=48192 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]=16384 (0x4000) smb_vwv[21]= 256 (0x100) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 256 (0x100) smb_bcc=17 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. [010] 00 . [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:19, 5] auth/auth_util.c:(437) NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 contains 5 SIDs SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:52:19, 5] auth/auth_util.c:(454) UNIX token of user 205 Primary group is 15 and contains 1 supplementary groups Group[ 0]: 15 [2006/05/09 08:52:19, 5] smbd/uid.c:(308) change_to_user uid=(0,205) gid=(0,15) [2006/05/09 08:52:19, 4] smbd/vfs.c:(738) vfs_ChDir to /tmp [2006/05/09 08:52:19, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 [2006/05/09 08:52:19, 4] smbd/nttrans.c:(330) nt_open_pipe: Opening pipe \wkssvc. [2006/05/09 08:52:19, 3] smbd/nttrans.c:(351) nt_open_pipe: Known pipe wkssvc opening. [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(179) Open pipe requested wkssvc (pipes_open=0) [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(285) Create pipe requested wkssvc [2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(77) init_pipe_handles: created handle list for pipe wkssvc [2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(92) init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(362) Created internal pipe wkssvc (pipes_open=0) [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(262) Opened pipe wkssvc with handle 76be (pipes_open=1) [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name wkssvc pnum=76be [2006/05/09 08:52:19, 5] smbd/nttrans.c:(400) do_ntcreate_pipe_open: open pipe = \wkssvc [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=48192 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=48640 (0xBE00) smb_vwv[ 3]= 374 (0x176) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 136 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x88 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 5 of length 140 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48256 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30398 (0x76BE) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [020] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 [030] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBwriteX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76be [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76be (pipes_open=1) [2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76be name: wkssvc open: Yes len: 72 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 72 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0b [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0048 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 11, flags = 3 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 11 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1495) api_pipe_bind_req: decode request. 1495 [2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(1505) api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_rb [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 00000000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0008 num_contexts: 01 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000c context_id : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 000e num_transfer_syntaxes: 01 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 00000f smb_io_rpc_iface [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 000010 smb_io_uuid uuid [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0010 data : 6bffd098 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0014 data : a112 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0016 data : 3610 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 0018 data : 98 33 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 001a data : 46 c3 f8 7e 34 5a [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0020 version: 00000001 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000024 smb_io_rpc_iface [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 000024 smb_io_uuid uuid [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0024 data : 8a885d04 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0028 data : 1ceb [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 002a data : 11c9 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 002c data : 9f e8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 002e data : 08 00 2b 10 48 60 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0034 version: 00000002 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1548) api_pipe_bind_req: make response. 1548 [2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(959) check_bind_req for \PIPE\wkssvc [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\samr [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\NETLOGON [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\srvsvc [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\wkssvc [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_ba [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 000053f0 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000008 smb_io_rpc_addr_str [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 len: 000d [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 000a str: \PIPE\ntsvcs. [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000017 smb_io_rpc_results [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0018 num_results: 01 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 001c result : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 001e reason : 0000 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000020 smb_io_rpc_iface [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 000020 smb_io_uuid uuid [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0020 data : 8a885d04 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0024 data : 1ceb [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0026 data : 11c9 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 0028 data : 9f e8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 002a data : 08 00 2b 10 48 60 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0030 version: 00000002 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0c [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0044 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 56 [2006/05/09 08:52:19, 3] smbd/pipes.c:(207) writeX-IPC pnum=76be nwritten=72 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=47 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48256 smt_wct=6 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 72 (0x48) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 59 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x3b [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 6 of length 63 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48320 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30398 (0x76BE) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBreadX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76be [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76be (pipes_open=1) [2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76be name: wkssvc len: 1024 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1049) read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2006/05/09 08:52:19, 3] smbd/pipes.c:(251) readX-IPC pnum=76be min=1024 max=1024 nread=68 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=127 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48320 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 68 (0x44) smb_vwv[ 6]= 59 (0x3B) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=68 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [040] 02 00 00 00 .... [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 144 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x90 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 7 of length 148 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=144 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=48384 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 60 (0x3C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 60 (0x3C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30398 (0x76BE) smb_bcc=77 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... [020] 00 24 00 00 00 00 00 00 00 10 E5 34 02 08 00 00 .$...... ...4.... [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h [040] 00 65 00 76 00 79 00 00 00 64 00 00 00 .e.v.y.. .d... [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 3] smbd/ipc.c:(538) trans <\PIPE\> data=60 params=0 setup=2 [2006/05/09 08:52:19, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:19, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:19, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76be [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76be (pipes_open=1) [2006/05/09 08:52:19, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "wkssvc" (pnum 76be) [2006/05/09 08:52:19, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d480 max_trans_reply: 1024 [2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76be name: wkssvc open: Yes len: 60 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 60 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 003c [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 00000024 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 0000 [2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 74 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\wkssvc [2006/05/09 08:52:19, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO [2006/05/09 08:52:19, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[0].fn == 12016d7f0 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 wks_io_q_query_info [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0000 ptr_srv_name: 0234e510 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000004 smb_io_unistr2 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0004 uni_max_len: 00000008 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0008 offset : 00000000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c uni_str_len: 00000008 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) 0010 buffer : \.\.c.h.e.v.y... [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0020 switch_value: 0064 [2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(66) _wks_query_info: 66 [2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(40) create_wks_info_100: 40 [2006/05/09 08:52:19, 5] rpc_parse/parse_wks.c:(79) Init WKS_INFO_100: 79 [2006/05/09 08:52:19, 5] rpc_parse/parse_wks.c:(139) init_wks_r_unknown_0: 139 [2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(76) _wks_query_info: 76 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 wks_io_r_query_info [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0000 switch_value: 0064 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0004 ptr_1 : 00000001 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000008 wks_io_wks_info_100 inf [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0008 platform_id : 000001f4 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c ptr_compname: 00000001 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0010 ptr_lan_grp : 00000001 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0014 ver_major : 00000004 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0018 ver_minor : 00000009 [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 00001c smb_io_unistr2 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 001c uni_max_len: 00000006 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0020 offset : 00000000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0024 uni_str_len: 00000006 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) 0028 buffer : C.H.E.V.Y... [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 000034 smb_io_unistr2 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0034 uni_max_len: 0000000a [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0038 offset : 00000000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 003c uni_str_len: 0000000a [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) 0040 buffer : W.O.R.K.G.R.O.U.P... [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(761) 0054 status : NT_STATUS_OK [2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called wkssvc successfully [2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 120 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 44 [2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76be name: wkssvc len: 1024 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 88. [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0070 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 00000058 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:19, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..112] [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=168 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=48384 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 112 (0x70) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 112 (0x70) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=113 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 70 00 00 00 01 00 00 ........ .p...... [010] 00 58 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .X...... .d...... [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ [030] 00 09 00 00 00 06 00 00 00 00 00 00 00 06 00 00 ........ ........ [040] 00 43 00 48 00 45 00 56 00 59 00 00 00 0A 00 00 .C.H.E.V .Y...... [050] 00 00 00 00 00 0A 00 00 00 57 00 4F 00 52 00 4B ........ .W.O.R.K [060] 00 47 00 52 00 4F 00 55 00 50 00 00 00 00 00 00 .G.R.O.U .P...... [070] 00 . [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 8 of length 45 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48448 smt_wct=3 smb_vwv[ 0]=30398 (0x76BE) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76be [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76be (pipes_open=1) [2006/05/09 08:52:19, 5] smbd/pipes.c:(272) reply_pipe_close: pnum:76be [2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(235) close_policy_by_pipe: deleted handle list for pipe wkssvc [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1165) closed pipe name wkssvc pnum=76be (pipes_open=0) [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48448 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 100 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x64 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 9 of length 104 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=48512 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]=16384 (0x4000) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 256 (0x100) smb_bcc=17 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. [010] 00 . [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 [2006/05/09 08:52:19, 4] smbd/nttrans.c:(330) nt_open_pipe: Opening pipe \srvsvc. [2006/05/09 08:52:19, 3] smbd/nttrans.c:(351) nt_open_pipe: Known pipe srvsvc opening. [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(179) Open pipe requested srvsvc (pipes_open=0) [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(285) Create pipe requested srvsvc [2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(77) init_pipe_handles: created handle list for pipe srvsvc [2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(92) init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(362) Created internal pipe srvsvc (pipes_open=0) [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(262) Opened pipe srvsvc with handle 76bf (pipes_open=1) [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name srvsvc pnum=76bf [2006/05/09 08:52:19, 5] smbd/nttrans.c:(400) do_ntcreate_pipe_open: open pipe = \srvsvc [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=48512 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=48896 (0xBF00) smb_vwv[ 3]= 374 (0x176) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 136 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x88 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 10 of length 140 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48576 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30399 (0x76BF) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [020] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. [030] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBwriteX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76bf [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76bf (pipes_open=1) [2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76bf name: srvsvc open: Yes len: 72 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 72 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0b [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0048 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 11, flags = 3 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 11 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1495) api_pipe_bind_req: decode request. 1495 [2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(1505) api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_rb [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 00000000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0008 num_contexts: 01 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000c context_id : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 000e num_transfer_syntaxes: 01 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 00000f smb_io_rpc_iface [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 000010 smb_io_uuid uuid [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0010 data : 4b324fc8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0014 data : 1670 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0016 data : 01d3 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 0018 data : 12 78 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 001a data : 5a 47 bf 6e e1 88 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0020 version: 00000003 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000024 smb_io_rpc_iface [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 000024 smb_io_uuid uuid [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0024 data : 8a885d04 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0028 data : 1ceb [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 002a data : 11c9 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 002c data : 9f e8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 002e data : 08 00 2b 10 48 60 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0034 version: 00000002 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1548) api_pipe_bind_req: make response. 1548 [2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(959) check_bind_req for \PIPE\srvsvc [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\samr [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\NETLOGON [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\srvsvc [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_ba [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 000053f0 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000008 smb_io_rpc_addr_str [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 len: 000d [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 000a str: \PIPE\ntsvcs. [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000017 smb_io_rpc_results [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0018 num_results: 01 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 001c result : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 001e reason : 0000 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000020 smb_io_rpc_iface [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 000020 smb_io_uuid uuid [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0020 data : 8a885d04 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0024 data : 1ceb [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0026 data : 11c9 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 0028 data : 9f e8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 002a data : 08 00 2b 10 48 60 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0030 version: 00000002 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0c [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0044 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 56 [2006/05/09 08:52:19, 3] smbd/pipes.c:(207) writeX-IPC pnum=76bf nwritten=72 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=47 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48576 smt_wct=6 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 72 (0x48) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 59 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x3b [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 11 of length 63 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48640 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30399 (0x76BF) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBreadX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76bf [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76bf (pipes_open=1) [2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76bf name: srvsvc len: 1024 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1049) read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2006/05/09 08:52:19, 3] smbd/pipes.c:(251) readX-IPC pnum=76bf min=1024 max=1024 nread=68 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=127 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48640 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 68 (0x44) smb_vwv[ 6]= 59 (0x3B) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=68 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [040] 02 00 00 00 .... [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 144 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x90 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 12 of length 148 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=144 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=48704 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 60 (0x3C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 60 (0x3C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30399 (0x76BF) smb_bcc=77 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... [020] 00 24 00 00 00 00 00 15 00 10 E5 34 02 08 00 00 .$...... ...4.... [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h [040] 00 65 00 76 00 79 00 00 00 65 00 00 00 .e.v.y.. .e... [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 3] smbd/ipc.c:(538) trans <\PIPE\> data=60 params=0 setup=2 [2006/05/09 08:52:19, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:19, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:19, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76bf [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76bf (pipes_open=1) [2006/05/09 08:52:19, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "srvsvc" (pnum 76bf) [2006/05/09 08:52:19, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d480 max_trans_reply: 1024 [2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76bf name: srvsvc open: Yes len: 60 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 60 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 003c [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 00000024 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 0015 [2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 74 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\srvsvc [2006/05/09 08:52:19, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO [2006/05/09 08:52:19, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[11].fn == 12017a0c0 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 srv_io_q_net_srv_get_info [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0000 ptr_srv_name : 0234e510 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000004 smb_io_unistr2 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0004 uni_max_len: 00000008 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0008 offset : 00000000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c uni_str_len: 00000008 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) 0010 buffer : \.\.c.h.e.v.y... [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0020 switch_value : 00000065 [2006/05/09 08:52:19, 5] rpc_server/srv_srvsvc_nt.c:(1235) srv_net_srv_get_info: 1235 [2006/05/09 08:52:19, 5] rpc_parse/parse_srv.c:(2809) init_srv_info_101 [2006/05/09 08:52:19, 5] rpc_parse/parse_srv.c:(3044) init_srv_r_net_srv_get_info [2006/05/09 08:52:19, 5] rpc_server/srv_srvsvc_nt.c:(1280) srv_net_srv_get_info: 1280 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 srv_io_r_net_srv_get_info [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000000 srv_io_info_ctr ctr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0000 switch_value: 00000065 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0004 ptr_srv_ctr : 00000001 [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 000008 srv_io_info_101 sv101 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0008 platform_id : 000001f4 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c ptr_name : 00000001 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0010 ver_major : 00000004 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0014 ver_minor : 00000009 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0018 srv_type : 00009a03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 001c ptr_comment : 00000001 [2006/05/09 08:52:19, 8] rpc_parse/parse_prs.c:(84) 000020 smb_io_unistr2 uni_name [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0020 uni_max_len: 00000006 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0024 offset : 00000000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0028 uni_str_len: 00000006 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) 002c buffer : C.H.E.V.Y... [2006/05/09 08:52:19, 8] rpc_parse/parse_prs.c:(84) 000038 smb_io_unistr2 uni_comment [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0038 uni_max_len: 0000000e [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 003c offset : 00000000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0040 uni_str_len: 0000000e [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) 0044 buffer : S.a.m.b.a. .3...0...2.1.c... [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(791) 0060 status: WERR_OK [2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called srvsvc successfully [2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 192 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 44 [2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76bf name: srvsvc len: 1024 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 100. [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 007c [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 00000064 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:19, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..124] [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=180 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=48704 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 124 (0x7C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 124 (0x7C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=125 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 7C 00 00 00 01 00 00 ........ .|...... [010] 00 64 00 00 00 00 00 00 00 65 00 00 00 01 00 00 .d...... .e...... [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ [030] 00 03 9A 00 00 01 00 00 00 06 00 00 00 00 00 00 ........ ........ [040] 00 06 00 00 00 43 00 48 00 45 00 56 00 59 00 00 .....C.H .E.V.Y.. [050] 00 0E 00 00 00 00 00 00 00 0E 00 00 00 53 00 61 ........ .....S.a [060] 00 6D 00 62 00 61 00 20 00 33 00 2E 00 30 00 2E .m.b.a. .3...0.. [070] 00 32 00 31 00 63 00 00 00 00 00 00 00 .2.1.c.. ..... [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 13 of length 45 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48768 smt_wct=3 smb_vwv[ 0]=30399 (0x76BF) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76bf [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76bf (pipes_open=1) [2006/05/09 08:52:19, 5] smbd/pipes.c:(272) reply_pipe_close: pnum:76bf [2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(235) close_policy_by_pipe: deleted handle list for pipe srvsvc [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1165) closed pipe name srvsvc pnum=76bf (pipes_open=0) [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48768 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 100 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x64 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 14 of length 104 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=48832 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]=16384 (0x4000) smb_vwv[21]= 256 (0x100) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 256 (0x100) smb_bcc=17 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. [010] 00 . [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 [2006/05/09 08:52:19, 4] smbd/nttrans.c:(330) nt_open_pipe: Opening pipe \wkssvc. [2006/05/09 08:52:19, 3] smbd/nttrans.c:(351) nt_open_pipe: Known pipe wkssvc opening. [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(179) Open pipe requested wkssvc (pipes_open=0) [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(285) Create pipe requested wkssvc [2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(77) init_pipe_handles: created handle list for pipe wkssvc [2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(92) init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(362) Created internal pipe wkssvc (pipes_open=0) [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(262) Opened pipe wkssvc with handle 76c0 (pipes_open=1) [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name wkssvc pnum=76c0 [2006/05/09 08:52:19, 5] smbd/nttrans.c:(400) do_ntcreate_pipe_open: open pipe = \wkssvc [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=48832 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=49152 (0xC000) smb_vwv[ 3]= 374 (0x176) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 136 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x88 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 15 of length 140 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48896 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30400 (0x76C0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [020] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 [030] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBwriteX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c0 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76c0 (pipes_open=1) [2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c0 name: wkssvc open: Yes len: 72 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 72 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0b [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0048 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 11, flags = 3 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 11 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1495) api_pipe_bind_req: decode request. 1495 [2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(1505) api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_rb [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 00000000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0008 num_contexts: 01 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000c context_id : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 000e num_transfer_syntaxes: 01 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 00000f smb_io_rpc_iface [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 000010 smb_io_uuid uuid [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0010 data : 6bffd098 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0014 data : a112 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0016 data : 3610 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 0018 data : 98 33 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 001a data : 46 c3 f8 7e 34 5a [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0020 version: 00000001 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000024 smb_io_rpc_iface [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 000024 smb_io_uuid uuid [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0024 data : 8a885d04 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0028 data : 1ceb [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 002a data : 11c9 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 002c data : 9f e8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 002e data : 08 00 2b 10 48 60 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0034 version: 00000002 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1548) api_pipe_bind_req: make response. 1548 [2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(959) check_bind_req for \PIPE\wkssvc [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\samr [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\NETLOGON [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\srvsvc [2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\wkssvc [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_ba [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 000053f0 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000008 smb_io_rpc_addr_str [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 len: 000d [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 000a str: \PIPE\ntsvcs. [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000017 smb_io_rpc_results [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0018 num_results: 01 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 001c result : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 001e reason : 0000 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000020 smb_io_rpc_iface [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 000020 smb_io_uuid uuid [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0020 data : 8a885d04 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0024 data : 1ceb [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0026 data : 11c9 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 0028 data : 9f e8 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) 002a data : 08 00 2b 10 48 60 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0030 version: 00000002 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0c [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0044 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 56 [2006/05/09 08:52:19, 3] smbd/pipes.c:(207) writeX-IPC pnum=76c0 nwritten=72 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=47 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48896 smt_wct=6 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 72 (0x48) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 59 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x3b [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 16 of length 63 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48960 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30400 (0x76C0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBreadX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c0 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76c0 (pipes_open=1) [2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c0 name: wkssvc len: 1024 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1049) read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2006/05/09 08:52:19, 3] smbd/pipes.c:(251) readX-IPC pnum=76c0 min=1024 max=1024 nread=68 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=127 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=48960 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 68 (0x44) smb_vwv[ 6]= 59 (0x3B) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=68 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [040] 02 00 00 00 .... [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 144 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x90 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 17 of length 148 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=144 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=49024 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 60 (0x3C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 60 (0x3C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30400 (0x76C0) smb_bcc=77 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... [020] 00 24 00 00 00 00 00 00 00 F0 E4 34 02 08 00 00 .$...... ...4.... [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h [040] 00 65 00 76 00 79 00 00 00 64 00 00 00 .e.v.y.. .d... [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 3] smbd/ipc.c:(538) trans <\PIPE\> data=60 params=0 setup=2 [2006/05/09 08:52:19, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:19, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:19, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c0 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76c0 (pipes_open=1) [2006/05/09 08:52:19, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "wkssvc" (pnum 76c0) [2006/05/09 08:52:19, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d480 max_trans_reply: 1024 [2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c0 name: wkssvc open: Yes len: 60 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 60 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 003c [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 00000024 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 0000 [2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 74 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\wkssvc [2006/05/09 08:52:19, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO [2006/05/09 08:52:19, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[0].fn == 12016d7f0 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 wks_io_q_query_info [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0000 ptr_srv_name: 0234e4f0 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000004 smb_io_unistr2 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0004 uni_max_len: 00000008 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0008 offset : 00000000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c uni_str_len: 00000008 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) 0010 buffer : \.\.c.h.e.v.y... [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0020 switch_value: 0064 [2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(66) _wks_query_info: 66 [2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(40) create_wks_info_100: 40 [2006/05/09 08:52:19, 5] rpc_parse/parse_wks.c:(79) Init WKS_INFO_100: 79 [2006/05/09 08:52:19, 5] rpc_parse/parse_wks.c:(139) init_wks_r_unknown_0: 139 [2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(76) _wks_query_info: 76 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 wks_io_r_query_info [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0000 switch_value: 0064 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0004 ptr_1 : 00000001 [2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) 000008 wks_io_wks_info_100 inf [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0008 platform_id : 000001f4 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c ptr_compname: 00000001 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0010 ptr_lan_grp : 00000001 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0014 ver_major : 00000004 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0018 ver_minor : 00000009 [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 00001c smb_io_unistr2 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 001c uni_max_len: 00000006 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0020 offset : 00000000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0024 uni_str_len: 00000006 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) 0028 buffer : C.H.E.V.Y... [2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) 000034 smb_io_unistr2 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0034 uni_max_len: 0000000a [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0038 offset : 00000000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 003c uni_str_len: 0000000a [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) 0040 buffer : W.O.R.K.G.R.O.U.P... [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(761) 0054 status : NT_STATUS_OK [2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called wkssvc successfully [2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 120 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 44 [2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c0 name: wkssvc len: 1024 [2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 88. [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0070 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 00000058 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:19, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..112] [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=168 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=49024 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 112 (0x70) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 112 (0x70) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=113 [2006/05/09 08:52:19, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 70 00 00 00 01 00 00 ........ .p...... [010] 00 58 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .X...... .d...... [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ [030] 00 09 00 00 00 06 00 00 00 00 00 00 00 06 00 00 ........ ........ [040] 00 43 00 48 00 45 00 56 00 59 00 00 00 0A 00 00 .C.H.E.V .Y...... [050] 00 00 00 00 00 0A 00 00 00 57 00 4F 00 52 00 4B ........ .W.O.R.K [060] 00 47 00 52 00 4F 00 55 00 50 00 00 00 00 00 00 .G.R.O.U .P...... [070] 00 . [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:19, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:19, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:19, 3] smbd/process.c:(1194) Transaction 18 of length 45 [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49088 smt_wct=3 smb_vwv[ 0]=30400 (0x76C0) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:19, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x14011b050 [2006/05/09 08:52:19, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c0 [2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76c0 (pipes_open=1) [2006/05/09 08:52:19, 5] smbd/pipes.c:(272) reply_pipe_close: pnum:76c0 [2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(235) close_policy_by_pipe: deleted handle list for pipe wkssvc [2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1165) closed pipe name wkssvc pnum=76c0 (pipes_open=0) [2006/05/09 08:52:19, 5] lib/util.c:(454) [2006/05/09 08:52:19, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49088 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:19, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:19, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 100 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x64 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 19 of length 104 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=49152 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]=16384 (0x4000) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 256 (0x100) smb_bcc=17 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. [010] 00 . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 [2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) nt_open_pipe: Opening pipe \srvsvc. [2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) nt_open_pipe: Known pipe srvsvc opening. [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) Open pipe requested srvsvc (pipes_open=0) [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) Create pipe requested srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) init_pipe_handles: created handle list for pipe srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) Created internal pipe srvsvc (pipes_open=0) [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) Opened pipe srvsvc with handle 76c1 (pipes_open=1) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name srvsvc pnum=76c1 [2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) do_ntcreate_pipe_open: open pipe = \srvsvc [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=49152 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=49408 (0xC100) smb_vwv[ 3]= 374 (0x176) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 136 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x88 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 20 of length 140 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49216 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30401 (0x76C1) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [020] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. [030] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBwriteX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c1 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76c1 (pipes_open=1) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c1 name: srvsvc open: Yes len: 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0b [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0048 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 11, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 11 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) api_pipe_bind_req: decode request. 1495 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_rb [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0008 num_contexts: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000c context_id : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 000e num_transfer_syntaxes: 01 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 00000f smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000010 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 data : 4b324fc8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 data : 1670 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0016 data : 01d3 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0018 data : 12 78 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 001a data : 5a 47 bf 6e e1 88 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 version: 00000003 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000024 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000024 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0028 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 002a data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002c data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002e data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0034 version: 00000002 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) api_pipe_bind_req: make response. 1548 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) check_bind_req for \PIPE\srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\samr [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\NETLOGON [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\srvsvc [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_ba [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 000053f0 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000008 smb_io_rpc_addr_str [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 len: 000d [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000a str: \PIPE\ntsvcs. [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000017 smb_io_rpc_results [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0018 num_results: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001c result : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001e reason : 0000 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000020 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000020 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0024 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0026 data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0028 data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002a data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0030 version: 00000002 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0044 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 56 [2006/05/09 08:52:20, 3] smbd/pipes.c:(207) writeX-IPC pnum=76c1 nwritten=72 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=47 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49216 smt_wct=6 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 72 (0x48) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 59 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x3b [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 21 of length 63 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49280 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30401 (0x76C1) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBreadX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c1 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76c1 (pipes_open=1) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c1 name: srvsvc len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2006/05/09 08:52:20, 3] smbd/pipes.c:(251) readX-IPC pnum=76c1 min=1024 max=1024 nread=68 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=127 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49280 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 68 (0x44) smb_vwv[ 6]= 59 (0x3B) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=68 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [040] 02 00 00 00 .... [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 168 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0xa8 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 22 of length 172 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=168 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=49344 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 84 (0x54) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 84 (0x54) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30401 (0x76C1) smb_bcc=101 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 54 00 00 00 01 00 00 ........ .T...... [020] 00 3C 00 00 00 00 00 0F 00 44 98 03 00 08 00 00 .<...... .D...... [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h [040] 00 65 00 76 00 79 00 00 00 01 00 00 00 01 00 00 .e.v.y.. ........ [050] 00 6C E1 7E 01 00 00 00 00 00 00 00 00 FF FF FF .l.~.... ........ [060] FF 00 00 00 00 ..... [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 3] smbd/ipc.c:(538) trans <\PIPE\> data=84 params=0 setup=2 [2006/05/09 08:52:20, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:20, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:20, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c1 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76c1 (pipes_open=1) [2006/05/09 08:52:20, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "srvsvc" (pnum 76c1) [2006/05/09 08:52:20, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d480 max_trans_reply: 1024 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c1 name: srvsvc open: Yes len: 84 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 84 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 84 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 84, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 68 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 68 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0054 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 68 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 68, incoming data = 68 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 0000003c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 000f [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 74 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\srvsvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: srvsvc op 0xf - api_rpcTNP: rpc command: SRV_NET_SHARE_ENUM_ALL [2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[3].fn == 12017a720 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 srv_io_q_net_share_enum [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 ptr_srv_name: 00039844 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000004 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 uni_max_len: 00000008 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0008 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c uni_str_len: 00000008 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0010 buffer : \.\.c.h.e.v.y... [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000020 srv_io_srv_share_ctr share_ctr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 info_level: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 switch_value: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0028 ptr_share_info: 017ee16c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 002c num_entries: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0030 ptr_entries: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0034 preferred_len: ffffffff [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000038 smb_io_enum_hnd enum_hnd [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0038 ptr_hnd: 00000000 [2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1443) _srv_net_share_enum: 1443 [2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(752) init_srv_r_net_share_enum: 752 [2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(524) init_srv_share_info_ctr [2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(142) init_srv_share_info1: audit 0 Audited /bin directory [2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(101) init_srv_share_info1_str [2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(142) init_srv_share_info1: IPC$ 3 IPC Service (Samba 3.0.21c) [2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(101) init_srv_share_info1_str [2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(142) init_srv_share_info1: ADMIN$ 3 IPC Service (Samba 3.0.21c) [2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(101) init_srv_share_info1_str [2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(142) init_srv_share_info1: pavan 0 Home Directories [2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(101) init_srv_share_info1_str [2006/05/09 08:52:20, 5] rpc_parse/parse_misc.c:(159) smb_io_enum_hnd [2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1455) _srv_net_share_enum: 1455 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 srv_io_r_net_share_enum [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 srv_io_srv_share_ctr share_ctr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 info_level: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 switch_value: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0008 ptr_share_info: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c num_entries: 00000004 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 ptr_entries: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0014 num_entries2: 00000004 [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000018 srv_io_share_info1 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0018 ptr_netname: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 001c type : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 ptr_remark : 00000001 [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000024 srv_io_share_info1 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 ptr_netname: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0028 type : 00000003 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 002c ptr_remark : 00000001 [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000030 srv_io_share_info1 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0030 ptr_netname: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0034 type : 00000003 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0038 ptr_remark : 00000001 [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 00003c srv_io_share_info1 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 003c ptr_netname: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0040 type : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0044 ptr_remark : 00000001 [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000048 srv_io_share_info1_str [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 000048 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0048 uni_max_len: 00000006 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 004c offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0050 uni_str_len: 00000006 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0054 buffer : a.u.d.i.t... [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 000060 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0060 uni_max_len: 00000017 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0064 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0068 uni_str_len: 00000017 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 006c buffer : A.u.d.i.t.e.d. ./.b.i.n. .d.i.r.e.c.t.o.r.y... [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 00009a srv_io_share_info1_str [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 00009c smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 009c uni_max_len: 00000005 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 00a0 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 00a4 uni_str_len: 00000005 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 00a8 buffer : I.P.C.$... [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 0000b4 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 00b4 uni_max_len: 0000001c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 00b8 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 00bc uni_str_len: 0000001c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 00c0 buffer : I.P.C. .S.e.r.v.i.c.e. .(.S.a.m.b.a. .3...0...2.1.c.)... [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 0000f8 srv_io_share_info1_str [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 0000f8 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 00f8 uni_max_len: 00000007 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 00fc offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0100 uni_str_len: 00000007 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0104 buffer : A.D.M.I.N.$... [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 000114 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0114 uni_max_len: 0000001c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0118 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 011c uni_str_len: 0000001c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0120 buffer : I.P.C. .S.e.r.v.i.c.e. .(.S.a.m.b.a. .3...0...2.1.c.)... [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000158 srv_io_share_info1_str [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 000158 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0158 uni_max_len: 00000006 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 015c offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0160 uni_str_len: 00000006 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0164 buffer : p.a.v.a.n... [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 000170 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0170 uni_max_len: 00000011 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0174 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0178 uni_str_len: 00000011 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 017c buffer : H.o.m.e. .D.i.r.e.c.t.o.r.i.e.s... [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 01a0 total_entries: 00000004 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 0001a4 smb_io_enum_hnd enum_hnd [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 01a4 ptr_hnd: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) 01a8 status: WERR_OK [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called srvsvc successfully [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 544 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 68 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c1 name: srvsvc len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 428. [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 01c4 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 000001ac [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:20, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..452] [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=508 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=49344 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 452 (0x1C4) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 452 (0x1C4) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=453 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 C4 01 00 00 01 00 00 ........ ........ [010] 00 AC 01 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ [020] 00 01 00 00 00 04 00 00 00 01 00 00 00 04 00 00 ........ ........ [030] 00 01 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ [040] 00 03 00 00 00 01 00 00 00 01 00 00 00 03 00 00 ........ ........ [050] 00 01 00 00 00 01 00 00 00 00 00 00 00 01 00 00 ........ ........ [060] 00 06 00 00 00 00 00 00 00 06 00 00 00 61 00 75 ........ .....a.u [070] 00 64 00 69 00 74 00 00 00 17 00 00 00 00 00 00 .d.i.t.. ........ [080] 00 17 00 00 00 41 00 75 00 64 00 69 00 74 00 65 .....A.u .d.i.t.e [090] 00 64 00 20 00 2F 00 62 00 69 00 6E 00 20 00 64 .d. ./.b .i.n. .d [0A0] 00 69 00 72 00 65 00 63 00 74 00 6F 00 72 00 79 .i.r.e.c .t.o.r.y [0B0] 00 00 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ [0C0] 00 49 00 50 00 43 00 24 00 00 00 00 00 1C 00 00 .I.P.C.$ ........ [0D0] 00 00 00 00 00 1C 00 00 00 49 00 50 00 43 00 20 ........ .I.P.C. [0E0] 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 .S.e.r.v .i.c.e. [0F0] 00 28 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 .(.S.a.m .b.a. .3 [100] 00 2E 00 30 00 2E 00 32 00 31 00 63 00 29 00 00 ...0...2 .1.c.).. [110] 00 07 00 00 00 00 00 00 00 07 00 00 00 41 00 44 ........ .....A.D [120] 00 4D 00 49 00 4E 00 24 00 00 00 00 00 1C 00 00 .M.I.N.$ ........ [130] 00 00 00 00 00 1C 00 00 00 49 00 50 00 43 00 20 ........ .I.P.C. [140] 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 .S.e.r.v .i.c.e. [150] 00 28 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 .(.S.a.m .b.a. .3 [160] 00 2E 00 30 00 2E 00 32 00 31 00 63 00 29 00 00 ...0...2 .1.c.).. [170] 00 06 00 00 00 00 00 00 00 06 00 00 00 70 00 61 ........ .....p.a [180] 00 76 00 61 00 6E 00 00 00 11 00 00 00 00 00 00 .v.a.n.. ........ [190] 00 11 00 00 00 48 00 6F 00 6D 00 65 00 20 00 44 .....H.o .m.e. .D [1A0] 00 69 00 72 00 65 00 63 00 74 00 6F 00 72 00 69 .i.r.e.c .t.o.r.i [1B0] 00 65 00 73 00 00 00 00 00 04 00 00 00 00 00 00 .e.s.... ........ [1C0] 00 00 00 00 00 ..... [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 23 of length 45 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49408 smt_wct=3 smb_vwv[ 0]=30401 (0x76C1) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c1 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76c1 (pipes_open=1) [2006/05/09 08:52:20, 5] smbd/pipes.c:(272) reply_pipe_close: pnum:76c1 [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235) close_policy_by_pipe: deleted handle list for pipe srvsvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165) closed pipe name srvsvc pnum=76c1 (pipes_open=0) [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49408 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 102 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x66 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 24 of length 106 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=102 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=220 smb_uid=101 smb_mid=49472 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 4096 (0x1000) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]=16384 (0x4000) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=19 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 73 00 70 00 6F 00 6F 00 6C 00 73 00 73 .\.s.p.o .o.l.s.s [010] 00 00 00 ... [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 [2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) nt_open_pipe: Opening pipe \spoolss. [2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) nt_open_pipe: Known pipe spoolss opening. [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) Open pipe requested spoolss (pipes_open=0) [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) Create pipe requested spoolss [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) init_pipe_handles: created handle list for pipe spoolss [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) init_pipe_handles: pipe_handles ref count = 1 for pipe spoolss [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) Created internal pipe spoolss (pipes_open=0) [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) Opened pipe spoolss with handle 76c2 (pipes_open=1) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name spoolss pnum=76c2 [2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) do_ntcreate_pipe_open: open pipe = \spoolss [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=220 smb_uid=101 smb_mid=49472 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=49664 (0xC200) smb_vwv[ 3]= 374 (0x176) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 136 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x88 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 25 of length 140 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49536 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30402 (0x76C2) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 17 00 00 ........ .H...... [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [020] 00 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 89 .xV4.4.. ....#Eg. [030] AB 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBwriteX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c2 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=1) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c2 name: spoolss open: Yes len: 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0b [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0048 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000017 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 11, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 11 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) api_pipe_bind_req: decode request. 1495 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) api_pipe_bind_req: \PIPE\spoolss -> \PIPE\spoolss [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_rb [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0008 num_contexts: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000c context_id : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 000e num_transfer_syntaxes: 01 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 00000f smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000010 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 data : 12345678 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 data : 1234 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0016 data : abcd [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0018 data : ef 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 001a data : 01 23 45 67 89 ab [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 version: 00000001 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000024 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000024 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0028 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 002a data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002c data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002e data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0034 version: 00000002 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) api_pipe_bind_req: make response. 1548 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) check_bind_req for \PIPE\spoolss [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\samr [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\NETLOGON [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\wkssvc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\winreg [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\spoolss [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_ba [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 000053f0 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000008 smb_io_rpc_addr_str [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 len: 000e [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000a str: \PIPE\spoolss. [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000018 smb_io_rpc_results [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0018 num_results: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001c result : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001e reason : 0000 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000020 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000020 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0024 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0026 data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0028 data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002a data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0030 version: 00000002 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0044 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000017 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 56 [2006/05/09 08:52:20, 3] smbd/pipes.c:(207) writeX-IPC pnum=76c2 nwritten=72 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=47 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49536 smt_wct=6 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 72 (0x48) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 59 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x3b [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 26 of length 63 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49600 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30402 (0x76C2) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBreadX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c2 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=1) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c2 name: spoolss len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) read_from_pipe: spoolss: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2006/05/09 08:52:20, 3] smbd/pipes.c:(251) readX-IPC pnum=76c2 min=1024 max=1024 nread=68 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=127 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49600 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 68 (0x44) smb_vwv[ 6]= 59 (0x3B) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=68 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 05 00 0C 03 10 00 00 00 44 00 00 00 17 00 00 00 ........ D....... [010] B8 10 B8 10 F0 53 00 00 0E 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ [020] 73 70 6F 6F 6C 73 73 00 01 00 00 00 00 00 00 00 spoolss. ........ [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [040] 02 00 00 00 .... [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 262 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x106 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 27 of length 266 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=262 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=220 smb_uid=101 smb_mid=49664 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 178 (0xB2) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 178 (0xB2) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30402 (0x76C2) smb_bcc=195 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 B2 00 00 00 17 00 00 ........ ........ [020] 00 9A 00 00 00 00 00 45 00 B8 FF 39 00 08 00 00 .......E ...9.... [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h [040] 00 65 00 76 00 79 00 00 00 00 00 00 00 00 00 00 .e.v.y.. ........ [050] 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ [060] 00 1C F5 95 00 1C 00 00 00 C8 93 39 00 78 F5 95 ........ ...9.x.. [070] 00 28 0A 00 00 03 00 00 00 00 00 00 00 00 00 39 .(...... .......9 [080] 00 0B 00 00 00 00 00 00 00 0B 00 00 00 5C 00 5C ........ .....\.\ [090] 00 4E 00 54 00 32 00 31 00 38 00 32 00 30 00 31 .N.T.2.1 .8.2.0.1 [0A0] 00 00 00 5C 00 09 00 00 00 00 00 00 00 09 00 00 ...\.... ........ [0B0] 00 6B 00 61 00 6D 00 61 00 6E 00 68 00 61 00 6C .k.a.m.a .n.h.a.l [0C0] 00 00 00 ... [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 3] smbd/ipc.c:(538) trans <\PIPE\> data=178 params=0 setup=2 [2006/05/09 08:52:20, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:20, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:20, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c2 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=1) [2006/05/09 08:52:20, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "spoolss" (pnum 76c2) [2006/05/09 08:52:20, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d480 max_trans_reply: 1024 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c2 name: spoolss open: Yes len: 178 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 178 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 178 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 178, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 162 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 162 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 00b2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000017 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 162 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 162, incoming data = 162 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 0000009a [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 0045 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 75 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\spoolss [2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX [2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[1].fn == 120184250 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 spoolss_io_q_open_printer_ex [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 ptr: 0039ffb8 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000004 smb_io_unistr2 printername [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 uni_max_len: 00000008 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0008 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c uni_str_len: 00000008 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0010 buffer : \.\.c.h.e.v.y... [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000020 spoolss_io_printer_default [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 datatype_ptr: 00000000 [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000024 smb_io_unistr2 - NULL datatype [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000024 spoolss_io_devmode_cont [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 size: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0028 devmode_ptr: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 002c access_required: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0030 user_switch: 00000001 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000034 spool_io_user_level [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0034 level: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0038 ptr: 0095f51c [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 00003c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 003c size: 0000001c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0040 ptr: 003993c8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0044 ptr: 0095f578 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0048 build: 00000a28 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 004c major: 00000003 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0050 minor: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0054 processor: 00390000 [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 000058 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0058 uni_max_len: 0000000b [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 005c offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0060 uni_str_len: 0000000b [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0064 buffer : \.\.N.T.2.1.8.2.0.1... [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 00007c smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 007c uni_max_len: 00000009 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0080 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0084 uni_str_len: 00000009 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0088 buffer : k.a.m.a.n.h.a.l... checking name: \\chevy [2006/05/09 08:52:20, 10] rpc_server/srv_spoolss_nt.c:(556) open_printer_hnd: name [\\chevy] [2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(142) Opened policy hnd[1] [000] 00 00 00 00 01 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D [010] 55 2C 06 00 U,.. [2006/05/09 08:52:20, 3] rpc_server/srv_spoolss_nt.c:(416) Setting printer type=\\chevy Printer is a print server [2006/05/09 08:52:20, 4] rpc_server/srv_spoolss_nt.c:(452) Setting printer name=\\chevy (len=7) [2006/05/09 08:52:20, 5] rpc_server/srv_spoolss_nt.c:(591) 1 printer handles active [2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D [010] 55 2C 06 00 U,.. [2006/05/09 08:52:20, 4] rpc_server/srv_spoolss_nt.c:(1638) Setting print server access = SERVER_ACCESS_ENUMERATE [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 spoolss_io_r_open_printer_ex [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_pol_hnd printer handle [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 data1: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 data2: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 data3: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a data4: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000c data5: ec 0a 60 44 55 2c 06 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) 0014 status code: WERR_OK [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called spoolss successfully [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 168 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 162 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c2 name: spoolss len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: spoolss: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0030 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000017 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 00000018 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:20, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..48] [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=220 smb_uid=101 smb_mid=49664 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 17 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ ........ [020] 00 00 00 00 00 EC 0A 60 44 55 2C 06 00 00 00 00 .......` DU,..... [030] 00 . [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 128 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x80 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 28 of length 132 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=220 smb_uid=101 smb_mid=49728 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30402 (0x76C2) smb_bcc=61 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 18 00 00 ........ .,...... [020] 00 14 00 00 00 00 00 1D 00 00 00 00 00 01 00 00 ........ ........ [030] 00 00 00 00 00 EC 0A 60 44 55 2C 06 00 .......` DU,.. [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 3] smbd/ipc.c:(538) trans <\PIPE\> data=44 params=0 setup=2 [2006/05/09 08:52:20, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:20, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:20, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c2 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=1) [2006/05/09 08:52:20, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "spoolss" (pnum 76c2) [2006/05/09 08:52:20, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d480 max_trans_reply: 1024 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c2 name: spoolss open: Yes len: 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 28 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 002c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000018 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 28 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 00000014 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 001d [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 0 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\spoolss [2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER [2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[3].fn == 120184930 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 spoolss_io_q_closeprinter [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_pol_hnd printer handle [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 data1: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 data2: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 data3: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a data4: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000c data5: ec 0a 60 44 55 2c 06 00 [2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D [010] 55 2C 06 00 U,.. [2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D [010] 55 2C 06 00 U,.. [2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D [010] 55 2C 06 00 U,.. [2006/05/09 08:52:20, 3] rpc_server/srv_lsa_hnd.c:(200) Closed policy [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 spoolss_io_r_closeprinter [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_pol_hnd printer handle [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 data1: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 data2: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 data3: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a data4: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000c data5: 00 00 00 00 00 00 00 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) 0014 status: WERR_OK [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called spoolss successfully [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 28 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c2 name: spoolss len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: spoolss: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0030 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000018 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 00000018 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:20, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..48] [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=220 smb_uid=101 smb_mid=49728 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 18 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [030] 00 . [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 100 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x64 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 29 of length 104 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=49792 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]=16384 (0x4000) smb_vwv[21]= 256 (0x100) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 256 (0x100) smb_bcc=17 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. [010] 00 . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 [2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) nt_open_pipe: Opening pipe \wkssvc. [2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) nt_open_pipe: Known pipe wkssvc opening. [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) Open pipe requested wkssvc (pipes_open=1) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210) open_rpc_pipe_p: name spoolss pnum=76c2 [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) Create pipe requested wkssvc [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) init_pipe_handles: created handle list for pipe wkssvc [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) Created internal pipe wkssvc (pipes_open=1) [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) Opened pipe wkssvc with handle 76c3 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name wkssvc pnum=76c3 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name spoolss pnum=76c2 [2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) do_ntcreate_pipe_open: open pipe = \wkssvc [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=49792 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=49920 (0xC300) smb_vwv[ 3]= 374 (0x176) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 136 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x88 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 30 of length 140 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49856 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30403 (0x76C3) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [020] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 [030] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBwriteX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c3 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76c3 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c3 name: wkssvc open: Yes len: 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0b [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0048 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 11, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 11 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) api_pipe_bind_req: decode request. 1495 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_rb [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0008 num_contexts: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000c context_id : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 000e num_transfer_syntaxes: 01 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 00000f smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000010 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 data : 6bffd098 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 data : a112 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0016 data : 3610 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0018 data : 98 33 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 001a data : 46 c3 f8 7e 34 5a [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 version: 00000001 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000024 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000024 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0028 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 002a data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002c data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002e data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0034 version: 00000002 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) api_pipe_bind_req: make response. 1548 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) check_bind_req for \PIPE\wkssvc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\samr [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\NETLOGON [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\wkssvc [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_ba [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 000053f0 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000008 smb_io_rpc_addr_str [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 len: 000d [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000a str: \PIPE\ntsvcs. [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000017 smb_io_rpc_results [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0018 num_results: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001c result : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001e reason : 0000 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000020 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000020 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0024 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0026 data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0028 data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002a data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0030 version: 00000002 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0044 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 56 [2006/05/09 08:52:20, 3] smbd/pipes.c:(207) writeX-IPC pnum=76c3 nwritten=72 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=47 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49856 smt_wct=6 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 72 (0x48) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 59 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x3b [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 31 of length 63 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49920 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30403 (0x76C3) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBreadX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c3 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76c3 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c3 name: wkssvc len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2006/05/09 08:52:20, 3] smbd/pipes.c:(251) readX-IPC pnum=76c3 min=1024 max=1024 nread=68 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=127 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=49920 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 68 (0x44) smb_vwv[ 6]= 59 (0x3B) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=68 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [040] 02 00 00 00 .... [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 144 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x90 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 32 of length 148 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=144 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=49984 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 60 (0x3C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 60 (0x3C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30403 (0x76C3) smb_bcc=77 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... [020] 00 24 00 00 00 00 00 00 00 F0 DF 7E 01 08 00 00 .$...... ...~.... [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h [040] 00 65 00 76 00 79 00 00 00 64 00 00 00 .e.v.y.. .d... [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 3] smbd/ipc.c:(538) trans <\PIPE\> data=60 params=0 setup=2 [2006/05/09 08:52:20, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:20, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:20, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c3 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76c3 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "wkssvc" (pnum 76c3) [2006/05/09 08:52:20, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d900 max_trans_reply: 1024 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c3 name: wkssvc open: Yes len: 60 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 60 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 003c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 00000024 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 0000 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 74 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\wkssvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO [2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[0].fn == 12016d7f0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 wks_io_q_query_info [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 ptr_srv_name: 017edff0 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000004 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 uni_max_len: 00000008 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0008 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c uni_str_len: 00000008 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0010 buffer : \.\.c.h.e.v.y... [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0020 switch_value: 0064 [2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(66) _wks_query_info: 66 [2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(40) create_wks_info_100: 40 [2006/05/09 08:52:20, 5] rpc_parse/parse_wks.c:(79) Init WKS_INFO_100: 79 [2006/05/09 08:52:20, 5] rpc_parse/parse_wks.c:(139) init_wks_r_unknown_0: 139 [2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(76) _wks_query_info: 76 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 wks_io_r_query_info [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 switch_value: 0064 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 ptr_1 : 00000001 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000008 wks_io_wks_info_100 inf [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0008 platform_id : 000001f4 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c ptr_compname: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 ptr_lan_grp : 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0014 ver_major : 00000004 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0018 ver_minor : 00000009 [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 00001c smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 001c uni_max_len: 00000006 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 uni_str_len: 00000006 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0028 buffer : C.H.E.V.Y... [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000034 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0034 uni_max_len: 0000000a [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0038 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 003c uni_str_len: 0000000a [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0040 buffer : W.O.R.K.G.R.O.U.P... [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(761) 0054 status : NT_STATUS_OK [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called wkssvc successfully [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 120 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 44 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c3 name: wkssvc len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 88. [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0070 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 00000058 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:20, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..112] [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=168 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=49984 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 112 (0x70) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 112 (0x70) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=113 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 70 00 00 00 01 00 00 ........ .p...... [010] 00 58 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .X...... .d...... [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ [030] 00 09 00 00 00 06 00 00 00 00 00 00 00 06 00 00 ........ ........ [040] 00 43 00 48 00 45 00 56 00 59 00 00 00 0A 00 00 .C.H.E.V .Y...... [050] 00 00 00 00 00 0A 00 00 00 57 00 4F 00 52 00 4B ........ .W.O.R.K [060] 00 47 00 52 00 4F 00 55 00 50 00 00 00 00 00 00 .G.R.O.U .P...... [070] 00 . [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 33 of length 45 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50048 smt_wct=3 smb_vwv[ 0]=30403 (0x76C3) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c3 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76c3 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 5] smbd/pipes.c:(272) reply_pipe_close: pnum:76c3 [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235) close_policy_by_pipe: deleted handle list for pipe wkssvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165) closed pipe name wkssvc pnum=76c3 (pipes_open=1) [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50048 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 100 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x64 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 34 of length 104 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=50112 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]=16384 (0x4000) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 256 (0x100) smb_bcc=17 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. [010] 00 . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 [2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) nt_open_pipe: Opening pipe \srvsvc. [2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) nt_open_pipe: Known pipe srvsvc opening. [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) Open pipe requested srvsvc (pipes_open=1) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210) open_rpc_pipe_p: name spoolss pnum=76c2 [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) Create pipe requested srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) init_pipe_handles: created handle list for pipe srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) Created internal pipe srvsvc (pipes_open=1) [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) Opened pipe srvsvc with handle 76c4 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name srvsvc pnum=76c4 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name spoolss pnum=76c2 [2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) do_ntcreate_pipe_open: open pipe = \srvsvc [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=50112 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=50176 (0xC400) smb_vwv[ 3]= 374 (0x176) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 136 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x88 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 35 of length 140 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50176 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30404 (0x76C4) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [020] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. [030] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBwriteX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c4 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76c4 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c4 name: srvsvc open: Yes len: 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0b [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0048 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 11, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 11 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) api_pipe_bind_req: decode request. 1495 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_rb [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0008 num_contexts: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000c context_id : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 000e num_transfer_syntaxes: 01 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 00000f smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000010 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 data : 4b324fc8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 data : 1670 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0016 data : 01d3 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0018 data : 12 78 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 001a data : 5a 47 bf 6e e1 88 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 version: 00000003 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000024 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000024 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0028 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 002a data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002c data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002e data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0034 version: 00000002 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) api_pipe_bind_req: make response. 1548 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) check_bind_req for \PIPE\srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\samr [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\NETLOGON [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\srvsvc [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_ba [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 000053f0 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000008 smb_io_rpc_addr_str [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 len: 000d [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000a str: \PIPE\ntsvcs. [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000017 smb_io_rpc_results [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0018 num_results: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001c result : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001e reason : 0000 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000020 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000020 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0024 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0026 data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0028 data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002a data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0030 version: 00000002 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0044 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 56 [2006/05/09 08:52:20, 3] smbd/pipes.c:(207) writeX-IPC pnum=76c4 nwritten=72 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=47 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50176 smt_wct=6 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 72 (0x48) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 59 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x3b [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 36 of length 63 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50240 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30404 (0x76C4) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBreadX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c4 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76c4 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c4 name: srvsvc len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2006/05/09 08:52:20, 3] smbd/pipes.c:(251) readX-IPC pnum=76c4 min=1024 max=1024 nread=68 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=127 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50240 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 68 (0x44) smb_vwv[ 6]= 59 (0x3B) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=68 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [040] 02 00 00 00 .... [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 144 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x90 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 37 of length 148 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=144 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=50304 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 60 (0x3C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 60 (0x3C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30404 (0x76C4) smb_bcc=77 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... [020] 00 24 00 00 00 00 00 15 00 F0 DF 7E 01 08 00 00 .$...... ...~.... [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h [040] 00 65 00 76 00 79 00 00 00 65 00 00 00 .e.v.y.. .e... [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 3] smbd/ipc.c:(538) trans <\PIPE\> data=60 params=0 setup=2 [2006/05/09 08:52:20, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:20, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:20, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c4 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76c4 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "srvsvc" (pnum 76c4) [2006/05/09 08:52:20, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d900 max_trans_reply: 1024 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c4 name: srvsvc open: Yes len: 60 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 60 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 003c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 00000024 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 0015 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 74 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\srvsvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO [2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[11].fn == 12017a0c0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 srv_io_q_net_srv_get_info [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 ptr_srv_name : 017edff0 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000004 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 uni_max_len: 00000008 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0008 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c uni_str_len: 00000008 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0010 buffer : \.\.c.h.e.v.y... [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 switch_value : 00000065 [2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1235) srv_net_srv_get_info: 1235 [2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(2809) init_srv_info_101 [2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(3044) init_srv_r_net_srv_get_info [2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1280) srv_net_srv_get_info: 1280 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 srv_io_r_net_srv_get_info [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 srv_io_info_ctr ctr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 switch_value: 00000065 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 ptr_srv_ctr : 00000001 [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000008 srv_io_info_101 sv101 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0008 platform_id : 000001f4 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c ptr_name : 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 ver_major : 00000004 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0014 ver_minor : 00000009 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0018 srv_type : 00009a03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 001c ptr_comment : 00000001 [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 000020 smb_io_unistr2 uni_name [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 uni_max_len: 00000006 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0028 uni_str_len: 00000006 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 002c buffer : C.H.E.V.Y... [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 000038 smb_io_unistr2 uni_comment [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0038 uni_max_len: 0000000e [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 003c offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0040 uni_str_len: 0000000e [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0044 buffer : S.a.m.b.a. .3...0...2.1.c... [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) 0060 status: WERR_OK [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called srvsvc successfully [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 192 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 44 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c4 name: srvsvc len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 100. [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 007c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 00000064 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:20, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..124] [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=180 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=50304 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 124 (0x7C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 124 (0x7C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=125 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 7C 00 00 00 01 00 00 ........ .|...... [010] 00 64 00 00 00 00 00 00 00 65 00 00 00 01 00 00 .d...... .e...... [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ [030] 00 03 9A 00 00 01 00 00 00 06 00 00 00 00 00 00 ........ ........ [040] 00 06 00 00 00 43 00 48 00 45 00 56 00 59 00 00 .....C.H .E.V.Y.. [050] 00 0E 00 00 00 00 00 00 00 0E 00 00 00 53 00 61 ........ .....S.a [060] 00 6D 00 62 00 61 00 20 00 33 00 2E 00 30 00 2E .m.b.a. .3...0.. [070] 00 32 00 31 00 63 00 00 00 00 00 00 00 .2.1.c.. ..... [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 38 of length 45 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50368 smt_wct=3 smb_vwv[ 0]=30404 (0x76C4) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c4 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76c4 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 5] smbd/pipes.c:(272) reply_pipe_close: pnum:76c4 [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235) close_policy_by_pipe: deleted handle list for pipe srvsvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165) closed pipe name srvsvc pnum=76c4 (pipes_open=1) [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50368 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 100 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x64 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 39 of length 104 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=50432 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]=16384 (0x4000) smb_vwv[21]= 256 (0x100) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 256 (0x100) smb_bcc=17 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. [010] 00 . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 [2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) nt_open_pipe: Opening pipe \wkssvc. [2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) nt_open_pipe: Known pipe wkssvc opening. [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) Open pipe requested wkssvc (pipes_open=1) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210) open_rpc_pipe_p: name spoolss pnum=76c2 [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) Create pipe requested wkssvc [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) init_pipe_handles: created handle list for pipe wkssvc [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) Created internal pipe wkssvc (pipes_open=1) [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) Opened pipe wkssvc with handle 76c5 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name wkssvc pnum=76c5 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name spoolss pnum=76c2 [2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) do_ntcreate_pipe_open: open pipe = \wkssvc [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=50432 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=50432 (0xC500) smb_vwv[ 3]= 374 (0x176) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 136 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x88 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 40 of length 140 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50496 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30405 (0x76C5) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [020] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 [030] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBwriteX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c5 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76c5 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c5 name: wkssvc open: Yes len: 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0b [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0048 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 11, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 11 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) api_pipe_bind_req: decode request. 1495 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_rb [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0008 num_contexts: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000c context_id : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 000e num_transfer_syntaxes: 01 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 00000f smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000010 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 data : 6bffd098 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 data : a112 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0016 data : 3610 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0018 data : 98 33 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 001a data : 46 c3 f8 7e 34 5a [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 version: 00000001 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000024 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000024 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0028 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 002a data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002c data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002e data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0034 version: 00000002 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) api_pipe_bind_req: make response. 1548 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) check_bind_req for \PIPE\wkssvc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\samr [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\NETLOGON [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\wkssvc [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_ba [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 000053f0 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000008 smb_io_rpc_addr_str [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 len: 000d [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000a str: \PIPE\ntsvcs. [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000017 smb_io_rpc_results [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0018 num_results: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001c result : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001e reason : 0000 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000020 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000020 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0024 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0026 data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0028 data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002a data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0030 version: 00000002 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0044 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 56 [2006/05/09 08:52:20, 3] smbd/pipes.c:(207) writeX-IPC pnum=76c5 nwritten=72 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=47 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50496 smt_wct=6 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 72 (0x48) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 59 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x3b [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 41 of length 63 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50560 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30405 (0x76C5) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBreadX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c5 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76c5 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c5 name: wkssvc len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2006/05/09 08:52:20, 3] smbd/pipes.c:(251) readX-IPC pnum=76c5 min=1024 max=1024 nread=68 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=127 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50560 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 68 (0x44) smb_vwv[ 6]= 59 (0x3B) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=68 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [040] 02 00 00 00 .... [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 144 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x90 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 42 of length 148 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=144 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=50624 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 60 (0x3C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 60 (0x3C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30405 (0x76C5) smb_bcc=77 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... [020] 00 24 00 00 00 00 00 00 00 F0 DF 7E 01 08 00 00 .$...... ...~.... [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h [040] 00 65 00 76 00 79 00 00 00 64 00 00 00 .e.v.y.. .d... [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 3] smbd/ipc.c:(538) trans <\PIPE\> data=60 params=0 setup=2 [2006/05/09 08:52:20, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:20, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:20, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c5 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76c5 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "wkssvc" (pnum 76c5) [2006/05/09 08:52:20, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d900 max_trans_reply: 1024 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c5 name: wkssvc open: Yes len: 60 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 60 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 003c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 00000024 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 0000 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 74 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\wkssvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO [2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[0].fn == 12016d7f0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 wks_io_q_query_info [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 ptr_srv_name: 017edff0 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000004 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 uni_max_len: 00000008 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0008 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c uni_str_len: 00000008 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0010 buffer : \.\.c.h.e.v.y... [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0020 switch_value: 0064 [2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(66) _wks_query_info: 66 [2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(40) create_wks_info_100: 40 [2006/05/09 08:52:20, 5] rpc_parse/parse_wks.c:(79) Init WKS_INFO_100: 79 [2006/05/09 08:52:20, 5] rpc_parse/parse_wks.c:(139) init_wks_r_unknown_0: 139 [2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(76) _wks_query_info: 76 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 wks_io_r_query_info [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 switch_value: 0064 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 ptr_1 : 00000001 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000008 wks_io_wks_info_100 inf [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0008 platform_id : 000001f4 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c ptr_compname: 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 ptr_lan_grp : 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0014 ver_major : 00000004 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0018 ver_minor : 00000009 [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 00001c smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 001c uni_max_len: 00000006 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 uni_str_len: 00000006 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0028 buffer : C.H.E.V.Y... [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000034 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0034 uni_max_len: 0000000a [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0038 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 003c uni_str_len: 0000000a [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0040 buffer : W.O.R.K.G.R.O.U.P... [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(761) 0054 status : NT_STATUS_OK [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called wkssvc successfully [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 120 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 44 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c5 name: wkssvc len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 88. [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0070 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 00000058 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:20, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..112] [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=168 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=50624 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 112 (0x70) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 112 (0x70) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=113 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 70 00 00 00 01 00 00 ........ .p...... [010] 00 58 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .X...... .d...... [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ [030] 00 09 00 00 00 06 00 00 00 00 00 00 00 06 00 00 ........ ........ [040] 00 43 00 48 00 45 00 56 00 59 00 00 00 0A 00 00 .C.H.E.V .Y...... [050] 00 00 00 00 00 0A 00 00 00 57 00 4F 00 52 00 4B ........ .W.O.R.K [060] 00 47 00 52 00 4F 00 55 00 50 00 00 00 00 00 00 .G.R.O.U .P...... [070] 00 . [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 43 of length 45 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50688 smt_wct=3 smb_vwv[ 0]=30405 (0x76C5) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c5 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name wkssvc pnum=76c5 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 5] smbd/pipes.c:(272) reply_pipe_close: pnum:76c5 [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235) close_policy_by_pipe: deleted handle list for pipe wkssvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165) closed pipe name wkssvc pnum=76c5 (pipes_open=1) [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50688 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 100 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x64 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 44 of length 104 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=50752 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]=16384 (0x4000) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 256 (0x100) smb_bcc=17 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. [010] 00 . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 [2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) nt_open_pipe: Opening pipe \srvsvc. [2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) nt_open_pipe: Known pipe srvsvc opening. [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) Open pipe requested srvsvc (pipes_open=1) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210) open_rpc_pipe_p: name spoolss pnum=76c2 [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) Create pipe requested srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) init_pipe_handles: created handle list for pipe srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) Created internal pipe srvsvc (pipes_open=1) [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) Opened pipe srvsvc with handle 76c6 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name srvsvc pnum=76c6 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name spoolss pnum=76c2 [2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) do_ntcreate_pipe_open: open pipe = \srvsvc [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=50752 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=50688 (0xC600) smb_vwv[ 3]= 374 (0x176) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 136 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x88 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 45 of length 140 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50816 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30406 (0x76C6) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [020] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. [030] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBwriteX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c6 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76c6 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c6 name: srvsvc open: Yes len: 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0b [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0048 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 11, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 11 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) api_pipe_bind_req: decode request. 1495 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_rb [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0008 num_contexts: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000c context_id : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 000e num_transfer_syntaxes: 01 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 00000f smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000010 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 data : 4b324fc8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 data : 1670 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0016 data : 01d3 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0018 data : 12 78 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 001a data : 5a 47 bf 6e e1 88 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 version: 00000003 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000024 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000024 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0028 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 002a data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002c data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002e data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0034 version: 00000002 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) api_pipe_bind_req: make response. 1548 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) check_bind_req for \PIPE\srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\samr [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\NETLOGON [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\srvsvc [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_ba [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 000053f0 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000008 smb_io_rpc_addr_str [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 len: 000d [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000a str: \PIPE\ntsvcs. [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000017 smb_io_rpc_results [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0018 num_results: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001c result : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001e reason : 0000 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000020 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000020 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0024 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0026 data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0028 data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002a data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0030 version: 00000002 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0044 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 56 [2006/05/09 08:52:20, 3] smbd/pipes.c:(207) writeX-IPC pnum=76c6 nwritten=72 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=47 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50816 smt_wct=6 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 72 (0x48) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 59 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x3b [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 46 of length 63 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50880 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30406 (0x76C6) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBreadX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c6 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76c6 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c6 name: srvsvc len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2006/05/09 08:52:20, 3] smbd/pipes.c:(251) readX-IPC pnum=76c6 min=1024 max=1024 nread=68 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=127 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=50880 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 68 (0x44) smb_vwv[ 6]= 59 (0x3B) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=68 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [040] 02 00 00 00 .... [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 144 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x90 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 47 of length 148 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=144 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=50944 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 60 (0x3C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 60 (0x3C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30406 (0x76C6) smb_bcc=77 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... [020] 00 24 00 00 00 00 00 15 00 F0 DF 7E 01 08 00 00 .$...... ...~.... [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h [040] 00 65 00 76 00 79 00 00 00 65 00 00 00 .e.v.y.. .e... [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 3] smbd/ipc.c:(538) trans <\PIPE\> data=60 params=0 setup=2 [2006/05/09 08:52:20, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:20, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:20, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c6 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76c6 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "srvsvc" (pnum 76c6) [2006/05/09 08:52:20, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d900 max_trans_reply: 1024 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c6 name: srvsvc open: Yes len: 60 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 60 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 003c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 00000024 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 0015 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 74 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\srvsvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO [2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[11].fn == 12017a0c0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 srv_io_q_net_srv_get_info [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 ptr_srv_name : 017edff0 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000004 smb_io_unistr2 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 uni_max_len: 00000008 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0008 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c uni_str_len: 00000008 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0010 buffer : \.\.c.h.e.v.y... [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 switch_value : 00000065 [2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1235) srv_net_srv_get_info: 1235 [2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(2809) init_srv_info_101 [2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(3044) init_srv_r_net_srv_get_info [2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1280) srv_net_srv_get_info: 1280 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 srv_io_r_net_srv_get_info [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 srv_io_info_ctr ctr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 switch_value: 00000065 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 ptr_srv_ctr : 00000001 [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000008 srv_io_info_101 sv101 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0008 platform_id : 000001f4 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c ptr_name : 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 ver_major : 00000004 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0014 ver_minor : 00000009 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0018 srv_type : 00009a03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 001c ptr_comment : 00000001 [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 000020 smb_io_unistr2 uni_name [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 uni_max_len: 00000006 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0028 uni_str_len: 00000006 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 002c buffer : C.H.E.V.Y... [2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) 000038 smb_io_unistr2 uni_comment [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0038 uni_max_len: 0000000e [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 003c offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0040 uni_str_len: 0000000e [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0044 buffer : S.a.m.b.a. .3...0...2.1.c... [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) 0060 status: WERR_OK [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called srvsvc successfully [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 192 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 44 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c6 name: srvsvc len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 100. [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 007c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 00000064 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:20, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..124] [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=180 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=50944 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 124 (0x7C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 124 (0x7C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=125 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 7C 00 00 00 01 00 00 ........ .|...... [010] 00 64 00 00 00 00 00 00 00 65 00 00 00 01 00 00 .d...... .e...... [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ [030] 00 03 9A 00 00 01 00 00 00 06 00 00 00 00 00 00 ........ ........ [040] 00 06 00 00 00 43 00 48 00 45 00 56 00 59 00 00 .....C.H .E.V.Y.. [050] 00 0E 00 00 00 00 00 00 00 0E 00 00 00 53 00 61 ........ .....S.a [060] 00 6D 00 62 00 61 00 20 00 33 00 2E 00 30 00 2E .m.b.a. .3...0.. [070] 00 32 00 31 00 63 00 00 00 00 00 00 00 .2.1.c.. ..... [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 48 of length 45 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=51008 smt_wct=3 smb_vwv[ 0]=30406 (0x76C6) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c6 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name srvsvc pnum=76c6 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 5] smbd/pipes.c:(272) reply_pipe_close: pnum:76c6 [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235) close_policy_by_pipe: deleted handle list for pipe srvsvc [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165) closed pipe name srvsvc pnum=76c6 (pipes_open=1) [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=51008 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 100 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x64 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 49 of length 104 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=51072 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=17 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 77 00 69 00 6E 00 72 00 65 00 67 00 00 .\.w.i.n .r.e.g.. [010] 00 . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0 [2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) nt_open_pipe: Opening pipe \winreg. [2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) nt_open_pipe: Known pipe winreg opening. [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) Open pipe requested winreg (pipes_open=1) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210) open_rpc_pipe_p: name spoolss pnum=76c2 [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) Create pipe requested winreg [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) init_pipe_handles: created handle list for pipe winreg [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) init_pipe_handles: pipe_handles ref count = 1 for pipe winreg [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) Created internal pipe winreg (pipes_open=1) [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) Opened pipe winreg with handle 76c7 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name winreg pnum=76c7 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) open pipes: name spoolss pnum=76c2 [2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) do_ntcreate_pipe_open: open pipe = \winreg [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=51072 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=50944 (0xC700) smb_vwv[ 3]= 374 (0x176) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:20, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:20, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:20, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 136 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x88 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 50 of length 140 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=51136 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30407 (0x76C7) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [020] 00 01 D0 8C 33 44 22 F1 31 AA AA 90 00 38 00 10 ....3D". 1....8.. [030] 03 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBwriteX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(287) setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:20, 5] auth/auth_util.c:(437) NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 contains 5 SIDs SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:52:20, 5] auth/auth_util.c:(454) UNIX token of user 205 Primary group is 15 and contains 1 supplementary groups Group[ 0]: 15 [2006/05/09 08:52:20, 5] smbd/uid.c:(308) change_to_user uid=(0,205) gid=(0,15) [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c7 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name winreg pnum=76c7 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c7 name: winreg open: Yes len: 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0b [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0048 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 11, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 11 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) api_pipe_bind_req: decode request. 1495 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) api_pipe_bind_req: \PIPE\winreg -> \PIPE\winreg [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_rb [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0008 num_contexts: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000c context_id : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 000e num_transfer_syntaxes: 01 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 00000f smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000010 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 data : 338cd001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 data : 2244 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0016 data : 31f1 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0018 data : aa aa [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 001a data : 90 00 38 00 10 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 version: 00000001 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000024 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000024 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0028 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 002a data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002c data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002e data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0034 version: 00000002 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) api_pipe_bind_req: make response. 1548 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) check_bind_req for \PIPE\winreg [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\lsarpc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\samr [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\NETLOGON [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\srvsvc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\wkssvc [2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) checking \PIPE\winreg [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_ba [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_bba [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0000 max_tsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0002 max_rsize: 10b8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 assoc_gid: 000053f0 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000008 smb_io_rpc_addr_str [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 len: 000d [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000a str: \PIPE\winreg. [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000017 smb_io_rpc_results [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0018 num_results: 01 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001c result : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 001e reason : 0000 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000020 smb_io_rpc_iface [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 000020 smb_io_uuid uuid [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 data : 8a885d04 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0024 data : 1ceb [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0026 data : 11c9 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 0028 data : 9f e8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 002a data : 08 00 2b 10 48 60 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0030 version: 00000002 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 0c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0044 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 56 [2006/05/09 08:52:20, 3] smbd/pipes.c:(207) writeX-IPC pnum=76c7 nwritten=72 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=47 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=51136 smt_wct=6 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 72 (0x48) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 59 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x3b [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 51 of length 63 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=51200 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30407 (0x76C7) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBreadX (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c7 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name winreg pnum=76c7 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c7 name: winreg len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) read_from_pipe: winreg: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2006/05/09 08:52:20, 3] smbd/pipes.c:(251) readX-IPC pnum=76c7 min=1024 max=1024 nread=68 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=127 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=51200 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 68 (0x44) smb_vwv[ 6]= 59 (0x3B) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=68 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ [020] 77 69 6E 72 65 67 00 00 01 00 00 00 00 00 00 00 winreg.. ........ [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [040] 02 00 00 00 .... [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 52 of length 124 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=120 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=51264 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 36 (0x24) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 36 (0x24) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30407 (0x76C7) smb_bcc=53 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 24 00 00 00 01 00 00 ........ .$...... [020] 00 0C 00 00 00 00 00 02 00 28 E3 7E 01 F8 B1 01 ........ .(.~.... [030] 00 00 00 00 02 ..... [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 3] smbd/ipc.c:(538) trans <\PIPE\> data=36 params=0 setup=2 [2006/05/09 08:52:20, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:20, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:20, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c7 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name winreg pnum=76c7 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "winreg" (pnum 76c7) [2006/05/09 08:52:20, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d900 max_trans_reply: 1024 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c7 name: winreg open: Yes len: 36 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 36 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 36 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 36, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 20 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 20 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0024 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 20 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 20, incoming data = 20 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 0000000c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 0002 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 74 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\winreg [2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: winreg op 0x2 - api_rpcTNP: rpc command: REG_OPEN_HKLM [2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[3].fn == 120162b10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 reg_io_q_open_hive [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 ptr: 017ee328 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0004 server: b1f8 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0008 access: 02000000 [2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(255) push_sec_ctx(205, 15) : sec_ctx_stack_ndx = 1 [2006/05/09 08:52:20, 3] smbd/uid.c:(392) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:52:20, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:20, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (205, 15) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:20, 10] registry/reg_db.c:(265) regdb_open: refcount reset (1) [2006/05/09 08:52:20, 7] registry/reg_frontend.c:(359) regkey_open_internal: name = [HKLM] [2006/05/09 08:52:20, 10] registry/reg_cachehook.c:(95) reghook_cache_find: Searching for keyname [/HKLM] [2006/05/09 08:52:20, 10] lib/adt_tree.c:(341) pathtree_find: Enter [/HKLM] [2006/05/09 08:52:20, 10] lib/adt_tree.c:(413) pathtree_find: Exit [2006/05/09 08:52:20, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x02000000, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410. [2006/05/09 08:52:20, 3] lib/util_seaccess.c:(250) [2006/05/09 08:52:20, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 [2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(142) Opened policy hnd[1] [000] 00 00 00 00 02 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D [010] 55 2C 06 00 U,.. [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 reg_io_r_open_hive [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_pol_hnd [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 data1: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 data2: 00000002 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 data3: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a data4: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000c data5: ec 0a 60 44 55 2c 06 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) 0014 status: WERR_OK [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called winreg successfully [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 538 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 20 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c7 name: winreg len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0030 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000001 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 00000018 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:20, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..48] [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=51264 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ [020] 00 00 00 00 00 EC 0A 60 44 55 2C 06 00 00 00 00 .......` DU,..... [030] 00 . [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 228 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0xe4 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 53 of length 232 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=228 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=51328 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 144 (0x90) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 144 (0x90) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30407 (0x76C7) smb_bcc=161 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 90 00 00 00 02 00 00 ........ ........ [020] 00 78 00 00 00 00 00 0F 00 00 00 00 00 02 00 00 .x...... ........ [030] 00 00 00 00 00 EC 0A 60 44 55 2C 06 00 46 00 46 .......` DU,..F.F [040] 00 10 15 83 75 23 00 00 00 00 00 00 00 23 00 00 ....u#.. .....#.. [050] 00 53 00 4F 00 46 00 54 00 57 00 41 00 52 00 45 .S.O.F.T .W.A.R.E [060] 00 5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F .\.M.i.c .r.o.s.o [070] 00 66 00 74 00 5C 00 53 00 63 00 68 00 65 00 64 .f.t.\.S .c.h.e.d [080] 00 75 00 6C 00 69 00 6E 00 67 00 41 00 67 00 65 .u.l.i.n .g.A.g.e [090] 00 6E 00 74 00 00 00 00 00 00 00 00 00 19 00 02 .n.t.... ........ [0A0] 00 . [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 3] smbd/ipc.c:(538) trans <\PIPE\> data=144 params=0 setup=2 [2006/05/09 08:52:20, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:20, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:20, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c7 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name winreg pnum=76c7 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "winreg" (pnum 76c7) [2006/05/09 08:52:20, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d900 max_trans_reply: 1024 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c7 name: winreg open: Yes len: 144 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 144 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 144 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 144, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 128 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 128 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0090 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000002 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 128 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 128, incoming data = 128 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 00000078 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 000f [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 0 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\winreg [2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: winreg op 0xf - api_rpcTNP: rpc command: REG_OPEN_ENTRY [2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[1].fn == 120162de0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 reg_io_q_open_entry [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_pol_hnd [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 data1: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 data2: 00000002 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 data3: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a data4: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000c data5: ec 0a 60 44 55 2c 06 00 [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000014 prs_unistr4 name [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 length: 0046 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0016 size: 0046 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0018 ptr: 75831510 [2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) 00001c smb_io_unistr2 name [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 001c uni_max_len: 00000023 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0020 offset : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0024 uni_str_len: 00000023 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) 0028 buffer : S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.S.c.h.e.d.u.l.i.n.g.A.g.e.n.t... [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0070 unknown_0 : 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0074 access: 00020019 [2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D [010] 55 2C 06 00 U,.. [2006/05/09 08:52:20, 10] registry/reg_db.c:(248) regdb_open: incrementing refcount (1) [2006/05/09 08:52:20, 7] registry/reg_frontend.c:(359) regkey_open_internal: name = [HKLM\SOFTWARE\Microsoft\SchedulingAgent] [2006/05/09 08:52:20, 10] registry/reg_cachehook.c:(95) reghook_cache_find: Searching for keyname [/HKLM/SOFTWARE/Microsoft/SchedulingAgent] [2006/05/09 08:52:20, 10] lib/adt_tree.c:(341) pathtree_find: Enter [/HKLM/SOFTWARE/Microsoft/SchedulingAgent] [2006/05/09 08:52:20, 10] lib/adt_tree.c:(413) pathtree_find: Exit [2006/05/09 08:52:20, 5] registry/reg_db.c:(457) regdb_fetch_keys: tdb lookup failed to locate key [HKLM\SOFTWARE\Microsoft\SchedulingAgent] [2006/05/09 08:52:20, 10] registry/reg_db.c:(279) regdb_close: decrementing refcount (1) [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 reg_io_r_open_entry [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_pol_hnd handle [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 data1: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 data2: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 data3: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a data4: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000c data5: 00 00 00 00 00 00 00 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) 0014 status: WERR_BADFILE [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called winreg successfully [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 94 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 128 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c7 name: winreg len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0030 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000002 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 00000018 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:20, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..48] [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=51328 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 02 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ [030] 00 . [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 128 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x80 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 54 of length 132 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=51392 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30407 (0x76C7) smb_bcc=61 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 ........ .,...... [020] 00 14 00 00 00 00 00 05 00 00 00 00 00 02 00 00 ........ ........ [030] 00 00 00 00 00 EC 0A 60 44 55 2C 06 00 .......` DU,.. [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBtrans (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 3] smbd/ipc.c:(538) trans <\PIPE\> data=44 params=0 setup=2 [2006/05/09 08:52:20, 5] smbd/ipc.c:(560) calling named_pipe [2006/05/09 08:52:20, 3] smbd/ipc.c:(334) named pipe command on <> name [2006/05/09 08:52:20, 5] smbd/ipc.c:(265) api_fd_reply [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c7 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name winreg pnum=76c7 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 3] smbd/ipc.c:(294) Got API command 0x26 on pipe "winreg" (pnum 76c7) [2006/05/09 08:52:20, 10] smbd/ipc.c:(299) api_fd_reply: p:14010d900 max_trans_reply: 1024 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) write_to_pipe: 76c7 name: winreg open: Yes len: 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 16 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 28 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 002c [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000003 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) unmarshall_rpc_header: using little-endian RPC [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) unmarshall_rpc_header: type = 0, flags = 3 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) write_to_pipe: data_left = 28 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) process_complete_pdu: processing packet type 0 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr_req req [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 alloc_hint: 00000014 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0004 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0006 opnum : 0005 [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 0 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) Requested \PIPE\winreg [2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) api_rpcTNP: winreg op 0x5 - api_rpcTNP: rpc command: REG_CLOSE [2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) api_rpc_cmds[0].fn == 120162a20 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 reg_io_q_close [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_pol_hnd [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 data1: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 data2: 00000002 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 data3: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a data4: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000c data5: ec 0a 60 44 55 2c 06 00 [2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D [010] 55 2C 06 00 U,.. [2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D [010] 55 2C 06 00 U,.. [2006/05/09 08:52:20, 3] rpc_server/srv_lsa_hnd.c:(200) Closed policy [2006/05/09 08:52:20, 10] registry/reg_db.c:(279) regdb_close: decrementing refcount (0) [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 reg_io_r_close [2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) 000000 smb_io_pol_hnd [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0000 data1: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0004 data2: 00000000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 data3: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a data4: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) 000c data5: 00 00 00 00 00 00 00 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) 0014 status: WERR_OK [2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) api_rpcTNP: called winreg successfully [2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) free_pipe_context: destroying talloc pool of size 0 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) write_to_pipe: data_used = 28 [2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) read_from_pipe: 76c7 name: winreg len: 1024 [2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000000 smb_io_rpc_hdr hdr [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0000 major : 05 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0001 minor : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0002 pkt_type : 02 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0003 flags : 03 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0004 pack_type0: 10 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0005 pack_type1: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0006 pack_type2: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0007 pack_type3: 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0008 frag_len : 0030 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 000a auth_len : 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 000c call_id : 00000003 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) 000010 smb_io_rpc_hdr_resp resp [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) 0010 alloc_hint: 00000018 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) 0014 context_id: 0000 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0016 cancel_ct : 00 [2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) 0017 reserved : 00 [2006/05/09 08:52:20, 5] smbd/ipc.c:(58) copy_trans_params_and_data: params[0..0] data[0..48] [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=2236 smb_uid=101 smb_mid=51392 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2006/05/09 08:52:20, 10] lib/util.c:(2058) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [030] 00 . [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:20, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:20, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:20, 3] smbd/process.c:(1194) Transaction 55 of length 45 [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=51456 smt_wct=3 smb_vwv[ 0]=30407 (0x76C7) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:20, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x14011b050 [2006/05/09 08:52:20, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) search for pipe pnum=76c7 [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name winreg pnum=76c7 (pipes_open=2) [2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) pipe name spoolss pnum=76c2 (pipes_open=2) [2006/05/09 08:52:20, 5] smbd/pipes.c:(272) reply_pipe_close: pnum:76c7 [2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235) close_policy_by_pipe: deleted handle list for pipe winreg [2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165) closed pipe name winreg pnum=76c7 (pipes_open=1) [2006/05/09 08:52:20, 5] lib/util.c:(454) [2006/05/09 08:52:20, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=101 smb_mid=51456 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:20, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:20, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:22, 10] lib/util_sock.c:(618) got smb length of 78 [2006/05/09 08:52:22, 6] smbd/process.c:(1193) got message type 0x0 of len 0x4e [2006/05/09 08:52:22, 3] smbd/process.c:(1194) Transaction 56 of length 82 [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=78 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=0 smb_pid=65279 smb_uid=101 smb_mid=51520 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 78 (0x4E) smb_vwv[ 2]= 8 (0x8) smb_vwv[ 3]= 1 (0x1) smb_bcc=35 [2006/05/09 08:52:22, 10] lib/util.c:(2058) [000] 00 5C 00 5C 00 43 00 48 00 45 00 56 00 59 00 5C .\.\.C.H .E.V.Y.\ [010] 00 50 00 41 00 56 00 41 00 4E 00 00 00 3F 3F 3F .P.A.V.A .N...??? [020] 3F 3F 00 ??. [2006/05/09 08:52:22, 3] smbd/process.c:(993) switch message SMBtconX (pid 404565) conn 0x0 [2006/05/09 08:52:22, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:22, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:22, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:22, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:22, 4] smbd/reply.c:(660) Client requested device type [?????] for share [PAVAN] [2006/05/09 08:52:22, 5] smbd/service.c:(824) making a connection to 'homes' service [PAVAN] created at session setup time [2006/05/09 08:52:22, 3] lib/access.c:(291) only_ipaddrs_in_list: list has non-ip address (.india.hp.com) [2006/05/09 08:52:22, 3] lib/access.c:(316) check_access: hostnames in host allow/deny list. [2006/05/09 08:52:22, 2] lib/access.c:(322) Allowed connection from nt218201.india.hp.com (15.76.218.201) [2006/05/09 08:52:22, 5] lib/username.c:(290) Finding user pavan [2006/05/09 08:52:22, 5] lib/username.c:(234) Trying _Get_Pwnam(), username as lowercase is pavan [2006/05/09 08:52:22, 10] lib/util_pw.c:(98) Got pavan from pwnam_cache [2006/05/09 08:52:22, 5] lib/username.c:(266) Get_Pwnam_internals did find user [pavan]! [2006/05/09 08:52:22, 3] smbd/service.c:(488) Connect path is '/usr/users/pavan' for service [pavan] [2006/05/09 08:52:22, 4] rpc_server/srv_srvsvc_nt.c:(240) get_share_security: using default secdesc for pavan [2006/05/09 08:52:22, 10] lib/util_seaccess.c:(175) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2006/05/09 08:52:22, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x00000002, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410. [2006/05/09 08:52:22, 3] lib/util_seaccess.c:(250) [2006/05/09 08:52:22, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 [2006/05/09 08:52:22, 5] lib/util_seaccess.c:(308) se_access_check: access (2) granted. [2006/05/09 08:52:22, 3] smbd/vfs.c:(216) Initialising default vfs hooks [2006/05/09 08:52:22, 5] smbd/connection.c:(170) claiming pavan 0 [2006/05/09 08:52:22, 10] smbd/uid.c:(124) is_share_read_only_for_user: share pavan is read-write for unix user pavan [2006/05/09 08:52:22, 4] rpc_server/srv_srvsvc_nt.c:(240) get_share_security: using default secdesc for pavan [2006/05/09 08:52:22, 10] lib/util_seaccess.c:(175) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2006/05/09 08:52:22, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x00000002, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410. [2006/05/09 08:52:22, 3] lib/util_seaccess.c:(250) [2006/05/09 08:52:22, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 [2006/05/09 08:52:22, 5] lib/util_seaccess.c:(308) se_access_check: access (2) granted. [2006/05/09 08:52:22, 4] rpc_server/srv_srvsvc_nt.c:(240) get_share_security: using default secdesc for pavan [2006/05/09 08:52:22, 10] lib/util_seaccess.c:(175) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2006/05/09 08:52:22, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x00000002, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410. [2006/05/09 08:52:22, 3] lib/util_seaccess.c:(250) [2006/05/09 08:52:22, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 [2006/05/09 08:52:22, 5] lib/util_seaccess.c:(308) se_access_check: access (2) granted. [2006/05/09 08:52:22, 3] smbd/sec_ctx.c:(287) setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:22, 5] auth/auth_util.c:(437) NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 contains 5 SIDs SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:52:22, 5] auth/auth_util.c:(454) UNIX token of user 205 Primary group is 15 and contains 1 supplementary groups Group[ 0]: 15 [2006/05/09 08:52:22, 5] smbd/uid.c:(308) change_to_user uid=(0,205) gid=(0,15) [2006/05/09 08:52:22, 1] smbd/service.c:(693) nt218201 (15.76.218.201) connect to service pavan initially as user pavan (uid=205, gid=15) (pid 404565) [2006/05/09 08:52:22, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:22, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:22, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:22, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:22, 3] smbd/reply.c:(707) tconX service=PAVAN [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=54 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=51520 smt_wct=3 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 1 (0x1) smb_bcc=13 [2006/05/09 08:52:22, 10] lib/util.c:(2058) [000] 41 3A 00 4E 00 54 00 46 00 53 00 00 00 A:.N.T.F .S... [2006/05/09 08:52:22, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:22, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:22, 10] lib/util_sock.c:(618) got smb length of 76 [2006/05/09 08:52:22, 6] smbd/process.c:(1193) got message type 0x0 of len 0x4c [2006/05/09 08:52:22, 3] smbd/process.c:(1194) Transaction 57 of length 80 [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=76 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51584 smt_wct=15 smb_vwv[ 0]= 8 (0x8) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 8 (0x8) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=11 [2006/05/09 08:52:22, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 00 00 ........ ... [2006/05/09 08:52:22, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:22, 3] smbd/sec_ctx.c:(287) setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:22, 5] auth/auth_util.c:(437) NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 contains 5 SIDs SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:52:22, 5] auth/auth_util.c:(454) UNIX token of user 205 Primary group is 15 and contains 1 supplementary groups Group[ 0]: 15 [2006/05/09 08:52:22, 5] smbd/uid.c:(308) change_to_user uid=(0,205) gid=(0,15) [2006/05/09 08:52:22, 4] smbd/vfs.c:(738) vfs_ChDir to /usr/users/pavan [2006/05/09 08:52:22, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:22, 5] smbd/filename.c:(108) unix_convert called on file "" [2006/05/09 08:52:22, 5] smbd/filename.c:(137) conversion finished "" -> . [2006/05/09 08:52:22, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo . (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) dos_mode: . [2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning d [2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) dos_mode returning d [2006/05/09 08:52:22, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:22, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:24 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 10 [2006/05/09 08:52:22, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:22, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51584 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:22, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 C6 E2 ........ Z.s..... [010] 5E 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E ^.s..... Z.s..... [020] 5A 17 73 C6 01 10 00 00 00 00 00 00 00 Z.s..... ..... [2006/05/09 08:52:22, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:22, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:22, 10] lib/util_sock.c:(618) got smb length of 86 [2006/05/09 08:52:22, 6] smbd/process.c:(1193) got message type 0x0 of len 0x56 [2006/05/09 08:52:22, 3] smbd/process.c:(1194) Transaction 58 of length 90 [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=86 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51648 smt_wct=15 smb_vwv[ 0]= 18 (0x12) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 10 (0xA) smb_vwv[ 3]=16384 (0x4000) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 18 (0x12) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 1 (0x1) smb_bcc=21 [2006/05/09 08:52:22, 10] lib/util.c:(2058) [000] 00 00 00 16 00 56 05 06 00 04 01 00 00 00 00 5C .....V.. .......\ [010] 00 2A 00 00 00 .*... [2006/05/09 08:52:22, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:22, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:22, 3] smbd/trans2.c:(1629) call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=0, close_if_end = 2 requires_resume_key = 4 level = 0x104, max_data_bytes = 16384 [2006/05/09 08:52:22, 5] smbd/filename.c:(108) unix_convert called on file "*" [2006/05/09 08:52:22, 10] smbd/statcache.c:(215) stat_cache_lookup: lookup failed for name [*] [2006/05/09 08:52:22, 5] smbd/filename.c:(185) unix_convert begin: name = *, dirpath = , start = * [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276) is_mangled * ? [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215) is_mangled_component * (len 1) ? [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276) is_mangled * ? [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215) is_mangled_component * (len 1) ? [2006/05/09 08:52:22, 5] smbd/filename.c:(335) New file * [2006/05/09 08:52:22, 5] smbd/trans2.c:(1688) dir=./, mask = * [2006/05/09 08:52:22, 5] smbd/dir.c:(391) dptr_create dir=./ [2006/05/09 08:52:22, 3] smbd/dir.c:(510) creating new dirptr 256 for path ./, expect_close = 1 [2006/05/09 08:52:22, 4] smbd/trans2.c:(1745) dptr_num is 256, wcard = *, attr = 22 [2006/05/09 08:52:22, 8] smbd/trans2.c:(1750) dirpath=<./> dontdescend=<> [2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 0 [2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) dos_mode: ./. [2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning d [2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) dos_mode returning d [2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) get_lanman2_dir_entry found ./. fname=. [2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO [2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 2147483648 [2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) dos_mode: ./.. [2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning d [2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) dos_mode returning d [2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) get_lanman2_dir_entry found ./.. fname=.. [2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO [2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 64 [2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) dos_mode: ./.cshrc [2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) dos_mode returning ha [2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) get_lanman2_dir_entry found ./.cshrc fname=.cshrc [2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616) name_map: .cshrc -> 46EB5320 -> _JOE4O~0 (cache=1) [2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 84 [2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) dos_mode: ./bin [2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning d [2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) dos_mode returning d [2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) get_lanman2_dir_entry found ./bin fname=bin [2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO [2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 108 [2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) dos_mode: ./.login [2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) dos_mode returning ha [2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) get_lanman2_dir_entry found ./.login fname=.login [2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616) name_map: .login -> 6257D060 -> _RABK2~O (cache=1) [2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 136 [2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) dos_mode: ./.profile [2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) dos_mode returning ha [2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) get_lanman2_dir_entry found ./.profile fname=.profile [2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616) name_map: .profile -> 5B1248D4 -> _P9OQF~O (cache=1) [2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 176 [2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) dos_mode: ./autobook_12.html [2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) get_lanman2_dir_entry found ./autobook_12.html fname=autobook_12.html [2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616) name_map: autobook_12.html -> 61CF5FF0 -> AR4ZWM~O (cache=1) [2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 216 [2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) dos_mode: ./New Text Document.txt [2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) get_lanman2_dir_entry found ./New Text Document.txt fname=New Text Document.txt [2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616) name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1) [2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset -1 [2006/05/09 08:52:22, 5] smbd/trans2.c:(1798) call_trans2findfirst - (2) closing dptr_num 256 [2006/05/09 08:52:22, 4] smbd/dir.c:(238) closing dptr key 256 [2006/05/09 08:52:22, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 10, data_sent_thistime = 888, useable_space = 131010 [2006/05/09 08:52:22, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 10, data_to_send = 888, paramsize = 10, datasize = 888 [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=956 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51648 smt_wct=10 smb_vwv[ 0]= 10 (0xA) smb_vwv[ 1]= 888 (0x378) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 10 (0xA) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 888 (0x378) smb_vwv[ 7]= 68 (0x44) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=901 [2006/05/09 08:52:22, 10] lib/util.c:(2058) [000] 00 FD FF 08 00 01 00 00 00 F0 02 00 00 60 00 00 ........ .....`.. [010] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 C6 E2 ........ Z.s..... [020] 5E 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E ^.s..... Z.s..... [030] 5A 17 73 C6 01 00 00 00 00 00 00 00 00 00 00 00 Z.s..... ........ [040] 00 00 00 00 00 10 00 00 00 02 00 00 00 00 00 00 ........ ........ [050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [060] 00 00 00 00 00 00 00 00 00 00 00 2E 00 64 00 00 ........ .....d.. [070] 00 00 00 00 00 00 22 06 B2 60 5C C6 01 00 BD C0 ......". .`\..... [080] E7 4F 64 C6 01 00 22 06 B2 60 5C C6 01 00 22 06 .Od...". .`\...". [090] B2 60 5C C6 01 00 00 00 00 00 00 00 00 00 00 00 .`\..... ........ [0A0] 00 00 00 00 00 10 00 00 00 04 00 00 00 00 00 00 ........ ........ [0B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0C0] 00 00 00 00 00 00 00 00 00 00 00 2E 00 2E 00 00 ........ ........ [0D0] 00 6C 00 00 00 00 00 00 00 80 57 20 ED 6D 75 C2 .l...... ..W .mu. [0E0] 01 80 FE 37 6F 72 63 C6 01 80 57 20 ED 6D 75 C2 ...7orc. ..W .mu. [0F0] 01 80 57 20 ED 6D 75 C2 01 0F 05 00 00 00 00 00 ..W .mu. ........ [100] 00 00 00 10 00 00 00 00 00 22 00 00 00 0C 00 00 ........ ."...... [110] 00 00 00 00 00 10 00 5F 00 4A 00 4F 00 45 00 34 ......._ .J.O.E.4 [120] 00 4F 00 7E 00 30 00 00 00 00 00 00 00 00 00 2E .O.~.0.. ........ [130] 00 63 00 73 00 68 00 72 00 63 00 00 00 64 00 00 .c.s.h.r .c...d.. [140] 00 00 00 00 00 80 35 22 2F FB 6C C6 01 00 98 E3 ......5" /.l..... [150] 4A 08 73 C6 01 80 35 22 2F FB 6C C6 01 80 35 22 J.s...5" /.l...5" [160] 2F FB 6C C6 01 00 00 00 00 00 00 00 00 00 00 00 /.l..... ........ [170] 00 00 00 00 00 10 00 00 00 06 00 00 00 00 00 00 ........ ........ [180] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [190] 00 00 00 00 00 00 00 00 00 00 00 62 00 69 00 6E ........ ...b.i.n [1A0] 00 6C 00 00 00 00 00 00 00 00 B9 F4 EA 46 4A C5 .l...... .....FJ. [1B0] 01 00 22 06 B2 60 5C C6 01 00 B9 F4 EA 46 4A C5 .."..`\. .....FJ. [1C0] 01 00 B9 F4 EA 46 4A C5 01 B8 05 00 00 00 00 00 .....FJ. ........ [1D0] 00 00 00 10 00 00 00 00 00 22 00 00 00 0C 00 00 ........ ."...... [1E0] 00 00 00 00 00 10 00 5F 00 52 00 41 00 42 00 4B ......._ .R.A.B.K [1F0] 00 32 00 7E 00 4F 00 00 00 00 00 00 00 00 00 2E .2.~.O.. ........ [2006/05/09 08:52:22, 4] smbd/trans2.c:(1832) SMBtrans2 mask=* directory=./ dirtype=22 numentries=8 [2006/05/09 08:52:22, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:22, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:22, 10] lib/util_sock.c:(618) got smb length of 100 [2006/05/09 08:52:22, 6] smbd/process.c:(1193) got message type 0x0 of len 0x64 [2006/05/09 08:52:22, 3] smbd/process.c:(1194) Transaction 59 of length 104 [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51712 smt_wct=15 smb_vwv[ 0]= 32 (0x20) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 32 (0x20) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=35 [2006/05/09 08:52:22, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 64 00 65 00 73 ........ .\.d.e.s [010] 00 6B 00 74 00 6F 00 70 00 2E 00 69 00 6E 00 69 .k.t.o.p ...i.n.i [020] 00 00 00 ... [2006/05/09 08:52:22, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:22, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:22, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:22, 5] smbd/filename.c:(108) unix_convert called on file "desktop.ini" [2006/05/09 08:52:22, 10] smbd/statcache.c:(215) stat_cache_lookup: lookup failed for name [DESKTOP.INI] [2006/05/09 08:52:22, 5] smbd/filename.c:(185) unix_convert begin: name = desktop.ini, dirpath = , start = desktop.ini [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276) is_mangled desktop.ini ? [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215) is_mangled_component desktop.ini (len 11) ? [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276) is_mangled desktop.ini ? [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215) is_mangled_component desktop.ini (len 11) ? [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276) is_mangled desktop.ini ? [2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215) is_mangled_component desktop.ini (len 11) ? [2006/05/09 08:52:22, 5] smbd/filename.c:(335) New file desktop.ini [2006/05/09 08:52:22, 3] smbd/trans2.c:(2886) call_trans2qfilepathinfo: SMB_VFS_STAT of desktop.ini failed (No such file or directory) [2006/05/09 08:52:22, 10] smbd/trans2.c:(2622) set_bad_path_error: err = 2 bad_path = 0 [2006/05/09 08:52:22, 3] smbd/error.c:(142) error packet at smbd/trans2.c(2629) cmd=50 (SMBtrans2) NT_STATUS_OBJECT_NAME_NOT_FOUND [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=35 smb_com=0x32 smb_rcls=52 smb_reh=0 smb_err=49152 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51712 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:22, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:22, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:22, 10] lib/util_sock.c:(618) got smb length of 86 [2006/05/09 08:52:22, 6] smbd/process.c:(1193) got message type 0x0 of len 0x56 [2006/05/09 08:52:22, 3] smbd/process.c:(1194) Transaction 60 of length 90 [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=86 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51776 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4096 (0x1000) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 256 (0x100) smb_vwv[ 8]= 4096 (0x1000) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 1792 (0x700) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 256 (0x100) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_bcc=3 [2006/05/09 08:52:22, 10] lib/util.c:(2058) [000] 00 00 00 ... [2006/05/09 08:52:22, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x140168050 [2006/05/09 08:52:22, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:22, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x10, access_mask = 0x100001 file_attributes = 0x0, share_access = 0x7, create_disposition = 0x1 create_options = 0x1 root_dir_fid = 0x0 [2006/05/09 08:52:22, 5] smbd/filename.c:(108) unix_convert called on file "" [2006/05/09 08:52:22, 5] smbd/filename.c:(137) conversion finished "" -> . [2006/05/09 08:52:22, 5] smbd/open.c:(1801) open_directory: opening directory ., access_mask = 0x100001, share_access = 0x7 create_options = 0x1, create_disposition = 0x1 [2006/05/09 08:52:22, 5] smbd/files.c:(127) allocated file structure 463, fnum = 4559 (1 used) [2006/05/09 08:52:22, 10] locking/locking.c:(538) unparse_share_modes: del: 0, num: 1 [2006/05/09 08:52:22, 10] locking/locking.c:(416) print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) dos_mode: . [2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning d [2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) dos_mode returning d [2006/05/09 08:52:22, 5] smbd/nttrans.c:(910) reply_ntcreate_and_X: fnum = 4559, open name = . [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51776 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=52992 (0xCF00) smb_vwv[ 3]= 273 (0x111) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 7698 (0x1E12) smb_vwv[ 7]= 5978 (0x175A) smb_vwv[ 8]=50803 (0xC673) smb_vwv[ 9]= 1 (0x1) smb_vwv[10]=64363 (0xFB6B) smb_vwv[11]= 6088 (0x17C8) smb_vwv[12]=50803 (0xC673) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 7698 (0x1E12) smb_vwv[15]= 5978 (0x175A) smb_vwv[16]=50803 (0xC673) smb_vwv[17]= 1 (0x1) smb_vwv[18]= 7698 (0x1E12) smb_vwv[19]= 5978 (0x175A) smb_vwv[20]=50803 (0xC673) smb_vwv[21]= 4097 (0x1001) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 0 (0x0) smb_vwv[32]= 1792 (0x700) smb_vwv[33]= 256 (0x100) smb_bcc=0 [2006/05/09 08:52:22, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:22, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:22, 10] lib/util_sock.c:(618) got smb length of 76 [2006/05/09 08:52:22, 6] smbd/process.c:(1193) got message type 0x0 of len 0x4c [2006/05/09 08:52:22, 3] smbd/process.c:(1194) Transaction 61 of length 80 [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=76 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51840 smt_wct=15 smb_vwv[ 0]= 8 (0x8) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 8 (0x8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 8 (0x8) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=11 [2006/05/09 08:52:22, 10] lib/util.c:(2058) [000] 00 00 00 EE 03 00 00 00 00 00 00 ........ ... [2006/05/09 08:52:22, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:22, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:22, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1006 [2006/05/09 08:52:22, 5] smbd/filename.c:(108) unix_convert called on file "" [2006/05/09 08:52:22, 5] smbd/filename.c:(137) conversion finished "" -> . [2006/05/09 08:52:22, 10] locking/locking.c:(440) parse_share_modes: delete_on_close: 0, num_share_modes: 1 [2006/05/09 08:52:22, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:22, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo . (fnum = -1) level=1006 call=5 total_data=0 [2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) dos_mode: . [2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning d [2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) dos_mode returning d [2006/05/09 08:52:22, 10] smbd/trans2.c:(3228) call_trans2qfilepathinfo: SMB_FILE_INTERNAL_INFORMATION [2006/05/09 08:52:22, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 8, useable_space = 131010 [2006/05/09 08:52:22, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 8, paramsize = 2, datasize = 8 [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=68 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51840 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 8 (0x8) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 8 (0x8) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=13 [2006/05/09 08:52:22, 10] lib/util.c:(2058) [000] 00 00 00 00 00 29 BC 00 00 8D 80 FE B9 .....).. ..... [2006/05/09 08:52:22, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:22, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:22, 10] lib/util_sock.c:(618) got smb length of 84 [2006/05/09 08:52:22, 6] smbd/process.c:(1193) got message type 0x0 of len 0x54 [2006/05/09 08:52:22, 3] smbd/process.c:(1194) Transaction 62 of length 88 [2006/05/09 08:52:22, 5] lib/util.c:(454) [2006/05/09 08:52:22, 5] lib/util.c:(457) size=84 smb_com=0xa0 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51904 smt_wct=23 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 8192 (0x2000) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]=21504 (0x5400) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 1024 (0x400) smb_vwv[18]= 4 (0x4) smb_vwv[19]= 23 (0x17) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 4559 (0x11CF) smb_vwv[22]= 0 (0x0) smb_bcc=3 [2006/05/09 08:52:22, 10] lib/util.c:(2058) [000] 00 00 00 ... [2006/05/09 08:52:22, 3] smbd/process.c:(993) switch message SMBnttrans (pid 404565) conn 0x140168050 [2006/05/09 08:52:22, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:22, 10] smbd/nttrans.c:(2806) reply_nttrans: setup_count = 8 [2006/05/09 08:52:22, 10] lib/util.c:(2058) [000] 17 00 00 00 CF 11 00 00 ........ [2006/05/09 08:52:22, 3] smbd/nttrans.c:(1853) call_nt_transact_notify_change [2006/05/09 08:52:22, 3] smbd/nttrans.c:(1867) call_nt_transact_notify_change: notify change called on directory name = . [2006/05/09 08:52:22, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:22, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 86 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x56 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 63 of length 90 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=86 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51969 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=33024 (0x8100) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=3 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 ... [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:23, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x16, access_mask = 0x81 file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x0 root_dir_fid = 0x0 [2006/05/09 08:52:23, 5] smbd/filename.c:(108) unix_convert called on file "" [2006/05/09 08:52:23, 5] smbd/filename.c:(137) conversion finished "" -> . [2006/05/09 08:52:23, 3] smbd/dosmode.c:(121) unix_mode(.) returning 0740 [2006/05/09 08:52:23, 10] smbd/open.c:(1085) open_file_ntcreate: fname=., dos_attrs=0x0 access_mask=0x81 share_access=0x3 create_disposition = 0x1 create_options=0x0 unix mode=0740 oplock_request=3 [2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) dos_mode: . [2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning d [2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) dos_mode returning d [2006/05/09 08:52:23, 10] smbd/open.c:(1258) open_file_ntcreate: fname=., after mapping access_mask=0x81 [2006/05/09 08:52:23, 5] smbd/files.c:(127) allocated file structure 464, fnum = 4560 (2 used) [2006/05/09 08:52:23, 10] locking/locking.c:(440) parse_share_modes: delete_on_close: 0, num_share_modes: 1 [2006/05/09 08:52:23, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] smbd/open.c:(382) share_conflict: entry->access_mask = 0x100001, entry->share_access = 0x7, entry->private_options = 0x1 [2006/05/09 08:52:23, 10] smbd/open.c:(389) share_conflict: access_mask = 0x81, share_access = 0x3 [2006/05/09 08:52:23, 10] smbd/open.c:(438) share_conflict: [1] am (0x100001) & right (0x6) = 0x0 [2006/05/09 08:52:23, 10] smbd/open.c:(438) share_conflict: [1] sa (0x3) & share (0x2) = 0x2 [2006/05/09 08:52:23, 10] smbd/open.c:(440) share_conflict: [2] am (0x81) & right (0x6) = 0x0 [2006/05/09 08:52:23, 10] smbd/open.c:(440) share_conflict: [2] sa (0x7) & share (0x2) = 0x2 [2006/05/09 08:52:23, 10] smbd/open.c:(443) share_conflict: [3] am (0x100001) & right (0x21) = 0x1 [2006/05/09 08:52:23, 10] smbd/open.c:(443) share_conflict: [3] sa (0x3) & share (0x1) = 0x1 [2006/05/09 08:52:23, 10] smbd/open.c:(445) share_conflict: [4] am (0x81) & right (0x21) = 0x1 [2006/05/09 08:52:23, 10] smbd/open.c:(445) share_conflict: [4] sa (0x7) & share (0x1) = 0x1 [2006/05/09 08:52:23, 10] smbd/open.c:(448) share_conflict: [5] am (0x100001) & right (0x10000) = 0x0 [2006/05/09 08:52:23, 10] smbd/open.c:(448) share_conflict: [5] sa (0x3) & share (0x4) = 0x0 [2006/05/09 08:52:23, 10] smbd/open.c:(450) share_conflict: [6] am (0x81) & right (0x10000) = 0x0 [2006/05/09 08:52:23, 10] smbd/open.c:(450) share_conflict: [6] sa (0x7) & share (0x4) = 0x4 [2006/05/09 08:52:23, 10] smbd/open.c:(453) share_conflict: No conflict. [2006/05/09 08:52:23, 4] smbd/open.c:(1488) calling open_file with flags=0x0 flags2=0x0 mode=0740 [2006/05/09 08:52:23, 10] smbd/open.c:(54) fd_open: name ., flags = 00 mode = 0740, fd = 25. [2006/05/09 08:52:23, 5] smbd/files.c:(449) freed files structure 4560 (1 used) [2006/05/09 08:52:23, 5] smbd/open.c:(1801) open_directory: opening directory ., access_mask = 0x81, share_access = 0x3 create_options = 0x0, create_disposition = 0x1 [2006/05/09 08:52:23, 5] smbd/files.c:(127) allocated file structure 465, fnum = 4561 (2 used) [2006/05/09 08:52:23, 10] locking/locking.c:(440) parse_share_modes: delete_on_close: 0, num_share_modes: 1 [2006/05/09 08:52:23, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] smbd/open.c:(382) share_conflict: entry->access_mask = 0x100001, entry->share_access = 0x7, entry->private_options = 0x1 [2006/05/09 08:52:23, 10] smbd/open.c:(389) share_conflict: access_mask = 0x81, share_access = 0x3 [2006/05/09 08:52:23, 10] smbd/open.c:(438) share_conflict: [1] am (0x100001) & right (0x6) = 0x0 [2006/05/09 08:52:23, 10] smbd/open.c:(438) share_conflict: [1] sa (0x3) & share (0x2) = 0x2 [2006/05/09 08:52:23, 10] smbd/open.c:(440) share_conflict: [2] am (0x81) & right (0x6) = 0x0 [2006/05/09 08:52:23, 10] smbd/open.c:(440) share_conflict: [2] sa (0x7) & share (0x2) = 0x2 [2006/05/09 08:52:23, 10] smbd/open.c:(443) share_conflict: [3] am (0x100001) & right (0x21) = 0x1 [2006/05/09 08:52:23, 10] smbd/open.c:(443) share_conflict: [3] sa (0x3) & share (0x1) = 0x1 [2006/05/09 08:52:23, 10] smbd/open.c:(445) share_conflict: [4] am (0x81) & right (0x21) = 0x1 [2006/05/09 08:52:23, 10] smbd/open.c:(445) share_conflict: [4] sa (0x7) & share (0x1) = 0x1 [2006/05/09 08:52:23, 10] smbd/open.c:(448) share_conflict: [5] am (0x100001) & right (0x10000) = 0x0 [2006/05/09 08:52:23, 10] smbd/open.c:(448) share_conflict: [5] sa (0x3) & share (0x4) = 0x0 [2006/05/09 08:52:23, 10] smbd/open.c:(450) share_conflict: [6] am (0x81) & right (0x10000) = 0x0 [2006/05/09 08:52:23, 10] smbd/open.c:(450) share_conflict: [6] sa (0x7) & share (0x4) = 0x4 [2006/05/09 08:52:23, 10] smbd/open.c:(453) share_conflict: No conflict. [2006/05/09 08:52:23, 10] locking/locking.c:(538) unparse_share_modes: del: 0, num: 2 [2006/05/09 08:52:23, 10] locking/locking.c:(416) print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] locking/locking.c:(416) print_share_mode_table: share_mode_entry[1]: pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x0, file_id = 3, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) dos_mode: . [2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning d [2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) dos_mode returning d [2006/05/09 08:52:23, 5] smbd/nttrans.c:(910) reply_ntcreate_and_X: fnum = 4561, open name = . [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51969 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=53504 (0xD100) smb_vwv[ 3]= 273 (0x111) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 7698 (0x1E12) smb_vwv[ 7]= 5978 (0x175A) smb_vwv[ 8]=50803 (0xC673) smb_vwv[ 9]= 1 (0x1) smb_vwv[10]=64363 (0xFB6B) smb_vwv[11]= 6088 (0x17C8) smb_vwv[12]=50803 (0xC673) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 7698 (0x1E12) smb_vwv[15]= 5978 (0x175A) smb_vwv[16]=50803 (0xC673) smb_vwv[17]= 1 (0x1) smb_vwv[18]= 7698 (0x1E12) smb_vwv[19]= 5978 (0x175A) smb_vwv[20]=50803 (0xC673) smb_vwv[21]= 4097 (0x1001) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 0 (0x0) smb_vwv[32]= 1792 (0x700) smb_vwv[33]= 256 (0x100) smb_bcc=0 [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 84 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x54 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 64 of length 88 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=84 smb_com=0xa0 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52033 smt_wct=23 smb_vwv[ 0]= 4 (0x4) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 4096 (0x1000) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]=21504 (0x5400) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 1024 (0x400) smb_vwv[18]= 2 (0x2) smb_vwv[19]=16484 (0x4064) smb_vwv[20]= 20 (0x14) smb_vwv[21]= 4561 (0x11D1) smb_vwv[22]= 1 (0x1) smb_bcc=3 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 ... [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBnttrans (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:23, 10] smbd/nttrans.c:(2806) reply_nttrans: setup_count = 8 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 64 40 14 00 D1 11 01 00 d@...... [2006/05/09 08:52:23, 10] smbd/nttrans.c:(2130) call_nt_transact_ioctl: function[0x00144064] FID[0x11D1] isFSctl[0x01] compfilter[0x00] [2006/05/09 08:52:23, 5] smbd/nttrans.c:(2227) FSCTL_GET_SHADOW_COPY_DATA: connectpath /usr/users/pavan, not supported. [2006/05/09 08:52:23, 3] smbd/error.c:(142) error packet at smbd/nttrans.c(2229) cmd=160 (SMBnttrans) NT_STATUS_NOT_SUPPORTED [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=35 smb_com=0xa0 smb_rcls=187 smb_reh=0 smb_err=49152 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52033 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 65 of length 45 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=52097 smt_wct=3 smb_vwv[ 0]= 4561 (0x11D1) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:23, 3] smbd/reply.c:(3257) close directory fnum=4561 [2006/05/09 08:52:23, 10] locking/locking.c:(440) parse_share_modes: delete_on_close: 0, num_share_modes: 2 [2006/05/09 08:52:23, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[1]: pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x0, file_id = 3, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] locking/locking.c:(538) unparse_share_modes: del: 0, num: 2 [2006/05/09 08:52:23, 10] locking/locking.c:(416) print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] locking/locking.c:(416) print_share_mode_table: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x40, file_id = 3, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 5] smbd/files.c:(449) freed files structure 4561 (1 used) [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=52097 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 88 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x58 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 66 of length 92 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=88 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52161 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 512 (0x200) smb_vwv[ 3]= 4096 (0x1000) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=32768 (0x8000) smb_vwv[ 8]= 4096 (0x1000) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]=32768 (0x8000) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 8192 (0x2000) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=5 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 5C 00 00 00 .\... [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:23, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x10, access_mask = 0x100080 file_attributes = 0x80, share_access = 0x3, create_disposition = 0x1 create_options = 0x200000 root_dir_fid = 0x0 [2006/05/09 08:52:23, 5] smbd/filename.c:(108) unix_convert called on file "" [2006/05/09 08:52:23, 5] smbd/filename.c:(137) conversion finished "" -> . [2006/05/09 08:52:23, 3] smbd/dosmode.c:(121) unix_mode(.) returning 0740 [2006/05/09 08:52:23, 10] smbd/open.c:(1085) open_file_ntcreate: fname=., dos_attrs=0x80 access_mask=0x100080 share_access=0x3 create_disposition = 0x1 create_options=0x200000 unix mode=0740 oplock_request=0 [2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) dos_mode: . [2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning d [2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) dos_mode returning d [2006/05/09 08:52:23, 10] smbd/open.c:(1258) open_file_ntcreate: fname=., after mapping access_mask=0x100080 [2006/05/09 08:52:23, 5] smbd/files.c:(127) allocated file structure 466, fnum = 4562 (2 used) [2006/05/09 08:52:23, 10] locking/locking.c:(440) parse_share_modes: delete_on_close: 0, num_share_modes: 2 [2006/05/09 08:52:23, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x40, file_id = 3, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 4] smbd/open.c:(1488) calling open_file with flags=0x0 flags2=0x0 mode=0740 [2006/05/09 08:52:23, 5] smbd/files.c:(449) freed files structure 4562 (1 used) [2006/05/09 08:52:23, 5] smbd/open.c:(1801) open_directory: opening directory ., access_mask = 0x100080, share_access = 0x3 create_options = 0x200000, create_disposition = 0x1 [2006/05/09 08:52:23, 5] smbd/files.c:(127) allocated file structure 467, fnum = 4563 (2 used) [2006/05/09 08:52:23, 10] locking/locking.c:(440) parse_share_modes: delete_on_close: 0, num_share_modes: 2 [2006/05/09 08:52:23, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x40, file_id = 3, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] locking/locking.c:(538) unparse_share_modes: del: 0, num: 2 [2006/05/09 08:52:23, 10] locking/locking.c:(416) print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] locking/locking.c:(416) print_share_mode_table: share_mode_entry[1]: pid = 404565, share_access = 0x3, private_options = 0x200000, access_mask = 0x100080, mid = 0x0, type= 0x0, file_id = 5, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) dos_mode: . [2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning d [2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) dos_mode returning d [2006/05/09 08:52:23, 5] smbd/nttrans.c:(910) reply_ntcreate_and_X: fnum = 4563, open name = . [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52161 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=54016 (0xD300) smb_vwv[ 3]= 273 (0x111) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 7698 (0x1E12) smb_vwv[ 7]= 5978 (0x175A) smb_vwv[ 8]=50803 (0xC673) smb_vwv[ 9]= 1 (0x1) smb_vwv[10]=64363 (0xFB6B) smb_vwv[11]= 6088 (0x17C8) smb_vwv[12]=50803 (0xC673) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 7698 (0x1E12) smb_vwv[15]= 5978 (0x175A) smb_vwv[16]=50803 (0xC673) smb_vwv[17]= 1 (0x1) smb_vwv[18]= 7698 (0x1E12) smb_vwv[19]= 5978 (0x175A) smb_vwv[20]=50803 (0xC673) smb_vwv[21]= 4097 (0x1001) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 0 (0x0) smb_vwv[32]= 1792 (0x700) smb_vwv[33]= 256 (0x100) smb_bcc=0 [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 84 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x54 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 67 of length 88 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=84 smb_com=0xa0 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52225 smt_wct=23 smb_vwv[ 0]= 4 (0x4) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 64 (0x40) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]=21504 (0x5400) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 1024 (0x400) smb_vwv[18]= 2 (0x2) smb_vwv[19]= 168 (0xA8) smb_vwv[20]= 9 (0x9) smb_vwv[21]= 4563 (0x11D3) smb_vwv[22]= 1 (0x1) smb_bcc=3 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 ... [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBnttrans (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:23, 10] smbd/nttrans.c:(2806) reply_nttrans: setup_count = 8 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] A8 00 09 00 D3 11 01 00 ........ [2006/05/09 08:52:23, 10] smbd/nttrans.c:(2130) call_nt_transact_ioctl: function[0x000900A8] FID[0x11D3] isFSctl[0x01] compfilter[0x00] [2006/05/09 08:52:23, 10] smbd/nttrans.c:(2162) FSCTL_GET_REPARSE_POINT: called on FID[0x11D3](but not implemented) [2006/05/09 08:52:23, 3] smbd/error.c:(142) error packet at smbd/nttrans.c(95) cmd=160 (SMBnttrans) NT_STATUS_NOT_A_REPARSE_POINT [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=35 smb_com=0xa0 smb_rcls=117 smb_reh=2 smb_err=49152 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52225 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 68 of length 45 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=52289 smt_wct=3 smb_vwv[ 0]= 4563 (0x11D3) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:23, 3] smbd/reply.c:(3257) close directory fnum=4563 [2006/05/09 08:52:23, 10] locking/locking.c:(440) parse_share_modes: delete_on_close: 0, num_share_modes: 2 [2006/05/09 08:52:23, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[1]: pid = 404565, share_access = 0x3, private_options = 0x200000, access_mask = 0x100080, mid = 0x0, type= 0x0, file_id = 5, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] locking/locking.c:(538) unparse_share_modes: del: 0, num: 2 [2006/05/09 08:52:23, 10] locking/locking.c:(416) print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 10] locking/locking.c:(416) print_share_mode_table: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x200000, access_mask = 0x100080, mid = 0x0, type= 0x40, file_id = 5, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:23, 5] smbd/files.c:(449) freed files structure 4563 (1 used) [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=52289 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 236 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0xec [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 69 of length 240 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=236 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=0 smb_pid=65279 smb_uid=0 smb_mid=52353 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 236 (0xEC) smb_vwv[ 2]=16644 (0x4104) smb_vwv[ 3]= 50 (0x32) smb_vwv[ 4]= 1 (0x1) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 74 (0x4A) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 212 (0xD4) smb_vwv[11]=40960 (0xA000) smb_bcc=177 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 60 48 06 06 2B 06 01 05 05 02 A0 3E 30 3C A0 0E `H..+... ...>0<.. [010] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A2 2A 0...+... ..7....* [020] 04 28 4E 54 4C 4D 53 53 50 00 01 00 00 00 97 82 .(NTLMSS P....... [030] 08 E2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [040] 00 00 05 01 28 0A 00 00 00 0F 00 57 00 69 00 6E ....(... ...W.i.n [050] 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 00 30 .d.o.w.s . .2.0.0 [060] 00 32 00 20 00 53 00 65 00 72 00 76 00 69 00 63 .2. .S.e .r.v.i.c [070] 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 32 .e. .P.a .c.k. .2 [080] 00 20 00 32 00 36 00 30 00 30 00 00 00 57 00 69 . .2.6.0 .0...W.i [090] 00 6E 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 .n.d.o.w .s. .2.0 [0A0] 00 30 00 32 00 20 00 35 00 2E 00 31 00 00 00 00 .0.2. .5 ...1.... [0B0] 00 . [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBsesssetupX (pid 404565) conn 0x0 [2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:23, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:23, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:23, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:23, 3] smbd/sesssetup.c:(822) wct=12 flg2=0xc807 [2006/05/09 08:52:23, 3] smbd/sesssetup.c:(633) Doing spnego session setup [2006/05/09 08:52:23, 3] smbd/sesssetup.c:(663) NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] [2006/05/09 08:52:23, 10] smbd/password.c:(182) register_vuid: allocated vuid = 102 [2006/05/09 08:52:23, 3] smbd/sesssetup.c:(525) Got OID 1 3 6 1 4 1 311 2 2 10 [2006/05/09 08:52:23, 3] smbd/sesssetup.c:(528) Got secblob of size 40 [2006/05/09 08:52:23, 5] auth/auth.c:(485) Making default auth method list for standalone security=user, encrypt passwords = yes [2006/05/09 08:52:23, 5] auth/auth.c:(388) load_auth_module: Attempting to find an auth method to match guest [2006/05/09 08:52:23, 5] auth/auth.c:(413) load_auth_module: auth method guest has a valid init [2006/05/09 08:52:23, 5] auth/auth.c:(388) load_auth_module: Attempting to find an auth method to match sam [2006/05/09 08:52:23, 5] auth/auth.c:(413) load_auth_module: auth method sam has a valid init [2006/05/09 08:52:23, 3] libsmb/ntlmssp.c:(63) Got NTLMSSP neg_flags=0xe2088297 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_NEGOTIATE_OEM NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_LM_KEY NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EXCH NTLMSSP_NEGOTIATE_56 [2006/05/09 08:52:23, 5] auth/auth.c:(95) auth_get_challenge: module guest did not want to specify a challenge [2006/05/09 08:52:23, 5] auth/auth.c:(95) auth_get_challenge: module sam did not want to specify a challenge [2006/05/09 08:52:23, 5] auth/auth.c:(135) auth_context challenge created by random [2006/05/09 08:52:23, 5] auth/auth.c:(136) challenge is: [2006/05/09 08:52:23, 5] lib/util.c:(2058) [000] C9 FA 9C 98 A8 9E 02 25 .......% [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=290 smb_com=0x73 smb_rcls=22 smb_reh=0 smb_err=49152 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=65279 smb_uid=102 smb_mid=52353 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 189 (0xBD) smb_bcc=247 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] A1 81 BA 30 81 B7 A0 03 0A 01 01 A1 0C 06 0A 2B ...0.... .......+ [010] 06 01 04 01 82 37 02 02 0A A2 81 A1 04 81 9E 4E .....7.. .......N [020] 54 4C 4D 53 53 50 00 02 00 00 00 0A 00 0A 00 30 TLMSSP.. .......0 [030] 00 00 00 B5 82 8A 60 C9 FA 9C 98 A8 9E 02 25 00 ......`. ......%. [040] 00 00 00 00 00 00 00 64 00 64 00 3A 00 00 00 43 .......d .d.:...C [050] 00 48 00 45 00 56 00 59 00 02 00 0A 00 43 00 48 .H.E.V.Y .....C.H [060] 00 45 00 56 00 59 00 01 00 0A 00 43 00 48 00 45 .E.V.Y.. ...C.H.E [070] 00 56 00 59 00 04 00 18 00 69 00 6E 00 64 00 69 .V.Y.... .i.n.d.i [080] 00 61 00 2E 00 68 00 70 00 2E 00 63 00 6F 00 6D .a...h.p ...c.o.m [090] 00 03 00 24 00 63 00 68 00 65 00 76 00 79 00 2E ...$.c.h .e.v.y.. [0A0] 00 69 00 6E 00 64 00 69 00 61 00 2E 00 68 00 70 .i.n.d.i .a...h.p [0B0] 00 2E 00 63 00 6F 00 6D 00 00 00 00 00 55 00 6E ...c.o.m .....U.n [0C0] 00 69 00 78 00 00 00 53 00 61 00 6D 00 62 00 61 .i.x...S .a.m.b.a [0D0] 00 20 00 33 00 2E 00 30 00 2E 00 32 00 31 00 63 . .3...0 ...2.1.c [0E0] 00 00 00 57 00 4F 00 52 00 4B 00 47 00 52 00 4F ...W.O.R .K.G.R.O [0F0] 00 55 00 50 00 00 00 .U.P... [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 274 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x112 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 70 of length 278 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=274 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=0 smb_pid=65279 smb_uid=102 smb_mid=52417 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 274 (0x112) smb_vwv[ 2]=16644 (0x4104) smb_vwv[ 3]= 50 (0x32) smb_vwv[ 4]= 1 (0x1) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 113 (0x71) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 212 (0xD4) smb_vwv[11]=40960 (0xA000) smb_bcc=215 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] A1 6F 30 6D A2 6B 04 69 4E 54 4C 4D 53 53 50 00 .o0m.k.i NTLMSSP. [010] 03 00 00 00 01 00 01 00 58 00 00 00 00 00 00 00 ........ X....... [020] 59 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 Y....... H....... [030] 48 00 00 00 10 00 10 00 48 00 00 00 10 00 10 00 H....... H....... [040] 59 00 00 00 15 8A 88 62 05 01 28 0A 00 00 00 0F Y......b ..(..... [050] 4E 00 54 00 32 00 31 00 38 00 32 00 30 00 31 00 N.T.2.1. 8.2.0.1. [060] 00 34 4B E5 5B 01 57 BA DB 53 87 D6 9C 0B CC 3C .4K.[.W. .S.....< [070] B7 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s. [080] 00 32 00 30 00 30 00 32 00 20 00 53 00 65 00 72 .2.0.0.2 . .S.e.r [090] 00 76 00 69 00 63 00 65 00 20 00 50 00 61 00 63 .v.i.c.e . .P.a.c [0A0] 00 6B 00 20 00 32 00 20 00 32 00 36 00 30 00 30 .k. .2. .2.6.0.0 [0B0] 00 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 ...W.i.n .d.o.w.s [0C0] 00 20 00 32 00 30 00 30 00 32 00 20 00 35 00 2E . .2.0.0 .2. .5.. [0D0] 00 31 00 00 00 00 00 .1..... [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBsesssetupX (pid 404565) conn 0x0 [2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:23, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:23, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:23, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:23, 3] smbd/sesssetup.c:(822) wct=12 flg2=0xc807 [2006/05/09 08:52:23, 3] smbd/sesssetup.c:(633) Doing spnego session setup [2006/05/09 08:52:23, 3] smbd/sesssetup.c:(663) NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] [2006/05/09 08:52:23, 3] libsmb/ntlmssp.c:(661) Got user=[] domain=[] workstation=[NT218201] len1=1 len2=0 [2006/05/09 08:52:23, 6] param/loadparm.c:(2947) lp_file_list_changed() file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 [2006/05/09 08:52:23, 5] auth/auth_util.c:(162) make_user_info_map: Mapping user []\[] from workstation [NT218201] [2006/05/09 08:52:23, 5] auth/auth_util.c:(69) attempting to make a user_info for () [2006/05/09 08:52:23, 5] auth/auth_util.c:(79) making strings for 's user_info struct [2006/05/09 08:52:23, 5] auth/auth_util.c:(121) making blobs for 's user_info struct [2006/05/09 08:52:23, 10] auth/auth_util.c:(139) made an encrypted user_info for () [2006/05/09 08:52:23, 3] auth/auth.c:(218) check_ntlm_password: Checking password for unmapped user []\[]@[NT218201] with the new password interface [2006/05/09 08:52:23, 3] auth/auth.c:(221) check_ntlm_password: mapped user is: [CHEVY]\[]@[NT218201] [2006/05/09 08:52:23, 10] auth/auth.c:(230) check_ntlm_password: auth_context challenge created by random [2006/05/09 08:52:23, 10] auth/auth.c:(233) challenge is: [2006/05/09 08:52:23, 5] lib/util.c:(2058) [000] C9 FA 9C 98 A8 9E 02 25 .......% [2006/05/09 08:52:23, 10] lib/account_pol.c:(332) account_policy_get: name: password history, val: 0 [2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(616) pdb_set_username: setting username nobody, was [2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(643) pdb_set_domain: setting domain CHEVY, was [2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(670) pdb_set_nt_username: setting nt username , was [2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(697) pdb_set_full_name: setting full name nobody, was [2006/05/09 08:52:23, 4] lib/substitute.c:(359) Home server: chevy [2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(805) pdb_set_homedir: setting home dir \\chevy\nobody, was [2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(778) pdb_set_dir_drive: setting dir drive , was NULL [2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(724) pdb_set_logon_script: setting logon script , was [2006/05/09 08:52:23, 4] lib/substitute.c:(359) Home server: chevy [2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(751) pdb_set_profile_path: setting profile path \\chevy\nobody\profile, was [2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(884) pdb_set_workstations: setting workstations , was [2006/05/09 08:52:23, 10] lib/account_pol.c:(332) account_policy_get: name: password history, val: 0 [2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(543) pdb_set_user_sid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-501 [2006/05/09 08:52:23, 10] passdb/pdb_compat.c:(72) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-501 from rid 501 [2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(579) pdb_set_group_sid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-514 [2006/05/09 08:52:23, 10] passdb/pdb_compat.c:(99) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-514 from rid 514 [2006/05/09 08:52:23, 3] auth/auth.c:(267) check_ntlm_password: guest authentication for user [] succeeded [2006/05/09 08:52:23, 5] auth/auth.c:(302) check_ntlm_password: guest authentication for user [] -> [] -> [nobody] succeeded [2006/05/09 08:52:23, 5] auth/auth_util.c:(1485) attempting to free (and zero) a user_info structure [2006/05/09 08:52:23, 10] auth/auth_util.c:(1488) structure was created for [2006/05/09 08:52:23, 10] auth/auth_ntlmssp.c:(119) Got NT session key of length 16 [2006/05/09 08:52:23, 10] auth/auth_ntlmssp.c:(126) Got LM session key of length 16 [2006/05/09 08:52:23, 10] libsmb/ntlmssp.c:(755) ntlmssp_server_auth: Using unmodified nt session key. [2006/05/09 08:52:23, 3] libsmb/ntlmssp_sign.c:(338) NTLMSSP Sign/Seal - Initialising with flags: [2006/05/09 08:52:23, 3] libsmb/ntlmssp.c:(63) Got NTLMSSP neg_flags=0x60088235 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_SEAL NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EXCH [2006/05/09 08:52:23, 10] smbd/password.c:(182) register_vuid: allocated vuid = 103 [2006/05/09 08:52:23, 10] lib/util_pw.c:(98) Got nobody from pwnam_cache [2006/05/09 08:52:23, 10] smbd/password.c:(252) register_vuid: (65534,65534) nobody CHEVY guest=1 [2006/05/09 08:52:23, 3] smbd/password.c:(257) User name: nobody Real name: nobody [2006/05/09 08:52:23, 3] smbd/password.c:(276) UNIX uid 65534 is UNIX user nobody, and will be vuid 103 [2006/05/09 08:52:23, 6] param/loadparm.c:(2947) lp_file_list_changed() file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=110 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=65279 smb_uid=103 smb_mid=52417 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 9 (0x9) smb_bcc=67 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] A1 07 30 05 A0 03 0A 01 00 55 00 6E 00 69 00 78 ..0..... .U.n.i.x [010] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3 [020] 00 2E 00 30 00 2E 00 32 00 31 00 63 00 00 00 57 ...0...2 .1.c...W [030] 00 4F 00 52 00 4B 00 47 00 52 00 4F 00 55 00 50 .O.R.K.G .R.O.U.P [040] 00 00 00 ... [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 76 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x4c [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 71 of length 80 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=76 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=0 smb_pid=65279 smb_uid=103 smb_mid=52481 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 76 (0x4C) smb_vwv[ 2]= 8 (0x8) smb_vwv[ 3]= 1 (0x1) smb_bcc=33 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 5C 00 5C 00 43 00 48 00 45 00 56 00 59 00 5C .\.\.C.H .E.V.Y.\ [010] 00 49 00 50 00 43 00 24 00 00 00 3F 3F 3F 3F 3F .I.P.C.$ ...????? [020] 00 . [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBtconX (pid 404565) conn 0x0 [2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:23, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:23, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:23, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:23, 4] smbd/reply.c:(660) Client requested device type [?????] for share [IPC$] [2006/05/09 08:52:23, 5] smbd/service.c:(860) making a connection to 'normal' service ipc$ [2006/05/09 08:52:23, 3] lib/access.c:(291) only_ipaddrs_in_list: list has non-ip address (.india.hp.com) [2006/05/09 08:52:23, 3] lib/access.c:(316) check_access: hostnames in host allow/deny list. [2006/05/09 08:52:23, 2] lib/access.c:(322) Allowed connection from nt218201.india.hp.com (15.76.218.201) [2006/05/09 08:52:23, 5] lib/username.c:(290) Finding user nobody [2006/05/09 08:52:23, 5] lib/username.c:(234) Trying _Get_Pwnam(), username as lowercase is nobody [2006/05/09 08:52:23, 10] lib/util_pw.c:(98) Got nobody from pwnam_cache [2006/05/09 08:52:23, 5] lib/username.c:(266) Get_Pwnam_internals did find user [nobody]! [2006/05/09 08:52:23, 3] smbd/service.c:(488) Connect path is '/tmp' for service [IPC$] [2006/05/09 08:52:23, 4] rpc_server/srv_srvsvc_nt.c:(240) get_share_security: using default secdesc for IPC$ [2006/05/09 08:52:23, 10] lib/util_seaccess.c:(175) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2006/05/09 08:52:23, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x00000002, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-501. [2006/05/09 08:52:23, 3] lib/util_seaccess.c:(250) [2006/05/09 08:52:23, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-501 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-132069 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 [2006/05/09 08:52:23, 5] lib/util_seaccess.c:(308) se_access_check: access (2) granted. [2006/05/09 08:52:23, 3] smbd/vfs.c:(216) Initialising default vfs hooks [2006/05/09 08:52:23, 5] smbd/connection.c:(170) claiming IPC$ 0 [2006/05/09 08:52:23, 10] smbd/uid.c:(124) is_share_read_only_for_user: share IPC$ is read-only for unix user nobody [2006/05/09 08:52:23, 4] rpc_server/srv_srvsvc_nt.c:(240) get_share_security: using default secdesc for IPC$ [2006/05/09 08:52:23, 10] lib/util_seaccess.c:(175) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2006/05/09 08:52:23, 10] lib/util_seaccess.c:(231) se_access_check: requested access 0x00000001, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-501. [2006/05/09 08:52:23, 3] lib/util_seaccess.c:(250) [2006/05/09 08:52:23, 3] lib/util_seaccess.c:(251) se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-501 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-132069 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1 [2006/05/09 08:52:23, 5] lib/util_seaccess.c:(308) se_access_check: access (1) granted. [2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:23, 5] auth/auth_util.c:(437) NT user token of user S-1-5-21-4112424572-1378032116-4237619202-501 contains 6 SIDs SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-501 SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-514 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-32-546 SID[ 5]: S-1-5-21-4112424572-1378032116-4237619202-132069 SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:52:23, 5] auth/auth_util.c:(454) UNIX token of user 65534 Primary group is 65534 and contains 1 supplementary groups Group[ 0]: 65534 [2006/05/09 08:52:23, 5] smbd/uid.c:(308) change_to_user uid=(0,65534) gid=(0,65534) [2006/05/09 08:52:23, 3] smbd/service.c:(693) nt218201 (15.76.218.201) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 404565) [2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:23, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:23, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:23, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:23, 3] smbd/reply.c:(707) tconX service=IPC$ [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=48 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=3 smb_pid=65279 smb_uid=103 smb_mid=52481 smt_wct=3 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 1 (0x1) smb_bcc=7 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 49 50 43 00 00 00 00 IPC.... [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 72 of length 124 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52545 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287) setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:23, 5] auth/auth_util.c:(437) NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 contains 5 SIDs SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:52:23, 5] auth/auth_util.c:(454) UNIX token of user 205 Primary group is 15 and contains 1 supplementary groups Group[ 0]: 15 [2006/05/09 08:52:23, 5] smbd/uid.c:(308) change_to_user uid=(0,205) gid=(0,15) [2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:23, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:23, 10] smbd/statcache.c:(215) stat_cache_lookup: lookup failed for name [NEW TEXT DOCUMENT.TXT] [2006/05/09 08:52:23, 5] smbd/statcache.c:(139) stat_cache_add: Added entry (14011a280:size16) NEW TEXT DOCUMENT.TXT -> New Text Document.txt [2006/05/09 08:52:23, 5] smbd/filename.c:(180) conversion finished New Text Document.txt -> New Text Document.txt [2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:23, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:23, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52545 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 73 of length 124 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52609 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:23, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:23, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:23, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:23, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52609 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 74 of length 124 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52673 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:23, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:23, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:23, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:23, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52673 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 75 of length 124 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52737 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:23, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:23, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:23, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:23, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52737 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 76 of length 124 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52801 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:23, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:23, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:23, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:23, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52801 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 77 of length 124 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52865 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:23, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:23, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:23, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:23, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52865 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:23, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:23, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:23, 3] smbd/process.c:(1194) Transaction 78 of length 124 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52929 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:23, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:23, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:23, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:23, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:23, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:23, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:23, 5] lib/util.c:(454) [2006/05/09 08:52:23, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52929 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:23, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:23, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:23, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:24, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:24, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:24, 3] smbd/process.c:(1194) Transaction 79 of length 124 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52993 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:24, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:24, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:24, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:24, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:24, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:24, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=52993 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:24, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:24, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:24, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:24, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:24, 3] smbd/process.c:(1194) Transaction 80 of length 124 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53057 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:24, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:24, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:24, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:24, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:24, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:24, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53057 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:24, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:24, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:24, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:24, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:24, 3] smbd/process.c:(1194) Transaction 81 of length 124 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53121 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:24, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:24, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:24, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:24, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:24, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:24, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53121 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:24, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:24, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:24, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:24, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:24, 3] smbd/process.c:(1194) Transaction 82 of length 124 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53185 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:24, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:24, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:24, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:24, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:24, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:24, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53185 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:24, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:24, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:24, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:24, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:24, 3] smbd/process.c:(1194) Transaction 83 of length 124 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53249 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:24, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:24, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:24, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:24, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:24, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:24, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53249 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:24, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:24, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:24, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:24, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:24, 3] smbd/process.c:(1194) Transaction 84 of length 124 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53313 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:24, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:24, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:24, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:24, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:24, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:24, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53313 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:24, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:24, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:24, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:24, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:24, 3] smbd/process.c:(1194) Transaction 85 of length 124 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53377 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:24, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:24, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:24, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:24, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:24, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:24, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53377 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:24, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:24, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:24, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:24, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:24, 3] smbd/process.c:(1194) Transaction 86 of length 124 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53441 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:24, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:24, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:24, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:24, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:24, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:24, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53441 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:24, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:24, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:24, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:24, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:24, 3] smbd/process.c:(1194) Transaction 87 of length 124 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53505 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:24, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:24, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:24, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:24, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:24, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:24, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53505 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:24, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:24, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:24, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:24, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:24, 3] smbd/process.c:(1194) Transaction 88 of length 124 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53569 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:24, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:24, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:24, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:24, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:24, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:24, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53569 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:24, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:24, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:24, 10] lib/util_sock.c:(618) got smb length of 120 [2006/05/09 08:52:24, 6] smbd/process.c:(1193) got message type 0x0 of len 0x78 [2006/05/09 08:52:24, 3] smbd/process.c:(1194) Transaction 89 of length 124 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=120 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53633 smt_wct=15 smb_vwv[ 0]= 52 (0x34) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 40 (0x28) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 52 (0x34) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 5 (0x5) smb_bcc=55 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [030] 00 78 00 74 00 00 00 .x.t... [2006/05/09 08:52:24, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:24, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 [2006/05/09 08:52:24, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:24, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 [2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION [2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) SMB_QFBI - create: Tue May 9 08:49:16 2006 access: Tue May 9 08:49:16 2006 write: Tue May 9 08:49:16 2006 change: Tue May 9 08:49:16 2006 mode: 20 [2006/05/09 08:52:24, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 [2006/05/09 08:52:24, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 [2006/05/09 08:52:24, 5] lib/util.c:(454) [2006/05/09 08:52:24, 5] lib/util.c:(457) size=100 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53633 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=45 [2006/05/09 08:52:24, 10] lib/util.c:(2058) [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... [2006/05/09 08:52:24, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:24, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:25, 10] lib/util_sock.c:(618) got smb length of 126 [2006/05/09 08:52:25, 6] smbd/process.c:(1193) got message type 0x0 of len 0x7e [2006/05/09 08:52:25, 3] smbd/process.c:(1194) Transaction 90 of length 130 [2006/05/09 08:52:25, 5] lib/util.c:(454) [2006/05/09 08:52:25, 5] lib/util.c:(457) size=126 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53697 smt_wct=15 smb_vwv[ 0]= 58 (0x3A) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 10 (0xA) smb_vwv[ 3]=16384 (0x4000) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 58 (0x3A) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 1 (0x1) smb_bcc=61 [2006/05/09 08:52:25, 10] lib/util.c:(2058) [000] 00 00 00 16 00 56 05 07 00 04 01 00 00 00 00 5C .....V.. .......\ [010] 00 4E 00 65 00 77 00 20 00 54 00 65 00 78 00 74 .N.e.w. .T.e.x.t [020] 00 20 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E . .D.o.c .u.m.e.n [030] 00 74 00 2E 00 74 00 78 00 74 00 00 00 .t...t.x .t... [2006/05/09 08:52:25, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:25, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:25, 3] smbd/trans2.c:(1629) call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=1, close_if_end = 2 requires_resume_key = 4 level = 0x104, max_data_bytes = 16384 [2006/05/09 08:52:25, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:25, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:25, 5] smbd/trans2.c:(1688) dir=./, mask = New Text Document.txt [2006/05/09 08:52:25, 5] smbd/dir.c:(391) dptr_create dir=./ [2006/05/09 08:52:25, 3] smbd/dir.c:(510) creating new dirptr 256 for path ./, expect_close = 1 [2006/05/09 08:52:25, 4] smbd/trans2.c:(1745) dptr_num is 256, wcard = New Text Document.txt, attr = 22 [2006/05/09 08:52:25, 8] smbd/trans2.c:(1750) dirpath=<./> dontdescend=<> [2006/05/09 08:52:25, 8] smbd/trans2.c:(1078) get_lanman2_dir_entry:readdir on dirptr 0x1400ed200 now at offset -1 [2006/05/09 08:52:25, 8] smbd/dosmode.c:(300) dos_mode: ./New Text Document.txt [2006/05/09 08:52:25, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:25, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:25, 5] smbd/trans2.c:(1169) get_lanman2_dir_entry found ./New Text Document.txt fname=New Text Document.txt [2006/05/09 08:52:25, 10] smbd/trans2.c:(1310) get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO [2006/05/09 08:52:25, 10] smbd/mangle_hash2.c:(616) name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1) [2006/05/09 08:52:25, 5] smbd/trans2.c:(1798) call_trans2findfirst - (2) closing dptr_num 256 [2006/05/09 08:52:25, 4] smbd/dir.c:(238) closing dptr key 256 [2006/05/09 08:52:25, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 10, data_sent_thistime = 136, useable_space = 131010 [2006/05/09 08:52:25, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 10, data_to_send = 136, paramsize = 10, datasize = 136 [2006/05/09 08:52:25, 5] lib/util.c:(454) [2006/05/09 08:52:25, 5] lib/util.c:(457) size=204 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53697 smt_wct=10 smb_vwv[ 0]= 10 (0xA) smb_vwv[ 1]= 136 (0x88) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 10 (0xA) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 136 (0x88) smb_vwv[ 7]= 68 (0x44) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=149 [2006/05/09 08:52:25, 10] lib/util.c:(2058) [000] 00 FD FF 01 00 01 00 00 00 00 00 00 00 88 00 00 ........ ........ [010] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [020] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [030] 5A 17 73 C6 01 00 00 00 00 00 00 00 00 00 00 00 Z.s..... ........ [040] 00 00 00 00 00 20 00 00 00 2A 00 00 00 00 00 00 ..... .. .*...... [050] 00 18 00 4E 00 35 00 32 00 48 00 5A 00 32 00 7E ...N.5.2 .H.Z.2.~ [060] 00 54 00 2E 00 54 00 58 00 54 00 4E 00 65 00 77 .T...T.X .T.N.e.w [070] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [080] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [090] 00 78 00 74 00 .x.t. [2006/05/09 08:52:25, 4] smbd/trans2.c:(1832) SMBtrans2 mask=New Text Document.txt directory=./ dirtype=22 numentries=1 [2006/05/09 08:52:25, 10] smbd/mangle_hash2.c:(616) name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1) [2006/05/09 08:52:25, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:25, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:25, 10] lib/util_sock.c:(618) got smb length of 126 [2006/05/09 08:52:25, 6] smbd/process.c:(1193) got message type 0x0 of len 0x7e [2006/05/09 08:52:25, 3] smbd/process.c:(1194) Transaction 91 of length 130 [2006/05/09 08:52:25, 5] lib/util.c:(454) [2006/05/09 08:52:25, 5] lib/util.c:(457) size=126 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53761 smt_wct=15 smb_vwv[ 0]= 58 (0x3A) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 10 (0xA) smb_vwv[ 3]=16384 (0x4000) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 58 (0x3A) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 1 (0x1) smb_bcc=61 [2006/05/09 08:52:25, 10] lib/util.c:(2058) [000] 00 00 00 16 00 56 05 07 00 04 01 00 00 00 00 5C .....V.. .......\ [010] 00 4E 00 65 00 77 00 20 00 54 00 65 00 78 00 74 .N.e.w. .T.e.x.t [020] 00 20 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E . .D.o.c .u.m.e.n [030] 00 74 00 2E 00 74 00 78 00 74 00 00 00 .t...t.x .t... [2006/05/09 08:52:25, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:25, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:25, 3] smbd/trans2.c:(1629) call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=1, close_if_end = 2 requires_resume_key = 4 level = 0x104, max_data_bytes = 16384 [2006/05/09 08:52:25, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:25, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:25, 5] smbd/trans2.c:(1688) dir=./, mask = New Text Document.txt [2006/05/09 08:52:25, 5] smbd/dir.c:(391) dptr_create dir=./ [2006/05/09 08:52:25, 3] smbd/dir.c:(510) creating new dirptr 256 for path ./, expect_close = 1 [2006/05/09 08:52:25, 4] smbd/trans2.c:(1745) dptr_num is 256, wcard = New Text Document.txt, attr = 22 [2006/05/09 08:52:25, 8] smbd/trans2.c:(1750) dirpath=<./> dontdescend=<> [2006/05/09 08:52:25, 8] smbd/trans2.c:(1078) get_lanman2_dir_entry:readdir on dirptr 0x14010d420 now at offset -1 [2006/05/09 08:52:25, 8] smbd/dosmode.c:(300) dos_mode: ./New Text Document.txt [2006/05/09 08:52:25, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:25, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:25, 5] smbd/trans2.c:(1169) get_lanman2_dir_entry found ./New Text Document.txt fname=New Text Document.txt [2006/05/09 08:52:25, 10] smbd/trans2.c:(1310) get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO [2006/05/09 08:52:25, 10] smbd/mangle_hash2.c:(616) name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1) [2006/05/09 08:52:25, 5] smbd/trans2.c:(1798) call_trans2findfirst - (2) closing dptr_num 256 [2006/05/09 08:52:25, 4] smbd/dir.c:(238) closing dptr key 256 [2006/05/09 08:52:25, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 10, data_sent_thistime = 136, useable_space = 131010 [2006/05/09 08:52:25, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 10, data_to_send = 136, paramsize = 10, datasize = 136 [2006/05/09 08:52:25, 5] lib/util.c:(454) [2006/05/09 08:52:25, 5] lib/util.c:(457) size=204 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53761 smt_wct=10 smb_vwv[ 0]= 10 (0xA) smb_vwv[ 1]= 136 (0x88) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 10 (0xA) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 136 (0x88) smb_vwv[ 7]= 68 (0x44) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=149 [2006/05/09 08:52:25, 10] lib/util.c:(2058) [000] 00 FD FF 01 00 01 00 00 00 00 00 00 00 88 00 00 ........ ........ [010] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... [020] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... [030] 5A 17 73 C6 01 00 00 00 00 00 00 00 00 00 00 00 Z.s..... ........ [040] 00 00 00 00 00 20 00 00 00 2A 00 00 00 00 00 00 ..... .. .*...... [050] 00 18 00 4E 00 35 00 32 00 48 00 5A 00 32 00 7E ...N.5.2 .H.Z.2.~ [060] 00 54 00 2E 00 54 00 58 00 54 00 4E 00 65 00 77 .T...T.X .T.N.e.w [070] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o [080] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t [090] 00 78 00 74 00 .x.t. [2006/05/09 08:52:25, 4] smbd/trans2.c:(1832) SMBtrans2 mask=New Text Document.txt directory=./ dirtype=22 numentries=1 [2006/05/09 08:52:25, 10] smbd/mangle_hash2.c:(616) name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1) [2006/05/09 08:52:25, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:25, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:26, 10] lib/util_sock.c:(618) got smb length of 130 [2006/05/09 08:52:26, 6] smbd/process.c:(1193) got message type 0x0 of len 0x82 [2006/05/09 08:52:26, 3] smbd/process.c:(1194) Transaction 92 of length 134 [2006/05/09 08:52:26, 5] lib/util.c:(454) [2006/05/09 08:52:26, 5] lib/util.c:(457) size=130 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53825 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=11264 (0x2C00) smb_vwv[ 3]= 4096 (0x1000) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=32768 (0x8000) smb_vwv[ 8]= 256 (0x100) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 1792 (0x700) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]= 8192 (0x2000) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_bcc=47 [2006/05/09 08:52:26, 10] lib/util.c:(2058) [000] 00 5C 00 4E 00 65 00 77 00 20 00 54 00 65 00 78 .\.N.e.w . .T.e.x [010] 00 74 00 20 00 44 00 6F 00 63 00 75 00 6D 00 65 .t. .D.o .c.u.m.e [020] 00 6E 00 74 00 2E 00 74 00 78 00 74 00 00 00 .n.t...t .x.t... [2006/05/09 08:52:26, 3] smbd/process.c:(993) switch message SMBntcreateX (pid 404565) conn 0x140168050 [2006/05/09 08:52:26, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:26, 10] smbd/nttrans.c:(497) reply_ntcreateX: flags = 0x10, access_mask = 0x10080 file_attributes = 0x0, share_access = 0x7, create_disposition = 0x1 create_options = 0x200040 root_dir_fid = 0x0 [2006/05/09 08:52:26, 5] smbd/filename.c:(108) unix_convert called on file "New Text Document.txt" [2006/05/09 08:52:26, 10] smbd/statcache.c:(248) stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] [2006/05/09 08:52:26, 10] smbd/reply.c:(1862) can_delete: New Text Document.txt, dirtype = 0 [2006/05/09 08:52:26, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:26, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:26, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:26, 3] smbd/dosmode.c:(121) unix_mode(New Text Document.txt) returning 0740 [2006/05/09 08:52:26, 10] smbd/open.c:(1085) open_file_ntcreate: fname=New Text Document.txt, dos_attrs=0x0 access_mask=0x10080 share_access=0x7 create_disposition = 0x1 create_options=0x200040 unix mode=0740 oplock_request=0 [2006/05/09 08:52:26, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:26, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:26, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:26, 10] smbd/open.c:(1258) open_file_ntcreate: fname=New Text Document.txt, after mapping access_mask=0x10080 [2006/05/09 08:52:26, 5] smbd/files.c:(127) allocated file structure 468, fnum = 4564 (2 used) [2006/05/09 08:52:26, 4] smbd/open.c:(1488) calling open_file with flags=0x0 flags2=0x0 mode=0740 [2006/05/09 08:52:26, 2] smbd/open.c:(347) pavan opened file New Text Document.txt read=No write=No (numopen=2) [2006/05/09 08:52:26, 10] locking/locking.c:(538) unparse_share_modes: del: 0, num: 1 [2006/05/09 08:52:26, 10] locking/locking.c:(416) print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259 [2006/05/09 08:52:26, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:26, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:26, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:26, 5] smbd/nttrans.c:(910) reply_ntcreate_and_X: fnum = 4564, open name = New Text Document.txt [2006/05/09 08:52:26, 5] lib/util.c:(454) [2006/05/09 08:52:26, 5] lib/util.c:(457) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53825 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=54272 (0xD400) smb_vwv[ 3]= 273 (0x111) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 7698 (0x1E12) smb_vwv[ 7]= 5978 (0x175A) smb_vwv[ 8]=50803 (0xC673) smb_vwv[ 9]= 1 (0x1) smb_vwv[10]= 7698 (0x1E12) smb_vwv[11]= 5978 (0x175A) smb_vwv[12]=50803 (0xC673) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 7698 (0x1E12) smb_vwv[15]= 5978 (0x175A) smb_vwv[16]=50803 (0xC673) smb_vwv[17]= 1 (0x1) smb_vwv[18]= 7698 (0x1E12) smb_vwv[19]= 5978 (0x175A) smb_vwv[20]=50803 (0xC673) smb_vwv[21]= 8193 (0x2001) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 0 (0x0) smb_vwv[32]= 1792 (0x700) smb_vwv[33]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:26, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:26, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:26, 10] lib/util_sock.c:(618) got smb length of 72 [2006/05/09 08:52:26, 6] smbd/process.c:(1193) got message type 0x0 of len 0x48 [2006/05/09 08:52:26, 3] smbd/process.c:(1194) Transaction 93 of length 76 [2006/05/09 08:52:26, 5] lib/util.c:(454) [2006/05/09 08:52:26, 5] lib/util.c:(457) size=72 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53889 smt_wct=15 smb_vwv[ 0]= 4 (0x4) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 8 (0x8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 4 (0x4) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 7 (0x7) smb_bcc=7 [2006/05/09 08:52:26, 10] lib/util.c:(2058) [000] 00 00 00 D4 11 EE 03 ....... [2006/05/09 08:52:26, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:26, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:26, 3] smbd/trans2.c:(2799) call_trans2qfilepathinfo: TRANSACT2_QFILEINFO: level = 1006 [2006/05/09 08:52:26, 10] locking/locking.c:(440) parse_share_modes: delete_on_close: 0, num_share_modes: 1 [2006/05/09 08:52:26, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259 [2006/05/09 08:52:26, 3] smbd/trans2.c:(2912) call_trans2qfilepathinfo New Text Document.txt (fnum = 4564) level=1006 call=7 total_data=0 [2006/05/09 08:52:26, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:26, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:26, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:26, 10] smbd/trans2.c:(3228) call_trans2qfilepathinfo: SMB_FILE_INTERNAL_INFORMATION [2006/05/09 08:52:26, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 8, useable_space = 131010 [2006/05/09 08:52:26, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 8, paramsize = 2, datasize = 8 [2006/05/09 08:52:26, 5] lib/util.c:(454) [2006/05/09 08:52:26, 5] lib/util.c:(457) size=68 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53889 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 8 (0x8) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 8 (0x8) smb_vwv[ 7]= 60 (0x3C) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=13 [2006/05/09 08:52:26, 10] lib/util.c:(2058) [000] 00 00 00 00 00 83 BC 00 00 8D 80 FE B9 ........ ..... [2006/05/09 08:52:26, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:26, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:26, 10] lib/util_sock.c:(618) got smb length of 77 [2006/05/09 08:52:26, 6] smbd/process.c:(1193) got message type 0x0 of len 0x4d [2006/05/09 08:52:26, 3] smbd/process.c:(1194) Transaction 94 of length 81 [2006/05/09 08:52:26, 5] lib/util.c:(454) [2006/05/09 08:52:26, 5] lib/util.c:(457) size=77 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53953 smt_wct=15 smb_vwv[ 0]= 6 (0x6) smb_vwv[ 1]= 1 (0x1) smb_vwv[ 2]= 2 (0x2) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 6 (0x6) smb_vwv[10]= 68 (0x44) smb_vwv[11]= 1 (0x1) smb_vwv[12]= 76 (0x4C) smb_vwv[13]= 1 (0x1) smb_vwv[14]= 8 (0x8) smb_bcc=12 [2006/05/09 08:52:26, 10] lib/util.c:(2058) [000] 00 00 00 D4 11 F5 03 00 00 00 00 01 ........ .... [2006/05/09 08:52:26, 3] smbd/process.c:(993) switch message SMBtrans2 (pid 404565) conn 0x140168050 [2006/05/09 08:52:26, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:26, 3] smbd/trans2.c:(3701) call_trans2setfilepathinfo(8) New Text Document.txt (fnum 4564) info_level=1013 totdata=1 [2006/05/09 08:52:26, 8] smbd/dosmode.c:(300) dos_mode: New Text Document.txt [2006/05/09 08:52:26, 8] smbd/dosmode.c:(167) dos_mode_from_sbuf returning a [2006/05/09 08:52:26, 8] smbd/dosmode.c:(334) dos_mode returning a [2006/05/09 08:52:26, 10] locking/locking.c:(971) set_delete_on_close: Adding delete on close flag for fnum = 4564, file New Text Document.txt [2006/05/09 08:52:26, 10] locking/locking.c:(440) parse_share_modes: delete_on_close: 0, num_share_modes: 1 [2006/05/09 08:52:26, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259 [2006/05/09 08:52:26, 10] locking/locking.c:(538) unparse_share_modes: del: 1, num: 1 [2006/05/09 08:52:26, 10] locking/locking.c:(416) print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259 [2006/05/09 08:52:26, 9] smbd/trans2.c:(684) t2_rep: params_sent_thistime = 2, data_sent_thistime = 0, useable_space = 131012 [2006/05/09 08:52:26, 9] smbd/trans2.c:(686) t2_rep: params_to_send = 2, data_to_send = 0, paramsize = 2, datasize = 0 [2006/05/09 08:52:26, 5] lib/util.c:(454) [2006/05/09 08:52:26, 5] lib/util.c:(457) size=58 smb_com=0x32 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51265 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=53953 smt_wct=10 smb_vwv[ 0]= 2 (0x2) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=3 [2006/05/09 08:52:26, 10] lib/util.c:(2058) [000] 00 00 00 ... [2006/05/09 08:52:26, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:26, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:26, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:26, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:26, 3] smbd/process.c:(1194) Transaction 95 of length 45 [2006/05/09 08:52:26, 5] lib/util.c:(454) [2006/05/09 08:52:26, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=54017 smt_wct=3 smb_vwv[ 0]= 4564 (0x11D4) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:26, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x140168050 [2006/05/09 08:52:26, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:26, 3] smbd/reply.c:(3269) close fd=-1 fnum=4564 (numopen=2) [2006/05/09 08:52:26, 10] locking/locking.c:(440) parse_share_modes: delete_on_close: 1, num_share_modes: 1 [2006/05/09 08:52:26, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259 [2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(255) push_sec_ctx(205, 15) : sec_ctx_stack_ndx = 1 [2006/05/09 08:52:26, 3] smbd/uid.c:(392) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/05/09 08:52:26, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:26, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(385) pop_sec_ctx (205, 15) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:26, 5] smbd/close.c:(238) close_file: file New Text Document.txt. Delete on close was set - deleting file. [2006/05/09 08:52:26, 4] smbd/uid.c:(222) change_to_user: Skipping user change - already user [2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:26, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:26, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:26, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:26, 10] smbd/notify.c:(163) process_pending_change_notify_queue: dir . changed ! [2006/05/09 08:52:26, 3] smbd/error.c:(142) error packet at smbd/notify.c(55) cmd=160 (SMBnttrans) NT code 0x0000010c [2006/05/09 08:52:26, 5] lib/util.c:(454) [2006/05/09 08:52:26, 5] lib/util.c:(457) size=71 smb_com=0xa0 smb_rcls=12 smb_reh=1 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=51904 smt_wct=18 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:26, 10] locking/posix.c:(1249) posix_locking_close_file: file New Text Document.txt has no outstanding locks. [2006/05/09 08:52:26, 2] smbd/close.c:(305) pavan closed file New Text Document.txt (numopen=1) [2006/05/09 08:52:26, 5] smbd/files.c:(449) freed files structure 4564 (1 used) [2006/05/09 08:52:26, 5] lib/util.c:(454) [2006/05/09 08:52:26, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=54017 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:26, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:26, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:26, 10] lib/util_sock.c:(618) got smb length of 84 [2006/05/09 08:52:26, 6] smbd/process.c:(1193) got message type 0x0 of len 0x54 [2006/05/09 08:52:26, 3] smbd/process.c:(1194) Transaction 96 of length 88 [2006/05/09 08:52:26, 5] lib/util.c:(454) [2006/05/09 08:52:26, 5] lib/util.c:(457) size=84 smb_com=0xa0 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=54080 smt_wct=23 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 8192 (0x2000) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]=21504 (0x5400) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 1024 (0x400) smb_vwv[18]= 4 (0x4) smb_vwv[19]= 3 (0x3) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 4559 (0x11CF) smb_vwv[22]= 1 (0x1) smb_bcc=3 [2006/05/09 08:52:26, 10] lib/util.c:(2058) [000] 00 00 00 ... [2006/05/09 08:52:26, 3] smbd/process.c:(993) switch message SMBnttrans (pid 404565) conn 0x140168050 [2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(287) setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:26, 5] auth/auth_util.c:(437) NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 contains 5 SIDs SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:52:26, 5] auth/auth_util.c:(454) UNIX token of user 205 Primary group is 15 and contains 1 supplementary groups Group[ 0]: 15 [2006/05/09 08:52:26, 5] smbd/uid.c:(308) change_to_user uid=(0,205) gid=(0,15) [2006/05/09 08:52:26, 10] smbd/nttrans.c:(2806) reply_nttrans: setup_count = 8 [2006/05/09 08:52:26, 10] lib/util.c:(2058) [000] 03 00 00 00 CF 11 01 00 ........ [2006/05/09 08:52:26, 3] smbd/nttrans.c:(1853) call_nt_transact_notify_change [2006/05/09 08:52:26, 3] smbd/nttrans.c:(1867) call_nt_transact_notify_change: notify change called on directory name = . [2006/05/09 08:52:26, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:26, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:33, 10] lib/util_sock.c:(618) got smb length of 39 [2006/05/09 08:52:33, 6] smbd/process.c:(1193) got message type 0x0 of len 0x27 [2006/05/09 08:52:33, 3] smbd/process.c:(1194) Transaction 97 of length 43 [2006/05/09 08:52:33, 5] lib/util.c:(454) [2006/05/09 08:52:33, 5] lib/util.c:(457) size=39 smb_com=0x74 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=0 smb_pid=65279 smb_uid=103 smb_mid=54145 smt_wct=2 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:33, 3] smbd/process.c:(993) switch message SMBulogoffX (pid 404565) conn 0x0 [2006/05/09 08:52:33, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:33, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:33, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:33, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:33, 5] auth/auth_util.c:(1511) attempting to free (and zero) a server_info structure [2006/05/09 08:52:33, 3] smbd/reply.c:(1606) ulogoffX vuid=103 [2006/05/09 08:52:33, 5] lib/util.c:(454) [2006/05/09 08:52:33, 5] lib/util.c:(457) size=39 smb_com=0x74 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=65279 smb_uid=103 smb_mid=54145 smt_wct=2 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:33, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:33, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:33, 10] lib/util_sock.c:(618) got smb length of 35 [2006/05/09 08:52:33, 6] smbd/process.c:(1193) got message type 0x0 of len 0x23 [2006/05/09 08:52:33, 3] smbd/process.c:(1194) Transaction 98 of length 39 [2006/05/09 08:52:33, 5] lib/util.c:(454) [2006/05/09 08:52:33, 5] lib/util.c:(457) size=35 smb_com=0x71 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=3 smb_pid=65279 smb_uid=103 smb_mid=54209 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:33, 3] smbd/process.c:(993) switch message SMBtdis (pid 404565) conn 0x14016e050 [2006/05/09 08:52:33, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:33, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:33, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:33, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:33, 4] smbd/vfs.c:(738) vfs_ChDir to /tmp [2006/05/09 08:52:33, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:33, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:33, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:33, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:33, 3] smbd/service.c:(882) nt218201 (15.76.218.201) closed connection to service IPC$ [2006/05/09 08:52:33, 3] smbd/connection.c:(69) Yielding connection to IPC$ [2006/05/09 08:52:33, 4] smbd/vfs.c:(738) vfs_ChDir to / [2006/05/09 08:52:33, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:33, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:33, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:33, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:33, 5] lib/util.c:(454) [2006/05/09 08:52:33, 5] lib/util.c:(457) size=35 smb_com=0x71 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=3 smb_pid=65279 smb_uid=103 smb_mid=54209 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:33, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:33, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:37, 10] lib/util_sock.c:(618) got smb length of 36 [2006/05/09 08:52:37, 6] smbd/process.c:(1193) got message type 0x0 of len 0x24 [2006/05/09 08:52:37, 3] smbd/process.c:(1194) Transaction 99 of length 40 [2006/05/09 08:52:37, 5] lib/util.c:(454) [2006/05/09 08:52:37, 5] lib/util.c:(457) size=36 smb_com=0xa4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=54080 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:37, 3] smbd/process.c:(993) switch message SMBntcancel (pid 404565) conn 0x140168050 [2006/05/09 08:52:37, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:37, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:37, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:37, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:37, 3] smbd/error.c:(142) error packet at smbd/notify.c(55) cmd=160 (SMBnttrans) NT_STATUS_CANCELLED [2006/05/09 08:52:37, 5] lib/util.c:(454) [2006/05/09 08:52:37, 5] lib/util.c:(457) size=71 smb_com=0xa0 smb_rcls=32 smb_reh=1 smb_err=49152 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=2236 smb_uid=101 smb_mid=54080 smt_wct=18 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_bcc=0 [2006/05/09 08:52:37, 3] smbd/nttrans.c:(1564) reply_ntcancel: cancel called on mid = 54080. [2006/05/09 08:52:37, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:37, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:37, 10] lib/util_sock.c:(618) got smb length of 41 [2006/05/09 08:52:37, 6] smbd/process.c:(1193) got message type 0x0 of len 0x29 [2006/05/09 08:52:37, 3] smbd/process.c:(1194) Transaction 100 of length 45 [2006/05/09 08:52:37, 5] lib/util.c:(454) [2006/05/09 08:52:37, 5] lib/util.c:(457) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=54272 smt_wct=3 smb_vwv[ 0]= 4559 (0x11CF) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2006/05/09 08:52:37, 3] smbd/process.c:(993) switch message SMBclose (pid 404565) conn 0x140168050 [2006/05/09 08:52:37, 3] smbd/sec_ctx.c:(287) setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:37, 5] auth/auth_util.c:(437) NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 contains 5 SIDs SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SE_PRIV 0x0 0x0 0x0 0x0 [2006/05/09 08:52:37, 5] auth/auth_util.c:(454) UNIX token of user 205 Primary group is 15 and contains 1 supplementary groups Group[ 0]: 15 [2006/05/09 08:52:37, 5] smbd/uid.c:(308) change_to_user uid=(0,205) gid=(0,15) [2006/05/09 08:52:37, 4] smbd/vfs.c:(738) vfs_ChDir to /usr/users/pavan [2006/05/09 08:52:37, 3] smbd/reply.c:(3257) close directory fnum=4559 [2006/05/09 08:52:37, 10] locking/locking.c:(440) parse_share_modes: delete_on_close: 0, num_share_modes: 2 [2006/05/09 08:52:37, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:37, 10] locking/locking.c:(487) parse_share_modes: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x200000, access_mask = 0x100080, mid = 0x0, type= 0x40, file_id = 5, dev = 0xb9fe808d, inode = 48169 [2006/05/09 08:52:37, 5] smbd/files.c:(449) freed files structure 4559 (0 used) [2006/05/09 08:52:37, 5] lib/util.c:(454) [2006/05/09 08:52:37, 5] lib/util.c:(457) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=54272 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:37, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:37, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:52:49, 10] lib/util_sock.c:(618) got smb length of 35 [2006/05/09 08:52:49, 6] smbd/process.c:(1193) got message type 0x0 of len 0x23 [2006/05/09 08:52:49, 3] smbd/process.c:(1194) Transaction 101 of length 39 [2006/05/09 08:52:49, 5] lib/util.c:(454) [2006/05/09 08:52:49, 5] lib/util.c:(457) size=35 smb_com=0x71 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=54336 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:49, 3] smbd/process.c:(993) switch message SMBtdis (pid 404565) conn 0x140168050 [2006/05/09 08:52:49, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:49, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:49, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:49, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:49, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:49, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:49, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:49, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:49, 1] smbd/service.c:(882) nt218201 (15.76.218.201) closed connection to service pavan [2006/05/09 08:52:49, 3] smbd/connection.c:(69) Yielding connection to pavan [2006/05/09 08:52:49, 4] smbd/vfs.c:(738) vfs_ChDir to / [2006/05/09 08:52:49, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:52:49, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:52:49, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:52:49, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:52:49, 5] lib/util.c:(454) [2006/05/09 08:52:49, 5] lib/util.c:(457) size=35 smb_com=0x71 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=54336 smt_wct=0 smb_bcc=0 [2006/05/09 08:52:49, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:52:49, 10] smbd/process.c:(299) run_events: No events [2006/05/09 08:53:49, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:53:49, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:53:49, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:53:49, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:53:49, 10] smbd/process.c:(1372) change_notify_timeout: 60 [2006/05/09 08:54:49, 3] smbd/sec_ctx.c:(287) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/05/09 08:54:49, 5] auth/auth_util.c:(433) NT user token: (NULL) [2006/05/09 08:54:49, 5] auth/auth_util.c:(454) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2006/05/09 08:54:49, 5] smbd/uid.c:(323) change_to_root_user: now uid=(0,0) gid=(0,0) [2006/05/09 08:54:49, 3] smbd/process.c:(1428) Printcap cache time expired. [2006/05/09 08:54:49, 3] printing/pcap.c:(117) reloading printcap cache [2006/05/09 08:54:49, 3] printing/pcap.c:(223) reload status: ok [2006/05/09 08:54:49, 3] printing/pcap.c:(117) reloading printcap cache [2006/05/09 08:54:49, 3] printing/pcap.c:(223) reload status: ok [2006/05/09 08:54:49, 10] smbd/process.c:(1372) change_notify_timeout: 60