Attachment 1895 Details for Bug 3767 – smbd.log at debug=10

smbd.log at debug=10

smbd.txt (text/plain), 640.29 KB, created by pavan on 2006-05-10 02:06:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: pavan

Created: 2006-05-10 02:06:30 UTC

Size: 640.29 KB

patch

obsolete

>[2006/05/09 08:51:57, 6] param/loadparm.c:(2947)
>  lp_file_list_changed()
>  file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf  last mod_time: Tue May  9 08:51:35 2006
>  
>[2006/05/09 08:51:57, 2] lib/interface.c:(81)
>  added interface ip=15.70.194.216 bcast=15.70.194.255 nmask=255.255.255.0
>[2006/05/09 08:51:57, 5] lib/util.c:(260)
>  Netbios name list:-
>  my_netbios_names[0]="CHEVY"
>[2006/05/09 08:51:57, 3] lib/util.c:(2177)
>  set_maxfiles: setrlimit for RLIMIT_NOFILE for 10020 max files failed with error Invalid argument
>[2006/05/09 08:51:57, 1] smbd/files.c:(196)
>  file_init: Information only: requested 10000 open files, 4076 are available.
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2006/05/09 08:51:57, 3] smbd/uid.c:(392)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(950)
>  Trying to load: smbpasswd
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(94)
>  Attempting to register passdb backend smbpasswd
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(107)
>  Successfully added passdb backend 'smbpasswd'
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(94)
>  Attempting to register passdb backend tdbsam
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(107)
>  Successfully added passdb backend 'tdbsam'
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(94)
>  Attempting to register passdb backend guest
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(107)
>  Successfully added passdb backend 'guest'
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(822)
>  Attempting to find an passdb backend to match smbpasswd (smbpasswd)
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(843)
>  Found pdb backend smbpasswd
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(846)
>  pdb backend smbpasswd has a valid init
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(822)
>  Attempting to find an passdb backend to match guest (guest)
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(843)
>  Found pdb backend guest
>[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(846)
>  pdb backend guest has a valid init
>[2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(1371)
>  smbpasswd_getsampwrid: search by sid: S-1-5-21-4112424572-1378032116-4237619202-501
>[2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(1322)
>  getsampwnam (smbpasswd): search by name: nobody
>[2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(184)
>  startsmbfilepwent_internal: opening file /usr/local/samba/private/smbpasswd
>[2006/05/09 08:51:57, 5] passdb/pdb_smbpasswd.c:(487)
>  getsmbfilepwent: returning passwd entry for user pavan, uid 205
>[2006/05/09 08:51:57, 5] passdb/pdb_smbpasswd.c:(539)
>  getsmbfilepwent: end of file reached.
>[2006/05/09 08:51:57, 7] passdb/pdb_smbpasswd.c:(301)
>  endsmbfilepwent_internal: closed password file.
>[2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(616)
>  pdb_set_username: setting username nobody, was 
>[2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(697)
>  pdb_set_full_name: setting full name nobody, was 
>[2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(643)
>  pdb_set_domain: setting domain CHEVY, was 
>[2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(543)
>  pdb_set_user_sid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-501
>[2006/05/09 08:51:57, 10] passdb/pdb_compat.c:(72)
>  pdb_set_user_sid_from_rid:
>  	setting user sid S-1-5-21-4112424572-1378032116-4237619202-501 from rid 501
>[2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(579)
>  pdb_set_group_sid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-514
>[2006/05/09 08:51:57, 10] passdb/pdb_compat.c:(99)
>  pdb_set_group_sid_from_rid:
>  	setting group sid S-1-5-21-4112424572-1378032116-4237619202-514 from rid 514
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2006/05/09 08:51:57, 3] smbd/uid.c:(392)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:51:57, 10] lib/system_smbd.c:(167)
>  sys_getgrouplist: user [nobody]
>[2006/05/09 08:51:57, 10] lib/system_smbd.c:(175)
>  sys_getgrouplist(): disabled winbindd for group lookup [user == nobody]
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
>[2006/05/09 08:51:57, 3] smbd/uid.c:(392)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:51:57, 8] lib/system_smbd.c:(49)
>  remove_duplicate_gids: Enter 2 gids
>[2006/05/09 08:51:57, 8] lib/system_smbd.c:(67)
>  remove_duplicate_gids: Exit 1 gids
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
>[2006/05/09 08:51:57, 3] smbd/uid.c:(392)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:51:57, 10] passdb/passdb.c:(1244)
>  local_gid_to_sid: Fall back to algorithmic mapping: 65534 -> S-1-5-21-4112424572-1378032116-4237619202-132069
>[2006/05/09 08:51:57, 10] passdb/lookup_sid.c:(406)
>  gid_to_sid: local 65534 -> S-1-5-21-4112424572-1378032116-4237619202-132069
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:51:57, 10] lib/privileges.c:(565)
>  grant_privilege: S-1-1-0
>  original privilege mask:
>  SE_PRIV  0x0 0x0 0x0 0x0
>  new privilege mask:
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:51:57, 10] lib/privileges.c:(565)
>  grant_privilege: S-1-5-32-544
>  original privilege mask:
>  SE_PRIV  0x0 0x0 0x0 0x0
>  new privilege mask:
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:51:57, 10] lib/privileges.c:(565)
>  grant_privilege: S-1-5-32-548
>  original privilege mask:
>  SE_PRIV  0x0 0x0 0x0 0x0
>  new privilege mask:
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:51:57, 10] lib/privileges.c:(565)
>  grant_privilege: S-1-5-32-549
>  original privilege mask:
>  SE_PRIV  0x0 0x0 0x0 0x0
>  new privilege mask:
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:51:57, 10] lib/privileges.c:(565)
>  grant_privilege: S-1-5-32-550
>  original privilege mask:
>  SE_PRIV  0x0 0x0 0x0 0x0
>  new privilege mask:
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:51:57, 10] lib/privileges.c:(565)
>  grant_privilege: S-1-5-32-551
>  original privilege mask:
>  SE_PRIV  0x0 0x0 0x0 0x0
>  new privilege mask:
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:51:57, 10] auth/auth_util.c:(437)
>  NT user token of user S-1-5-21-4112424572-1378032116-4237619202-501
>  contains 6 SIDs
>  SID[  0]: S-1-5-21-4112424572-1378032116-4237619202-501
>  SID[  1]: S-1-5-21-4112424572-1378032116-4237619202-514
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-32-546
>  SID[  5]: S-1-5-21-4112424572-1378032116-4237619202-132069
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(896)
>  make_server_info_sam: made server info for user nobody -> nobody
>[2006/05/09 08:51:57, 3] smbd/server.c:(840)
>  loaded services
>[2006/05/09 08:51:57, 3] smbd/server.c:(855)
>  Becoming a daemon.
>[2006/05/09 08:51:57, 8] lib/util.c:(1820)
>  fcntl_lock 9 8 0 1 2
>[2006/05/09 08:51:57, 8] lib/util.c:(1855)
>  fcntl_lock: Lock call successful
>[2006/05/09 08:51:57, 5] tdb/tdbutil.c:(772)
>  tdb(unnamed): tdb_brlock failed (fd=10) at offset 4 rw_type=2 lck_type=8: Permission denied
>[2006/05/09 08:51:57, 2] lib/tallocmsg.c:(61)
>  Registered MSG_REQ_POOL_USAGE
>[2006/05/09 08:51:57, 2] lib/dmallocmsg.c:(71)
>  Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
>[2006/05/09 08:51:57, 5] lib/gencache.c:(59)
>  Opening cache file at /usr/local/samba/var/locks/gencache.tdb
>[2006/05/09 08:51:57, 5] libsmb/namecache.c:(57)
>  namecache_enable: enabling netbios namecache, timeout 660 seconds
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM] with subkey [SOFTWARE]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE] with subkey [Microsoft]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft] with subkey [Windows NT]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT] with subkey [CurrentVersion]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] with subkey [Print]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] with subkey [Printers]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM] with subkey [SOFTWARE]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE] with subkey [Microsoft]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft] with subkey [Windows NT]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT] with subkey [CurrentVersion]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] with subkey [Ports]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Control\Print]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM] with subkey [SYSTEM]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Control]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control] with subkey [Print]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Print] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM] with subkey [SYSTEM]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Services]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services] with subkey [LanmanServer]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer] with subkey [Shares]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM] with subkey [SYSTEM]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Services]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services] with subkey [Eventlog]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM] with subkey [SOFTWARE]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE] with subkey [Microsoft]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft] with subkey [Windows NT]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT] with subkey [CurrentVersion]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] with subkey [Perflib]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM] with subkey [SOFTWARE]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE] with subkey [Microsoft]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft] with subkey [Windows NT]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT] with subkey [CurrentVersion]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] with subkey [Perflib]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib] with subkey [009]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM] with subkey [SYSTEM]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Control]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control] with subkey [Print]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Print] with subkey [Monitors]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM] with subkey [SYSTEM]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Control]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control] with subkey [ProductOptions]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM] with subkey [SYSTEM]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Control]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control] with subkey [Terminal Server]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server] with subkey [DefaultUserConfiguration]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM] with subkey [SYSTEM]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Services]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services] with subkey [TcpIp]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\TcpIp] with subkey [Parameters]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM] with subkey [SYSTEM]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Services]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services] with subkey [Netlogon]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\Netlogon] with subkey [Parameters]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKU]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKU] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKCR]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKCR] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKPD]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKPD] with subkey [NULL]
>[2006/05/09 08:51:57, 6] registry/reg_db.c:(104)
>  init_registry_data: Adding [HKPT]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(129)
>  init_registry_data: Storing key [HKPT] with subkey [NULL]
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(562)
>  regdb_fetch_values: Looking for value of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports] 
>[2006/05/09 08:51:57, 8] registry/reg_db.c:(514)
>  specific: [Samba Printer Port], len: 2
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(562)
>  regdb_fetch_values: Looking for value of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] 
>[2006/05/09 08:51:57, 8] registry/reg_db.c:(514)
>  specific: [DefaultSpoolDirectory], len: 70
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(562)
>  regdb_fetch_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog] 
>[2006/05/09 08:51:57, 8] registry/reg_db.c:(514)
>  specific: [DisplayName], len: 20
>[2006/05/09 08:51:57, 8] registry/reg_db.c:(514)
>  specific: [ErrorControl], len: 4
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(562)
>  regdb_fetch_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog] 
>[2006/05/09 08:51:57, 8] registry/reg_db.c:(514)
>  specific: [DisplayName], len: 20
>[2006/05/09 08:51:57, 8] registry/reg_db.c:(514)
>  specific: [ErrorControl], len: 4
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(61)
>  reghook_cache_add: Adding key [/HKLM/SYSTEM/CurrentControlSet/Control/Print]
>[2006/05/09 08:51:57, 8] lib/adt_tree.c:(201)
>  pathtree_add: Enter
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(267)
>  pathtree_add: Successfully added node [HKLM/SYSTEM/CurrentControlSet/Control/Print] to tree
>[2006/05/09 08:51:57, 8] lib/adt_tree.c:(270)
>  pathtree_add: Exit
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(61)
>  reghook_cache_add: Adding key [/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Print/Printers]
>[2006/05/09 08:51:57, 8] lib/adt_tree.c:(201)
>  pathtree_add: Enter
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(267)
>  pathtree_add: Successfully added node [HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Print/Printers] to tree
>[2006/05/09 08:51:57, 8] lib/adt_tree.c:(270)
>  pathtree_add: Exit
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(61)
>  reghook_cache_add: Adding key [/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Ports]
>[2006/05/09 08:51:57, 8] lib/adt_tree.c:(201)
>  pathtree_add: Enter
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(267)
>  pathtree_add: Successfully added node [HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Ports] to tree
>[2006/05/09 08:51:57, 8] lib/adt_tree.c:(270)
>  pathtree_add: Exit
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(61)
>  reghook_cache_add: Adding key [/HKLM/SYSTEM/CurrentControlSet/Services/LanmanServer/Shares]
>[2006/05/09 08:51:57, 8] lib/adt_tree.c:(201)
>  pathtree_add: Enter
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(267)
>  pathtree_add: Successfully added node [HKLM/SYSTEM/CurrentControlSet/Services/LanmanServer/Shares] to tree
>[2006/05/09 08:51:57, 8] lib/adt_tree.c:(270)
>  pathtree_add: Exit
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2006/05/09 08:51:57, 3] smbd/uid.c:(392)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(1322)
>  getsampwnam (smbpasswd): search by name: root
>[2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(184)
>  startsmbfilepwent_internal: opening file /usr/local/samba/private/smbpasswd
>[2006/05/09 08:51:57, 5] passdb/pdb_smbpasswd.c:(487)
>  getsmbfilepwent: returning passwd entry for user pavan, uid 205
>[2006/05/09 08:51:57, 5] passdb/pdb_smbpasswd.c:(539)
>  getsmbfilepwent: end of file reached.
>[2006/05/09 08:51:57, 7] passdb/pdb_smbpasswd.c:(301)
>  endsmbfilepwent_internal: closed password file.
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:51:57, 4] passdb/passdb.c:(1145)
>  local_uid_to_sid: User root [uid == 0] has no samba account
>[2006/05/09 08:51:57, 8] passdb/passdb.c:(1107)
>  algorithmic_uid_to_sid: falling back to RID algorithm
>[2006/05/09 08:51:57, 10] passdb/passdb.c:(1110)
>  algorithmic_uid_to_sid:  uid (0) -> SID S-1-5-21-4112424572-1378032116-4237619202-1000.
>[2006/05/09 08:51:57, 10] passdb/passdb.c:(1153)
>  local_uid_to_sid:  uid (0) -> SID S-1-5-21-4112424572-1378032116-4237619202-1000 (root).
>[2006/05/09 08:51:57, 10] passdb/lookup_sid.c:(364)
>  uid_to_sid: local 0 -> S-1-5-21-4112424572-1378032116-4237619202-1000
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2006/05/09 08:51:57, 3] smbd/uid.c:(392)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:51:57, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:51:57, 10] passdb/passdb.c:(1244)
>  local_gid_to_sid: Fall back to algorithmic mapping: 1 -> S-1-5-21-4112424572-1378032116-4237619202-1003
>[2006/05/09 08:51:57, 10] passdb/lookup_sid.c:(406)
>  gid_to_sid: local 1 -> S-1-5-21-4112424572-1378032116-4237619202-1003
>[2006/05/09 08:51:57, 10] auth/auth_util.c:(437)
>  NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1000
>  contains 6 SIDs
>  SID[  0]: S-1-5-21-4112424572-1378032116-4237619202-1000
>  SID[  1]: S-1-5-21-4112424572-1378032116-4237619202-1003
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SID[  5]: S-1-5-32-544
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(248)
>  regdb_open: incrementing refcount (1)
>[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359)
>  regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services]
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95)
>  reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341)
>  pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413)
>  pathtree_find: Exit
>[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59)
>  registry_access_check: using root's token
>[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000.
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f
>  se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026
>[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (f003f) granted.
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(248)
>  regdb_open: incrementing refcount (2)
>[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359)
>  regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\Spooler]
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95)
>  reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/Spooler]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341)
>  pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/Spooler]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413)
>  pathtree_find: Exit
>[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59)
>  registry_access_check: using root's token
>[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000.
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f
>  se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026
>[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (f003f) granted.
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(592)
>  regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Spooler] 
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(279)
>  regdb_close: decrementing refcount (2)
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(248)
>  regdb_open: incrementing refcount (2)
>[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359)
>  regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\Spooler\Security]
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95)
>  reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/Spooler/Security]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341)
>  pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/Spooler/Security]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413)
>  pathtree_find: Exit
>[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59)
>  registry_access_check: using root's token
>[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000.
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f
>  se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026
>[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (f003f) granted.
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(84)
>  000000 sec_io_desc sec_desc
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>      0000 revision : 0001
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>      0002 type     : 8004
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      0004 off_owner_sid: 00000000
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      0008 off_grp_sid  : 00000000
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      000c off_sacl     : 00000000
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      0010 off_dacl     : 00000014
>[2006/05/09 08:51:57, 6] rpc_parse/parse_prs.c:(84)
>      000014 sec_io_acl dacl
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>          0014 revision: 0002
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>          0018 num_aces : 00000004
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          00001c sec_io_ace ace_list[00]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              001c type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              001d flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000020 sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  0020 mask: 0002018d
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000024 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0024 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0025 num_auths  : 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0026 id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0027 id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0028 id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0029 id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  002a id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  002b id_auth[5] : 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  002c sub_auths : 00000000 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              001e size : 0014
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          000030 sec_io_ace ace_list[01]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0030 type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0031 flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000034 sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  0034 mask: 000201fd
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000038 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0038 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0039 num_auths  : 02
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003a id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003b id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003c id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003d id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003e id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003f id_auth[5] : 05
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  0040 sub_auths : 00000020 00000223 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              0032 size : 0018
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          000048 sec_io_ace ace_list[02]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0048 type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0049 flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              00004c sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  004c mask: 000f01ff
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000050 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0050 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0051 num_auths  : 02
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0052 id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0053 id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0054 id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0055 id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0056 id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0057 id_auth[5] : 05
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  0058 sub_auths : 00000020 00000225 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              004a size : 0018
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          000060 sec_io_ace ace_list[03]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0060 type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0061 flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000064 sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  0064 mask: 000f01ff
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000068 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0068 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0069 num_auths  : 02
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006a id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006b id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006c id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006d id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006e id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006f id_auth[5] : 05
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  0070 sub_auths : 00000020 00000220 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              0062 size : 0018
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>          0016 size     : 0064
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(592)
>  regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Spooler\Security] 
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(279)
>  regdb_close: decrementing refcount (2)
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(248)
>  regdb_open: incrementing refcount (2)
>[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359)
>  regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\NETLOGON]
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95)
>  reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/NETLOGON]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341)
>  pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/NETLOGON]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413)
>  pathtree_find: Exit
>[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59)
>  registry_access_check: using root's token
>[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000.
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f
>  se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026
>[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (f003f) granted.
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(592)
>  regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\NETLOGON] 
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(279)
>  regdb_close: decrementing refcount (2)
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(248)
>  regdb_open: incrementing refcount (2)
>[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359)
>  regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\NETLOGON\Security]
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95)
>  reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/NETLOGON/Security]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341)
>  pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/NETLOGON/Security]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413)
>  pathtree_find: Exit
>[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59)
>  registry_access_check: using root's token
>[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000.
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f
>  se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026
>[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (f003f) granted.
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(84)
>  000000 sec_io_desc sec_desc
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>      0000 revision : 0001
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>      0002 type     : 8004
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      0004 off_owner_sid: 00000000
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      0008 off_grp_sid  : 00000000
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      000c off_sacl     : 00000000
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      0010 off_dacl     : 00000014
>[2006/05/09 08:51:57, 6] rpc_parse/parse_prs.c:(84)
>      000014 sec_io_acl dacl
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>          0014 revision: 0002
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>          0018 num_aces : 00000004
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          00001c sec_io_ace ace_list[00]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              001c type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              001d flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000020 sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  0020 mask: 0002018d
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000024 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0024 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0025 num_auths  : 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0026 id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0027 id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0028 id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0029 id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  002a id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  002b id_auth[5] : 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  002c sub_auths : 00000000 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              001e size : 0014
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          000030 sec_io_ace ace_list[01]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0030 type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0031 flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000034 sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  0034 mask: 000201fd
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000038 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0038 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0039 num_auths  : 02
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003a id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003b id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003c id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003d id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003e id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003f id_auth[5] : 05
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  0040 sub_auths : 00000020 00000223 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              0032 size : 0018
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          000048 sec_io_ace ace_list[02]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0048 type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0049 flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              00004c sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  004c mask: 000f01ff
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000050 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0050 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0051 num_auths  : 02
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0052 id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0053 id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0054 id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0055 id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0056 id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0057 id_auth[5] : 05
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  0058 sub_auths : 00000020 00000225 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              004a size : 0018
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          000060 sec_io_ace ace_list[03]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0060 type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0061 flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000064 sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  0064 mask: 000f01ff
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000068 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0068 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0069 num_auths  : 02
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006a id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006b id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006c id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006d id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006e id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006f id_auth[5] : 05
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  0070 sub_auths : 00000020 00000220 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              0062 size : 0018
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>          0016 size     : 0064
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(592)
>  regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\NETLOGON\Security] 
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(279)
>  regdb_close: decrementing refcount (2)
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(248)
>  regdb_open: incrementing refcount (2)
>[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359)
>  regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry]
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95)
>  reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/RemoteRegistry]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341)
>  pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/RemoteRegistry]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413)
>  pathtree_find: Exit
>[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59)
>  registry_access_check: using root's token
>[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000.
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f
>  se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026
>[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (f003f) granted.
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(592)
>  regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry] 
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(279)
>  regdb_close: decrementing refcount (2)
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(248)
>  regdb_open: incrementing refcount (2)
>[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359)
>  regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry\Security]
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95)
>  reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/RemoteRegistry/Security]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341)
>  pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/RemoteRegistry/Security]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413)
>  pathtree_find: Exit
>[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59)
>  registry_access_check: using root's token
>[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000.
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f
>  se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026
>[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (f003f) granted.
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(84)
>  000000 sec_io_desc sec_desc
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>      0000 revision : 0001
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>      0002 type     : 8004
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      0004 off_owner_sid: 00000000
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      0008 off_grp_sid  : 00000000
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      000c off_sacl     : 00000000
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      0010 off_dacl     : 00000014
>[2006/05/09 08:51:57, 6] rpc_parse/parse_prs.c:(84)
>      000014 sec_io_acl dacl
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>          0014 revision: 0002
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>          0018 num_aces : 00000004
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          00001c sec_io_ace ace_list[00]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              001c type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              001d flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000020 sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  0020 mask: 0002018d
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000024 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0024 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0025 num_auths  : 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0026 id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0027 id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0028 id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0029 id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  002a id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  002b id_auth[5] : 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  002c sub_auths : 00000000 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              001e size : 0014
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          000030 sec_io_ace ace_list[01]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0030 type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0031 flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000034 sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  0034 mask: 000201fd
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000038 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0038 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0039 num_auths  : 02
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003a id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003b id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003c id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003d id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003e id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003f id_auth[5] : 05
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  0040 sub_auths : 00000020 00000223 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              0032 size : 0018
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          000048 sec_io_ace ace_list[02]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0048 type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0049 flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              00004c sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  004c mask: 000f01ff
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000050 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0050 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0051 num_auths  : 02
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0052 id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0053 id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0054 id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0055 id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0056 id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0057 id_auth[5] : 05
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  0058 sub_auths : 00000020 00000225 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              004a size : 0018
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          000060 sec_io_ace ace_list[03]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0060 type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0061 flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000064 sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  0064 mask: 000f01ff
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000068 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0068 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0069 num_auths  : 02
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006a id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006b id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006c id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006d id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006e id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006f id_auth[5] : 05
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  0070 sub_auths : 00000020 00000220 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              0062 size : 0018
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>          0016 size     : 0064
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(592)
>  regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry\Security] 
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(279)
>  regdb_close: decrementing refcount (2)
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(248)
>  regdb_open: incrementing refcount (2)
>[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359)
>  regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\WINS]
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95)
>  reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/WINS]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341)
>  pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/WINS]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413)
>  pathtree_find: Exit
>[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59)
>  registry_access_check: using root's token
>[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000.
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f
>  se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026
>[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (f003f) granted.
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(592)
>  regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\WINS] 
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(279)
>  regdb_close: decrementing refcount (2)
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(248)
>  regdb_open: incrementing refcount (2)
>[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359)
>  regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\WINS\Security]
>[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95)
>  reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/WINS/Security]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341)
>  pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/WINS/Security]
>[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413)
>  pathtree_find: Exit
>[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59)
>  registry_access_check: using root's token
>[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000.
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f
>  se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026
>[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (f003f) granted.
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(84)
>  000000 sec_io_desc sec_desc
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>      0000 revision : 0001
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>      0002 type     : 8004
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      0004 off_owner_sid: 00000000
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      0008 off_grp_sid  : 00000000
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      000c off_sacl     : 00000000
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>      0010 off_dacl     : 00000014
>[2006/05/09 08:51:57, 6] rpc_parse/parse_prs.c:(84)
>      000014 sec_io_acl dacl
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>          0014 revision: 0002
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>          0018 num_aces : 00000004
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          00001c sec_io_ace ace_list[00]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              001c type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              001d flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000020 sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  0020 mask: 0002018d
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000024 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0024 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0025 num_auths  : 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0026 id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0027 id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0028 id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0029 id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  002a id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  002b id_auth[5] : 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  002c sub_auths : 00000000 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              001e size : 0014
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          000030 sec_io_ace ace_list[01]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0030 type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0031 flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000034 sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  0034 mask: 000201fd
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000038 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0038 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0039 num_auths  : 02
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003a id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003b id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003c id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003d id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003e id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  003f id_auth[5] : 05
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  0040 sub_auths : 00000020 00000223 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              0032 size : 0018
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          000048 sec_io_ace ace_list[02]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0048 type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0049 flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              00004c sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  004c mask: 000f01ff
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000050 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0050 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0051 num_auths  : 02
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0052 id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0053 id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0054 id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0055 id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0056 id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0057 id_auth[5] : 05
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  0058 sub_auths : 00000020 00000225 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              004a size : 0018
>[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84)
>          000060 sec_io_ace ace_list[03]: 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0060 type : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>              0061 flags: 00
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000064 sec_io_access info 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703)
>                  0064 mask: 000f01ff
>[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84)
>              000068 smb_io_dom_sid trustee  
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0068 sid_rev_num: 01
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  0069 num_auths  : 02
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006a id_auth[0] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006b id_auth[1] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006c id_auth[2] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006d id_auth[3] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006e id_auth[4] : 00
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614)
>                  006f id_auth[5] : 05
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959)
>                  0070 sub_auths : 00000020 00000220 
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>              0062 size : 0018
>[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674)
>          0016 size     : 0064
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(592)
>  regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\WINS\Security] 
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(279)
>  regdb_close: decrementing refcount (2)
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(279)
>  regdb_close: decrementing refcount (1)
>[2006/05/09 08:51:57, 10] registry/reg_db.c:(279)
>  regdb_close: decrementing refcount (0)
>[2006/05/09 08:51:57, 10] printing/nt_printing.c:(689)
>  update_c_setprinter: c_setprinter = 0
>[2006/05/09 08:51:57, 5] smbd/connection.c:(170)
>  claiming  0
>[2006/05/09 08:51:57, 3] printing/printing.c:(1379)
>  start_background_queue: Starting background LPQ thread
>[2006/05/09 08:51:57, 10] lib/util_sock.c:(835)
>  bind succeeded on port 445
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_KEEPALIVE = 8
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_REUSEADDR = 4
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_BROADCAST = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_NODELAY = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPCNT = 8
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPIDLE = 7200
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPINTVL = 75
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option IPTOS_LOWDELAY = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option IPTOS_THROUGHPUT = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_REUSEPORT = 512
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_SNDBUF = 61440
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_RCVBUF = 61440
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_SNDLOWAT = 8192
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_RCVLOWAT = 1
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_SNDTIMEO = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_RCVTIMEO = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_KEEPALIVE = 8
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_REUSEADDR = 4
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_BROADCAST = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_NODELAY = 4
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPCNT = 8
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPIDLE = 7200
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPINTVL = 75
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option IPTOS_LOWDELAY = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option IPTOS_THROUGHPUT = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_REUSEPORT = 512
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_SNDBUF = 61440
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_RCVBUF = 61440
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_SNDLOWAT = 8192
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_RCVLOWAT = 1
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_SNDTIMEO = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_RCVTIMEO = 0
>[2006/05/09 08:51:57, 10] lib/util_sock.c:(835)
>  bind succeeded on port 139
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_KEEPALIVE = 8
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_REUSEADDR = 4
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_BROADCAST = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_NODELAY = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPCNT = 8
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPIDLE = 7200
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPINTVL = 75
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option IPTOS_LOWDELAY = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option IPTOS_THROUGHPUT = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_REUSEPORT = 512
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_SNDBUF = 61440
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_RCVBUF = 61440
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_SNDLOWAT = 8192
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_RCVLOWAT = 1
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_SNDTIMEO = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_RCVTIMEO = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_KEEPALIVE = 8
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_REUSEADDR = 4
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_BROADCAST = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_NODELAY = 4
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPCNT = 8
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPIDLE = 7200
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPINTVL = 75
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option IPTOS_LOWDELAY = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option IPTOS_THROUGHPUT = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_REUSEPORT = 512
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_SNDBUF = 61440
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_RCVBUF = 61440
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_SNDLOWAT = 8192
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_RCVLOWAT = 1
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_SNDTIMEO = 0
>[2006/05/09 08:51:57, 5] lib/util_sock.c:(206)
>  socket option SO_RCVTIMEO = 0
>[2006/05/09 08:51:57, 2] smbd/server.c:(336)
>  waiting for a connection
>[2006/05/09 08:51:57, 5] printing/printing.c:(1389)
>  start_background_queue: background LPQ thread started
>[2006/05/09 08:51:57, 5] smbd/connection.c:(170)
>  claiming smbd lpq backend 0
>[2006/05/09 08:51:57, 5] printing/printing.c:(1400)
>  start_background_queue: background LPQ thread waiting for messages
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_KEEPALIVE = 8
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_REUSEADDR = 4
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_BROADCAST = 0
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option TCP_NODELAY = 0
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPCNT = 8
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPIDLE = 7200
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPINTVL = 75
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option IPTOS_LOWDELAY = 0
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option IPTOS_THROUGHPUT = 0
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_REUSEPORT = 512
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_SNDBUF = 61440
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_RCVBUF = 61440
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_SNDLOWAT = 536
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_RCVLOWAT = 1
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_SNDTIMEO = 0
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_RCVTIMEO = 0
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_KEEPALIVE = 8
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_REUSEADDR = 4
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_BROADCAST = 0
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option TCP_NODELAY = 4
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPCNT = 8
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPIDLE = 7200
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option TCP_KEEPINTVL = 75
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option IPTOS_LOWDELAY = 0
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option IPTOS_THROUGHPUT = 0
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_REUSEPORT = 512
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_SNDBUF = 61440
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_RCVBUF = 61440
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_SNDLOWAT = 536
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_RCVLOWAT = 1
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_SNDTIMEO = 0
>[2006/05/09 08:52:19, 5] lib/util_sock.c:(206)
>  socket option SO_RCVTIMEO = 0
>[2006/05/09 08:52:19, 6] param/loadparm.c:(2947)
>  lp_file_list_changed()
>  file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf  last mod_time: Tue May  9 08:51:35 2006
>  
>[2006/05/09 08:52:19, 3] smbd/oplock.c:(871)
>  open_oplock_ipc: initializing messages.
>[2006/05/09 08:52:19, 4] lib/time.c:(142)
>  TimeInit: Serverzone is -19800
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 133
>[2006/05/09 08:52:19, 3] lib/access.c:(291)
>  only_ipaddrs_in_list: list has non-ip address (.india.hp.com)
>[2006/05/09 08:52:19, 3] lib/access.c:(316)
>  check_access: hostnames in host allow/deny list.
>[2006/05/09 08:52:19, 2] lib/access.c:(322)
>  Allowed connection from nt218201.india.hp.com (15.76.218.201)
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x85
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 0 of length 137
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=133
>  smb_com=0x72
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51283
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=0
>  smb_mid=0
>  smt_wct=0
>  smb_bcc=98
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 02 50 43 20 4E 45 54 57  4F 52 4B 20 50 52 4F 47  .PC NETW ORK PROG
>  [010] 52 41 4D 20 31 2E 30 00  02 4C 41 4E 4D 41 4E 31  RAM 1.0. .LANMAN1
>  [020] 2E 30 00 02 57 69 6E 64  6F 77 73 20 66 6F 72 20  .0..Wind ows for 
>  [030] 57 6F 72 6B 67 72 6F 75  70 73 20 33 2E 31 61 00  Workgrou ps 3.1a.
>  [040] 02 4C 4D 31 2E 32 58 30  30 32 00 02 4C 41 4E 4D  .LM1.2X0 02..LANM
>  [050] 41 4E 32 2E 31 00 02 4E  54 20 4C 4D 20 30 2E 31  AN2.1..N T LM 0.1
>  [060] 32 00                                             2. 
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBnegprot (pid 404565) conn 0x0
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:19, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:19, 3] smbd/negprot.c:(486)
>  Requested protocol [PC NETWORK PROGRAM 1.0]
>[2006/05/09 08:52:19, 3] smbd/negprot.c:(486)
>  Requested protocol [LANMAN1.0]
>[2006/05/09 08:52:19, 3] smbd/negprot.c:(486)
>  Requested protocol [Windows for Workgroups 3.1a]
>[2006/05/09 08:52:19, 3] smbd/negprot.c:(486)
>  Requested protocol [LM1.2X002]
>[2006/05/09 08:52:19, 3] smbd/negprot.c:(486)
>  Requested protocol [LANMAN2.1]
>[2006/05/09 08:52:19, 3] smbd/negprot.c:(486)
>  Requested protocol [NT LM 0.12]
>[2006/05/09 08:52:19, 10] lib/util.c:(2033)
>  set_remote_arch: Client arch is 'Win2K'
>[2006/05/09 08:52:19, 6] param/loadparm.c:(2947)
>  lp_file_list_changed()
>  file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf  last mod_time: Tue May  9 08:51:35 2006
>  
>[2006/05/09 08:52:19, 5] smbd/connection.c:(170)
>  claiming  0
>[2006/05/09 08:52:19, 6] param/loadparm.c:(2947)
>  lp_file_list_changed()
>  file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf  last mod_time: Tue May  9 08:51:35 2006
>  
>[2006/05/09 08:52:19, 3] smbd/negprot.c:(357)
>  using SPNEGO
>[2006/05/09 08:52:19, 3] smbd/negprot.c:(579)
>  Selected protocol NT LM 0.12
>[2006/05/09 08:52:19, 5] smbd/negprot.c:(585)
>  negprot index=5
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=127
>  smb_com=0x72
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=0
>  smb_mid=0
>  smt_wct=17
>  smb_vwv[ 0]=    5 (0x5)
>  smb_vwv[ 1]=12803 (0x3203)
>  smb_vwv[ 2]=  256 (0x100)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=   65 (0x41)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  256 (0x100)
>  smb_vwv[ 7]=21760 (0x5500)
>  smb_vwv[ 8]= 1580 (0x62C)
>  smb_vwv[ 9]=64768 (0xFD00)
>  smb_vwv[10]=32995 (0x80E3)
>  smb_vwv[11]=32896 (0x8080)
>  smb_vwv[12]=12711 (0x31A7)
>  smb_vwv[13]= 6087 (0x17C7)
>  smb_vwv[14]=50803 (0xC673)
>  smb_vwv[15]=46593 (0xB601)
>  smb_vwv[16]=  254 (0xFE)
>  smb_bcc=58
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 63 68 65 76 79 00 00 00  00 00 00 00 00 00 00 00  chevy... ........
>  [010] 60 28 06 06 2B 06 01 05  05 02 A0 1E 30 1C A0 0E  `(..+... ....0...
>  [020] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A3 0A  0...+... ..7.....
>  [030] 30 08 A0 06 1B 04 4E 4F  4E 45                    0.....NO NE
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 236
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0xec
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 1 of length 240
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=236
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=0
>  smb_mid=48000
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=  236 (0xEC)
>  smb_vwv[ 2]=16644 (0x4104)
>  smb_vwv[ 3]=   50 (0x32)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=   74 (0x4A)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=  212 (0xD4)
>  smb_vwv[11]=40960 (0xA000)
>  smb_bcc=177
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 60 48 06 06 2B 06 01 05  05 02 A0 3E 30 3C A0 0E  `H..+... ...>0<..
>  [010] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A2 2A  0...+... ..7....*
>  [020] 04 28 4E 54 4C 4D 53 53  50 00 01 00 00 00 97 82  .(NTLMSS P.......
>  [030] 08 E2 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [040] 00 00 05 01 28 0A 00 00  00 0F 00 57 00 69 00 6E  ....(... ...W.i.n
>  [050] 00 64 00 6F 00 77 00 73  00 20 00 32 00 30 00 30  .d.o.w.s . .2.0.0
>  [060] 00 32 00 20 00 53 00 65  00 72 00 76 00 69 00 63  .2. .S.e .r.v.i.c
>  [070] 00 65 00 20 00 50 00 61  00 63 00 6B 00 20 00 32  .e. .P.a .c.k. .2
>  [080] 00 20 00 32 00 36 00 30  00 30 00 00 00 57 00 69  . .2.6.0 .0...W.i
>  [090] 00 6E 00 64 00 6F 00 77  00 73 00 20 00 32 00 30  .n.d.o.w .s. .2.0
>  [0A0] 00 30 00 32 00 20 00 35  00 2E 00 31 00 00 00 00  .0.2. .5 ...1....
>  [0B0] 00                                                . 
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBsesssetupX (pid 404565) conn 0x0
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:19, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(822)
>  wct=12 flg2=0xc807
>[2006/05/09 08:52:19, 2] smbd/sesssetup.c:(772)
>  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
>[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(633)
>  Doing spnego session setup
>[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(663)
>  NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[]
>[2006/05/09 08:52:19, 10] lib/util.c:(2033)
>  set_remote_arch: Client arch is 'WinXP'
>[2006/05/09 08:52:19, 10] smbd/password.c:(182)
>  register_vuid: allocated vuid = 100
>[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(525)
>  Got OID 1 3 6 1 4 1 311 2 2 10
>[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(528)
>  Got secblob of size 40
>[2006/05/09 08:52:19, 5] auth/auth.c:(485)
>  Making default auth method list for standalone security=user, encrypt passwords = yes
>[2006/05/09 08:52:19, 5] auth/auth.c:(45)
>  Attempting to register auth backend rhosts
>[2006/05/09 08:52:19, 5] auth/auth.c:(57)
>  Successfully added auth method 'rhosts'
>[2006/05/09 08:52:19, 5] auth/auth.c:(45)
>  Attempting to register auth backend hostsequiv
>[2006/05/09 08:52:19, 5] auth/auth.c:(57)
>  Successfully added auth method 'hostsequiv'
>[2006/05/09 08:52:19, 5] auth/auth.c:(45)
>  Attempting to register auth backend sam
>[2006/05/09 08:52:19, 5] auth/auth.c:(57)
>  Successfully added auth method 'sam'
>[2006/05/09 08:52:19, 5] auth/auth.c:(45)
>  Attempting to register auth backend sam_ignoredomain
>[2006/05/09 08:52:19, 5] auth/auth.c:(57)
>  Successfully added auth method 'sam_ignoredomain'
>[2006/05/09 08:52:19, 5] auth/auth.c:(45)
>  Attempting to register auth backend unix
>[2006/05/09 08:52:19, 5] auth/auth.c:(57)
>  Successfully added auth method 'unix'
>[2006/05/09 08:52:19, 5] auth/auth.c:(45)
>  Attempting to register auth backend winbind
>[2006/05/09 08:52:19, 5] auth/auth.c:(57)
>  Successfully added auth method 'winbind'
>[2006/05/09 08:52:19, 5] auth/auth.c:(45)
>  Attempting to register auth backend smbserver
>[2006/05/09 08:52:19, 5] auth/auth.c:(57)
>  Successfully added auth method 'smbserver'
>[2006/05/09 08:52:19, 5] auth/auth.c:(45)
>  Attempting to register auth backend trustdomain
>[2006/05/09 08:52:19, 5] auth/auth.c:(57)
>  Successfully added auth method 'trustdomain'
>[2006/05/09 08:52:19, 5] auth/auth.c:(45)
>  Attempting to register auth backend ntdomain
>[2006/05/09 08:52:19, 5] auth/auth.c:(57)
>  Successfully added auth method 'ntdomain'
>[2006/05/09 08:52:19, 5] auth/auth.c:(45)
>  Attempting to register auth backend guest
>[2006/05/09 08:52:19, 5] auth/auth.c:(57)
>  Successfully added auth method 'guest'
>[2006/05/09 08:52:19, 5] auth/auth.c:(388)
>  load_auth_module: Attempting to find an auth method to match guest
>[2006/05/09 08:52:19, 5] auth/auth.c:(413)
>  load_auth_module: auth method guest has a valid init
>[2006/05/09 08:52:19, 5] auth/auth.c:(388)
>  load_auth_module: Attempting to find an auth method to match sam
>[2006/05/09 08:52:19, 5] auth/auth.c:(413)
>  load_auth_module: auth method sam has a valid init
>[2006/05/09 08:52:19, 3] libsmb/ntlmssp.c:(63)
>  Got NTLMSSP neg_flags=0xe2088297
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_NEGOTIATE_OEM
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_LM_KEY
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>    NTLMSSP_NEGOTIATE_56
>[2006/05/09 08:52:19, 5] auth/auth.c:(95)
>  auth_get_challenge: module guest did not want to specify a challenge
>[2006/05/09 08:52:19, 5] auth/auth.c:(95)
>  auth_get_challenge: module sam did not want to specify a challenge
>[2006/05/09 08:52:19, 5] auth/auth.c:(135)
>  auth_context challenge created by random
>[2006/05/09 08:52:19, 5] auth/auth.c:(136)
>  challenge is: 
>[2006/05/09 08:52:19, 5] lib/util.c:(2058)
>  [000] BD E8 AC 7D BD 2D 5F F8                           ...}.-_. 
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=290
>  smb_com=0x73
>  smb_rcls=22
>  smb_reh=0
>  smb_err=49152
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=48000
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=  189 (0xBD)
>  smb_bcc=247
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] A1 81 BA 30 81 B7 A0 03  0A 01 01 A1 0C 06 0A 2B  ...0.... .......+
>  [010] 06 01 04 01 82 37 02 02  0A A2 81 A1 04 81 9E 4E  .....7.. .......N
>  [020] 54 4C 4D 53 53 50 00 02  00 00 00 0A 00 0A 00 30  TLMSSP.. .......0
>  [030] 00 00 00 B5 82 8A 60 BD  E8 AC 7D BD 2D 5F F8 00  ......`. ..}.-_..
>  [040] 00 00 00 00 00 00 00 64  00 64 00 3A 00 00 00 43  .......d .d.:...C
>  [050] 00 48 00 45 00 56 00 59  00 02 00 0A 00 43 00 48  .H.E.V.Y .....C.H
>  [060] 00 45 00 56 00 59 00 01  00 0A 00 43 00 48 00 45  .E.V.Y.. ...C.H.E
>  [070] 00 56 00 59 00 04 00 18  00 69 00 6E 00 64 00 69  .V.Y.... .i.n.d.i
>  [080] 00 61 00 2E 00 68 00 70  00 2E 00 63 00 6F 00 6D  .a...h.p ...c.o.m
>  [090] 00 03 00 24 00 63 00 68  00 65 00 76 00 79 00 2E  ...$.c.h .e.v.y..
>  [0A0] 00 69 00 6E 00 64 00 69  00 61 00 2E 00 68 00 70  .i.n.d.i .a...h.p
>  [0B0] 00 2E 00 63 00 6F 00 6D  00 00 00 00 00 55 00 6E  ...c.o.m .....U.n
>  [0C0] 00 69 00 78 00 00 00 53  00 61 00 6D 00 62 00 61  .i.x...S .a.m.b.a
>  [0D0] 00 20 00 33 00 2E 00 30  00 2E 00 32 00 31 00 63  . .3...0 ...2.1.c
>  [0E0] 00 00 00 57 00 4F 00 52  00 4B 00 47 00 52 00 4F  ...W.O.R .K.G.R.O
>  [0F0] 00 55 00 50 00 00 00                              .U.P... 
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 358
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x166
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 2 of length 362
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=358
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=48064
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=  358 (0x166)
>  smb_vwv[ 2]=16644 (0x4104)
>  smb_vwv[ 3]=   50 (0x32)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=  196 (0xC4)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=  212 (0xD4)
>  smb_vwv[11]=40960 (0xA000)
>  smb_bcc=299
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] A1 81 C1 30 81 BE A2 81  BB 04 81 B8 4E 54 4C 4D  ...0.... ....NTLM
>  [010] 53 53 50 00 03 00 00 00  18 00 18 00 78 00 00 00  SSP..... ....x...
>  [020] 18 00 18 00 90 00 00 00  16 00 16 00 48 00 00 00  ........ ....H...
>  [030] 0A 00 0A 00 5E 00 00 00  10 00 10 00 68 00 00 00  ....^... ....h...
>  [040] 10 00 10 00 A8 00 00 00  15 82 88 62 05 01 28 0A  ........ ...b..(.
>  [050] 00 00 00 0F 41 00 53 00  49 00 41 00 50 00 41 00  ....A.S. I.A.P.A.
>  [060] 43 00 49 00 46 00 49 00  43 00 70 00 61 00 76 00  C.I.F.I. C.p.a.v.
>  [070] 61 00 6E 00 4E 00 54 00  32 00 31 00 38 00 32 00  a.n.N.T. 2.1.8.2.
>  [080] 30 00 31 00 DC 61 60 1C  65 FB 38 FC 00 00 00 00  0.1..a`. e.8.....
>  [090] 00 00 00 00 00 00 00 00  00 00 00 00 3E 8F 59 A6  ........ ....>.Y.
>  [0A0] FE C9 4E E3 3E BE A4 13  9D 32 AB 5D 77 AB 70 C5  ..N.>... .2.]w.p.
>  [0B0] 04 E4 13 E5 FD 9E 8B D6  01 08 CD B9 5A 7C 56 EE  ........ ....Z|V.
>  [0C0] 4A 67 BB 91 00 57 00 69  00 6E 00 64 00 6F 00 77  Jg...W.i .n.d.o.w
>  [0D0] 00 73 00 20 00 32 00 30  00 30 00 32 00 20 00 53  .s. .2.0 .0.2. .S
>  [0E0] 00 65 00 72 00 76 00 69  00 63 00 65 00 20 00 50  .e.r.v.i .c.e. .P
>  [0F0] 00 61 00 63 00 6B 00 20  00 32 00 20 00 32 00 36  .a.c.k.  .2. .2.6
>  [100] 00 30 00 30 00 00 00 57  00 69 00 6E 00 64 00 6F  .0.0...W .i.n.d.o
>  [110] 00 77 00 73 00 20 00 32  00 30 00 30 00 32 00 20  .w.s. .2 .0.0.2. 
>  [120] 00 35 00 2E 00 31 00 00  00 00 00                 .5...1.. ...
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBsesssetupX (pid 404565) conn 0x0
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:19, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(822)
>  wct=12 flg2=0xc807
>[2006/05/09 08:52:19, 2] smbd/sesssetup.c:(772)
>  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
>[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(633)
>  Doing spnego session setup
>[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(663)
>  NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[]
>[2006/05/09 08:52:19, 3] libsmb/ntlmssp.c:(661)
>  Got user=[pavan] domain=[ASIAPACIFIC] workstation=[NT218201] len1=24 len2=24
>[2006/05/09 08:52:19, 5] auth/auth_ntlmssp.c:(66)
>  auth_context challenge set by NTLMSSP callback (NTLM2)
>[2006/05/09 08:52:19, 5] auth/auth_ntlmssp.c:(67)
>  challenge is: 
>[2006/05/09 08:52:19, 5] lib/util.c:(2058)
>  [000] 30 67 A2 E8 9F 98 02 95                           0g...... 
>[2006/05/09 08:52:19, 6] param/loadparm.c:(2947)
>  lp_file_list_changed()
>  file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf  last mod_time: Tue May  9 08:51:35 2006
>  
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(162)
>  make_user_info_map: Mapping user [ASIAPACIFIC]\[pavan] from workstation [NT218201]
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(69)
>  attempting to make a user_info for pavan (pavan)
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(79)
>  making strings for pavan's user_info struct
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(121)
>  making blobs for pavan's user_info struct
>[2006/05/09 08:52:19, 10] auth/auth_util.c:(139)
>  made an encrypted user_info for pavan (pavan)
>[2006/05/09 08:52:19, 3] auth/auth.c:(218)
>  check_ntlm_password:  Checking password for unmapped user [ASIAPACIFIC]\[pavan]@[NT218201] with the new password interface
>[2006/05/09 08:52:19, 3] auth/auth.c:(221)
>  check_ntlm_password:  mapped user is: [CHEVY]\[pavan]@[NT218201]
>[2006/05/09 08:52:19, 10] auth/auth.c:(230)
>  check_ntlm_password: auth_context challenge created by NTLMSSP callback (NTLM2)
>[2006/05/09 08:52:19, 10] auth/auth.c:(233)
>  challenge is: 
>[2006/05/09 08:52:19, 5] lib/util.c:(2058)
>  [000] 30 67 A2 E8 9F 98 02 95                           0g...... 
>[2006/05/09 08:52:19, 10] auth/auth.c:(259)
>  check_ntlm_password: guest had nothing to say
>[2006/05/09 08:52:19, 8] lib/util.c:(1879)
>  is_myname("CHEVY") returns 1
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:19, 3] smbd/uid.c:(392)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:19, 10] passdb/pdb_smbpasswd.c:(1322)
>  getsampwnam (smbpasswd): search by name: pavan
>[2006/05/09 08:52:19, 10] passdb/pdb_smbpasswd.c:(184)
>  startsmbfilepwent_internal: opening file /usr/local/samba/private/smbpasswd
>[2006/05/09 08:52:19, 5] passdb/pdb_smbpasswd.c:(487)
>  getsmbfilepwent: returning passwd entry for user pavan, uid 205
>[2006/05/09 08:52:19, 7] passdb/pdb_smbpasswd.c:(301)
>  endsmbfilepwent_internal: closed password file.
>[2006/05/09 08:52:19, 10] passdb/pdb_smbpasswd.c:(1344)
>  getsampwnam (smbpasswd): found by name: pavan
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(616)
>  pdb_set_username: setting username pavan, was 
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(697)
>  pdb_set_full_name: setting full name pavan, was 
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(832)
>  pdb_set_unix_homedir: setting home dir /usr/users/pavan, was NULL
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(643)
>  pdb_set_domain: setting domain CHEVY, was 
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(543)
>  pdb_set_user_sid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-1410
>[2006/05/09 08:52:19, 10] passdb/pdb_compat.c:(72)
>  pdb_set_user_sid_from_rid:
>  	setting user sid S-1-5-21-4112424572-1378032116-4237619202-1410 from rid 1410
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
>[2006/05/09 08:52:19, 3] smbd/uid.c:(392)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(579)
>  pdb_set_group_sid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-1031
>[2006/05/09 08:52:19, 10] passdb/pdb_compat.c:(99)
>  pdb_set_group_sid_from_rid:
>  	setting group sid S-1-5-21-4112424572-1378032116-4237619202-1031 from rid 1031
>[2006/05/09 08:52:19, 4] lib/substitute.c:(359)
>  Home server: chevy
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(751)
>  pdb_set_profile_path: setting profile path \\chevy\pavan\profile, was 
>[2006/05/09 08:52:19, 4] lib/substitute.c:(359)
>  Home server: chevy
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(805)
>  pdb_set_homedir: setting home dir \\chevy\pavan, was 
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(778)
>  pdb_set_dir_drive: setting dir drive , was NULL
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(724)
>  pdb_set_logon_script: setting logon script , was 
>[2006/05/09 08:52:19, 10] lib/account_pol.c:(332)
>  account_policy_get: name: password history, val: 0
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(616)
>  pdb_set_username: setting username pavan, was 
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(643)
>  pdb_set_domain: setting domain CHEVY, was 
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(670)
>  pdb_set_nt_username: setting nt username , was 
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(697)
>  pdb_set_full_name: setting full name pavan, was 
>[2006/05/09 08:52:19, 4] lib/substitute.c:(359)
>  Home server: chevy
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(805)
>  pdb_set_homedir: setting home dir \\chevy\pavan, was 
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(778)
>  pdb_set_dir_drive: setting dir drive , was NULL
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(724)
>  pdb_set_logon_script: setting logon script , was 
>[2006/05/09 08:52:19, 4] lib/substitute.c:(359)
>  Home server: chevy
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(751)
>  pdb_set_profile_path: setting profile path \\chevy\pavan\profile, was 
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(884)
>  pdb_set_workstations: setting workstations , was 
>[2006/05/09 08:52:19, 10] lib/account_pol.c:(332)
>  account_policy_get: name: password history, val: 0
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(543)
>  pdb_set_user_sid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-1410
>[2006/05/09 08:52:19, 10] passdb/pdb_compat.c:(72)
>  pdb_set_user_sid_from_rid:
>  	setting user sid S-1-5-21-4112424572-1378032116-4237619202-1410 from rid 1410
>[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(579)
>  pdb_set_group_sid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-1031
>[2006/05/09 08:52:19, 10] passdb/pdb_compat.c:(99)
>  pdb_set_group_sid_from_rid:
>  	setting group sid S-1-5-21-4112424572-1378032116-4237619202-1031 from rid 1031
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 9] passdb/passdb.c:(2337)
>  pdb_update_autolock_flag: Account pavan not autolocked, no check needed
>[2006/05/09 08:52:19, 4] libsmb/ntlm_check.c:(326)
>  ntlm_password_check: Checking NT MD4 password
>[2006/05/09 08:52:19, 4] auth/auth_sam.c:(123)
>  sam_account_ok: Checking SMB password for user pavan
>[2006/05/09 08:52:19, 5] auth/auth_sam.c:(104)
>  logon_hours_ok: user pavan allowed to logon at this time (Tue May  9 08:52:19 2006
>  )
>[2006/05/09 08:52:19, 10] lib/util_pw.c:(98)
>  Got pavan from pwnam_cache
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:19, 3] smbd/uid.c:(392)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:19, 10] lib/system_smbd.c:(167)
>  sys_getgrouplist: user [pavan]
>[2006/05/09 08:52:19, 10] lib/system_smbd.c:(175)
>  sys_getgrouplist(): disabled winbindd for group lookup [user == pavan]
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
>[2006/05/09 08:52:19, 3] smbd/uid.c:(392)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:19, 8] lib/system_smbd.c:(49)
>  remove_duplicate_gids: Enter 2 gids
>[2006/05/09 08:52:19, 8] lib/system_smbd.c:(67)
>  remove_duplicate_gids: Exit 1 gids
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
>[2006/05/09 08:52:19, 3] smbd/uid.c:(392)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:19, 10] passdb/passdb.c:(1244)
>  local_gid_to_sid: Fall back to algorithmic mapping: 15 -> S-1-5-21-4112424572-1378032116-4237619202-1031
>[2006/05/09 08:52:19, 10] passdb/lookup_sid.c:(406)
>  gid_to_sid: local 15 -> S-1-5-21-4112424572-1378032116-4237619202-1031
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 10] auth/auth_util.c:(437)
>  NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410
>  contains 5 SIDs
>  SID[  0]: S-1-5-21-4112424572-1378032116-4237619202-1410
>  SID[  1]: S-1-5-21-4112424572-1378032116-4237619202-1031
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(896)
>  make_server_info_sam: made server info for user pavan -> pavan
>[2006/05/09 08:52:19, 3] auth/auth.c:(267)
>  check_ntlm_password: sam authentication for user [pavan] succeeded
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:19, 3] smbd/uid.c:(392)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 5] auth/auth.c:(293)
>  check_ntlm_password:  PAM Account for user [pavan] succeeded
>[2006/05/09 08:52:19, 2] auth/auth.c:(302)
>  check_ntlm_password:  authentication for user [pavan] -> [pavan] -> [pavan] succeeded
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(1485)
>  attempting to free (and zero) a user_info structure
>[2006/05/09 08:52:19, 10] auth/auth_util.c:(1488)
>  structure was created for pavan
>[2006/05/09 08:52:19, 10] auth/auth_ntlmssp.c:(119)
>  Got NT session key of length 16
>[2006/05/09 08:52:19, 10] auth/auth_ntlmssp.c:(126)
>  Got LM session key of length 16
>[2006/05/09 08:52:19, 10] libsmb/ntlmssp.c:(728)
>  ntlmssp_server_auth: Created NTLM2 session key.
>[2006/05/09 08:52:19, 3] libsmb/ntlmssp_sign.c:(338)
>  NTLMSSP Sign/Seal - Initialising with flags:
>[2006/05/09 08:52:19, 3] libsmb/ntlmssp.c:(63)
>  Got NTLMSSP neg_flags=0x60088235
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_SEAL
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2006/05/09 08:52:19, 10] smbd/password.c:(182)
>  register_vuid: allocated vuid = 101
>[2006/05/09 08:52:19, 10] smbd/password.c:(252)
>  register_vuid: (205,15) pavan pavan CHEVY guest=0
>[2006/05/09 08:52:19, 3] smbd/password.c:(257)
>  User name: pavan	Real name: pavan
>[2006/05/09 08:52:19, 3] smbd/password.c:(276)
>  UNIX uid 205 is UNIX user pavan, and will be vuid 101
>[2006/05/09 08:52:19, 7] param/loadparm.c:(4343)
>  lp_servicenumber: couldn't find pavan
>[2006/05/09 08:52:19, 3] smbd/password.c:(304)
>  Adding homes service for user 'pavan' using home directory: '/usr/users/pavan'
>[2006/05/09 08:52:19, 8] param/loadparm.c:(2445)
>  add_a_service: Creating snum = 5 for pavan
>[2006/05/09 08:52:19, 10] param/loadparm.c:(2492)
>  hash_a_service: hashing index 5 for service name pavan
>[2006/05/09 08:52:19, 3] param/loadparm.c:(2538)
>  adding home's share [pavan] for user 'pavan' at '/usr/users/pavan'
>[2006/05/09 08:52:19, 6] param/loadparm.c:(2947)
>  lp_file_list_changed()
>  file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf  last mod_time: Tue May  9 08:51:35 2006
>  
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=110
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48064
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    9 (0x9)
>  smb_bcc=67
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] A1 07 30 05 A0 03 0A 01  00 55 00 6E 00 69 00 78  ..0..... .U.n.i.x
>  [010] 00 00 00 53 00 61 00 6D  00 62 00 61 00 20 00 33  ...S.a.m .b.a. .3
>  [020] 00 2E 00 30 00 2E 00 32  00 31 00 63 00 00 00 57  ...0...2 .1.c...W
>  [030] 00 4F 00 52 00 4B 00 47  00 52 00 4F 00 55 00 50  .O.R.K.G .R.O.U.P
>  [040] 00 00 00                                          ... 
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 76
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x4c
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 3 of length 80
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=76
>  smb_com=0x75
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48128
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=   76 (0x4C)
>  smb_vwv[ 2]=    8 (0x8)
>  smb_vwv[ 3]=    1 (0x1)
>  smb_bcc=33
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 00 5C 00 5C 00 43 00 48  00 45 00 56 00 59 00 5C  .\.\.C.H .E.V.Y.\
>  [010] 00 49 00 50 00 43 00 24  00 00 00 3F 3F 3F 3F 3F  .I.P.C.$ ...?????
>  [020] 00                                                . 
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBtconX (pid 404565) conn 0x0
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:19, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:19, 4] smbd/reply.c:(660)
>  Client requested device type [?????] for share [IPC$]
>[2006/05/09 08:52:19, 5] smbd/service.c:(860)
>  making a connection to 'normal' service ipc$
>[2006/05/09 08:52:19, 3] lib/access.c:(291)
>  only_ipaddrs_in_list: list has non-ip address (.india.hp.com)
>[2006/05/09 08:52:19, 3] lib/access.c:(316)
>  check_access: hostnames in host allow/deny list.
>[2006/05/09 08:52:19, 2] lib/access.c:(322)
>  Allowed connection from nt218201.india.hp.com (15.76.218.201)
>[2006/05/09 08:52:19, 5] lib/username.c:(290)
>  Finding user pavan
>[2006/05/09 08:52:19, 5] lib/username.c:(234)
>  Trying _Get_Pwnam(), username as lowercase is pavan
>[2006/05/09 08:52:19, 10] lib/util_pw.c:(98)
>  Got pavan from pwnam_cache
>[2006/05/09 08:52:19, 5] lib/username.c:(266)
>  Get_Pwnam_internals did find user [pavan]!
>[2006/05/09 08:52:19, 3] smbd/service.c:(488)
>  Connect path is '/tmp' for service [IPC$]
>[2006/05/09 08:52:19, 4] rpc_server/srv_srvsvc_nt.c:(240)
>  get_share_security: using default secdesc for IPC$
>[2006/05/09 08:52:19, 10] lib/util_seaccess.c:(175)
>  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
>[2006/05/09 08:52:19, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x00000002, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410.
>[2006/05/09 08:52:19, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:52:19, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2
>[2006/05/09 08:52:19, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (2) granted.
>[2006/05/09 08:52:19, 3] smbd/vfs.c:(216)
>  Initialising default vfs hooks
>[2006/05/09 08:52:19, 5] smbd/connection.c:(170)
>  claiming IPC$ 0
>[2006/05/09 08:52:19, 10] smbd/uid.c:(124)
>  is_share_read_only_for_user: share IPC$ is read-only for unix user pavan
>[2006/05/09 08:52:19, 4] rpc_server/srv_srvsvc_nt.c:(240)
>  get_share_security: using default secdesc for IPC$
>[2006/05/09 08:52:19, 10] lib/util_seaccess.c:(175)
>  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
>[2006/05/09 08:52:19, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x00000001, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410.
>[2006/05/09 08:52:19, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:52:19, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1
>[2006/05/09 08:52:19, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (1) granted.
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(437)
>  NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410
>  contains 5 SIDs
>  SID[  0]: S-1-5-21-4112424572-1378032116-4237619202-1410
>  SID[  1]: S-1-5-21-4112424572-1378032116-4237619202-1031
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 205
>  Primary group is 15 and contains 1 supplementary groups
>  Group[  0]: 15
>[2006/05/09 08:52:19, 5] smbd/uid.c:(308)
>  change_to_user uid=(0,205) gid=(0,15)
>[2006/05/09 08:52:19, 3] smbd/service.c:(693)
>  nt218201 (15.76.218.201) connect to service IPC$ initially as user pavan (uid=205, gid=15) (pid 404565)
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:19, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:19, 3] smbd/reply.c:(707)
>  tconX service=IPC$ 
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=48
>  smb_com=0x75
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48128
>  smt_wct=3
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    1 (0x1)
>  smb_bcc=7
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 49 50 43 00 00 00 00                              IPC.... 
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 100
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x64
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 4 of length 104
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=48192
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(437)
>  NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410
>  contains 5 SIDs
>  SID[  0]: S-1-5-21-4112424572-1378032116-4237619202-1410
>  SID[  1]: S-1-5-21-4112424572-1378032116-4237619202-1031
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:52:19, 5] auth/auth_util.c:(454)
>  UNIX token of user 205
>  Primary group is 15 and contains 1 supplementary groups
>  Group[  0]: 15
>[2006/05/09 08:52:19, 5] smbd/uid.c:(308)
>  change_to_user uid=(0,205) gid=(0,15)
>[2006/05/09 08:52:19, 4] smbd/vfs.c:(738)
>  vfs_ChDir to /tmp
>[2006/05/09 08:52:19, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2006/05/09 08:52:19, 4] smbd/nttrans.c:(330)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2006/05/09 08:52:19, 3] smbd/nttrans.c:(351)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(179)
>  Open pipe requested wkssvc (pipes_open=0)
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(285)
>  Create pipe requested wkssvc
>[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(92)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(362)
>  Created internal pipe wkssvc (pipes_open=0)
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(262)
>  Opened pipe wkssvc with handle 76be (pipes_open=1)
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name wkssvc pnum=76be
>[2006/05/09 08:52:19, 5] smbd/nttrans.c:(400)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=48192
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=48640 (0xBE00)
>  smb_vwv[ 3]=  374 (0x176)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 136
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x88
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 5 of length 140
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48256
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30398 (0x76BE)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] EE 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [010] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [020] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [030] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [040] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBwriteX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76be
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76be (pipes_open=1)
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76be name: wkssvc open: Yes len: 72
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 72
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0b
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0048
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 11
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1495)
>  api_pipe_bind_req: decode request. 1495
>[2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(1505)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_rb 
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 00000000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0008 num_contexts: 01
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000c context_id  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      000e num_transfer_syntaxes: 01
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      00000f smb_io_rpc_iface 
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          000010 smb_io_uuid uuid
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0010 data   : 6bffd098
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0014 data   : a112
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0016 data   : 3610
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              0018 data   : 98 33 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0020 version: 00000001
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000024 smb_io_rpc_iface 
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          000024 smb_io_uuid uuid
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0024 data   : 8a885d04
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0028 data   : 1ceb
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              002a data   : 11c9
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              002c data   : 9f e8 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              002e data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0034 version: 00000002
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1548)
>  api_pipe_bind_req: make response. 1548
>[2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(959)
>  check_bind_req for \PIPE\wkssvc
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\samr
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\NETLOGON
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\srvsvc
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\wkssvc
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_ba 
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 000053f0
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000008 smb_io_rpc_addr_str 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0008 len: 000d
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>          000a str: \PIPE\ntsvcs.
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000017 smb_io_rpc_results 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>          0018 num_results: 01
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          001c result     : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          001e reason     : 0000
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000020 smb_io_rpc_iface 
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          000020 smb_io_uuid uuid
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0020 data   : 8a885d04
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0024 data   : 1ceb
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0026 data   : 11c9
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              0028 data   : 9f e8 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              002a data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0030 version: 00000002
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0c
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0044
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 56
>[2006/05/09 08:52:19, 3] smbd/pipes.c:(207)
>  writeX-IPC pnum=76be nwritten=72
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=47
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48256
>  smt_wct=6
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   72 (0x48)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 59
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x3b
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 6 of length 63
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48320
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30398 (0x76BE)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBreadX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76be
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76be (pipes_open=1)
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76be name: wkssvc len: 1024
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1049)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2006/05/09 08:52:19, 3] smbd/pipes.c:(251)
>  readX-IPC pnum=76be min=1024 max=1024 nread=68
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=127
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48320
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=   68 (0x44)
>  smb_vwv[ 6]=   59 (0x3B)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=68
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 05 00 0C 03 10 00 00 00  44 00 00 00 01 00 00 00  ........ D.......
>  [010] B8 10 B8 10 F0 53 00 00  0D 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
>  [020] 6E 74 73 76 63 73 00 00  01 00 00 00 00 00 00 00  ntsvcs.. ........
>  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [040] 02 00 00 00                                       .... 
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 144
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x90
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 7 of length 148
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=48384
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30398 (0x76BE)
>  smb_bcc=77
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 10 E5 34 02 08 00 00  .$...... ...4....
>  [030] 00 00 00 00 00 08 00 00  00 5C 00 5C 00 63 00 68  ........ .\.\.c.h
>  [040] 00 65 00 76 00 79 00 00  00 64 00 00 00           .e.v.y.. .d...
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2006/05/09 08:52:19, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:19, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:19, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76be
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76be (pipes_open=1)
>[2006/05/09 08:52:19, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 76be)
>[2006/05/09 08:52:19, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d480 max_trans_reply: 1024
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76be name: wkssvc open: Yes len: 60
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 60
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 003c
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 00000024
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 0000
>[2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 74
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\wkssvc
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[0].fn == 12016d7f0
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 wks_io_q_query_info 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      0000 ptr_srv_name: 0234e510
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000004 smb_io_unistr2 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0004 uni_max_len: 00000008
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0008 offset     : 00000000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          000c uni_str_len: 00000008
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904)
>          0010 buffer     : \.\.c.h.e.v.y...
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0020 switch_value: 0064
>[2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(66)
>  _wks_query_info: 66
>[2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(40)
>  create_wks_info_100: 40
>[2006/05/09 08:52:19, 5] rpc_parse/parse_wks.c:(79)
>  Init WKS_INFO_100: 79
>[2006/05/09 08:52:19, 5] rpc_parse/parse_wks.c:(139)
>  init_wks_r_unknown_0: 139
>[2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(76)
>  _wks_query_info: 76
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 wks_io_r_query_info 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0000 switch_value: 0064
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      0004 ptr_1       : 00000001
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000008 wks_io_wks_info_100 inf
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0008 platform_id : 000001f4
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          000c ptr_compname: 00000001
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0010 ptr_lan_grp : 00000001
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0014 ver_major   : 00000004
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0018 ver_minor   : 00000009
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          00001c smb_io_unistr2 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              001c uni_max_len: 00000006
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0020 offset     : 00000000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0024 uni_str_len: 00000006
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904)
>              0028 buffer     : C.H.E.V.Y...
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          000034 smb_io_unistr2 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0034 uni_max_len: 0000000a
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0038 offset     : 00000000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              003c uni_str_len: 0000000a
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904)
>              0040 buffer     : W.O.R.K.G.R.O.U.P...
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(761)
>      0054 status      : NT_STATUS_OK
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called wkssvc successfully
>[2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 120
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 44
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76be name: wkssvc len: 1024
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 88.
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0070
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 00000058
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:19, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..112]
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=168
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=48384
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  112 (0x70)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  112 (0x70)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=113
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 70 00 00 00 01 00 00  ........ .p......
>  [010] 00 58 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .X...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 06 00 00  00 00 00 00 00 06 00 00  ........ ........
>  [040] 00 43 00 48 00 45 00 56  00 59 00 00 00 0A 00 00  .C.H.E.V .Y......
>  [050] 00 00 00 00 00 0A 00 00  00 57 00 4F 00 52 00 4B  ........ .W.O.R.K
>  [060] 00 47 00 52 00 4F 00 55  00 50 00 00 00 00 00 00  .G.R.O.U .P......
>  [070] 00                                                . 
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 8 of length 45
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48448
>  smt_wct=3
>  smb_vwv[ 0]=30398 (0x76BE)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76be
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76be (pipes_open=1)
>[2006/05/09 08:52:19, 5] smbd/pipes.c:(272)
>  reply_pipe_close: pnum:76be
>[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1165)
>  closed pipe name wkssvc pnum=76be (pipes_open=0)
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48448
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 100
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x64
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 9 of length 104
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=48512
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2006/05/09 08:52:19, 4] smbd/nttrans.c:(330)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2006/05/09 08:52:19, 3] smbd/nttrans.c:(351)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(179)
>  Open pipe requested srvsvc (pipes_open=0)
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(285)
>  Create pipe requested srvsvc
>[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(92)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(362)
>  Created internal pipe srvsvc (pipes_open=0)
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(262)
>  Opened pipe srvsvc with handle 76bf (pipes_open=1)
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name srvsvc pnum=76bf
>[2006/05/09 08:52:19, 5] smbd/nttrans.c:(400)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=48512
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=48896 (0xBF00)
>  smb_vwv[ 3]=  374 (0x176)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 136
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x88
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 10 of length 140
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48576
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30399 (0x76BF)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] EE 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [010] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [020] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [030] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [040] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBwriteX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76bf
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76bf (pipes_open=1)
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76bf name: srvsvc open: Yes len: 72
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 72
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0b
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0048
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 11
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1495)
>  api_pipe_bind_req: decode request. 1495
>[2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(1505)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_rb 
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 00000000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0008 num_contexts: 01
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000c context_id  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      000e num_transfer_syntaxes: 01
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      00000f smb_io_rpc_iface 
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          000010 smb_io_uuid uuid
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0010 data   : 4b324fc8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0014 data   : 1670
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0016 data   : 01d3
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              0018 data   : 12 78 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              001a data   : 5a 47 bf 6e e1 88 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0020 version: 00000003
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000024 smb_io_rpc_iface 
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          000024 smb_io_uuid uuid
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0024 data   : 8a885d04
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0028 data   : 1ceb
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              002a data   : 11c9
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              002c data   : 9f e8 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              002e data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0034 version: 00000002
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1548)
>  api_pipe_bind_req: make response. 1548
>[2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(959)
>  check_bind_req for \PIPE\srvsvc
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\samr
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\NETLOGON
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\srvsvc
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_ba 
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 000053f0
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000008 smb_io_rpc_addr_str 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0008 len: 000d
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>          000a str: \PIPE\ntsvcs.
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000017 smb_io_rpc_results 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>          0018 num_results: 01
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          001c result     : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          001e reason     : 0000
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000020 smb_io_rpc_iface 
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          000020 smb_io_uuid uuid
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0020 data   : 8a885d04
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0024 data   : 1ceb
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0026 data   : 11c9
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              0028 data   : 9f e8 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              002a data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0030 version: 00000002
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0c
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0044
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 56
>[2006/05/09 08:52:19, 3] smbd/pipes.c:(207)
>  writeX-IPC pnum=76bf nwritten=72
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=47
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48576
>  smt_wct=6
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   72 (0x48)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 59
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x3b
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 11 of length 63
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48640
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30399 (0x76BF)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBreadX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76bf
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76bf (pipes_open=1)
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76bf name: srvsvc len: 1024
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1049)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2006/05/09 08:52:19, 3] smbd/pipes.c:(251)
>  readX-IPC pnum=76bf min=1024 max=1024 nread=68
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=127
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48640
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=   68 (0x44)
>  smb_vwv[ 6]=   59 (0x3B)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=68
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 05 00 0C 03 10 00 00 00  44 00 00 00 01 00 00 00  ........ D.......
>  [010] B8 10 B8 10 F0 53 00 00  0D 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
>  [020] 6E 74 73 76 63 73 00 00  01 00 00 00 00 00 00 00  ntsvcs.. ........
>  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [040] 02 00 00 00                                       .... 
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 144
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x90
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 12 of length 148
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=48704
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30399 (0x76BF)
>  smb_bcc=77
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 15  00 10 E5 34 02 08 00 00  .$...... ...4....
>  [030] 00 00 00 00 00 08 00 00  00 5C 00 5C 00 63 00 68  ........ .\.\.c.h
>  [040] 00 65 00 76 00 79 00 00  00 65 00 00 00           .e.v.y.. .e...
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2006/05/09 08:52:19, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:19, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:19, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76bf
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76bf (pipes_open=1)
>[2006/05/09 08:52:19, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 76bf)
>[2006/05/09 08:52:19, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d480 max_trans_reply: 1024
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76bf name: srvsvc open: Yes len: 60
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 60
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 003c
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 00000024
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 0015
>[2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 74
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\srvsvc
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[11].fn == 12017a0c0
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 srv_io_q_net_srv_get_info 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      0000 ptr_srv_name  : 0234e510
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000004 smb_io_unistr2 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0004 uni_max_len: 00000008
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0008 offset     : 00000000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          000c uni_str_len: 00000008
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904)
>          0010 buffer     : \.\.c.h.e.v.y...
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      0020 switch_value  : 00000065
>[2006/05/09 08:52:19, 5] rpc_server/srv_srvsvc_nt.c:(1235)
>  srv_net_srv_get_info: 1235
>[2006/05/09 08:52:19, 5] rpc_parse/parse_srv.c:(2809)
>  init_srv_info_101
>[2006/05/09 08:52:19, 5] rpc_parse/parse_srv.c:(3044)
>  init_srv_r_net_srv_get_info
>[2006/05/09 08:52:19, 5] rpc_server/srv_srvsvc_nt.c:(1280)
>  srv_net_srv_get_info: 1280
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 srv_io_r_net_srv_get_info 
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000000 srv_io_info_ctr ctr
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0000 switch_value: 00000065
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0004 ptr_srv_ctr : 00000001
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          000008 srv_io_info_101 sv101
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0008 platform_id : 000001f4
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              000c ptr_name    : 00000001
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0010 ver_major   : 00000004
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0014 ver_minor   : 00000009
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0018 srv_type    : 00009a03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              001c ptr_comment : 00000001
>[2006/05/09 08:52:19, 8] rpc_parse/parse_prs.c:(84)
>              000020 smb_io_unistr2 uni_name    
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>                  0020 uni_max_len: 00000006
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>                  0024 offset     : 00000000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>                  0028 uni_str_len: 00000006
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904)
>                  002c buffer     : C.H.E.V.Y...
>[2006/05/09 08:52:19, 8] rpc_parse/parse_prs.c:(84)
>              000038 smb_io_unistr2 uni_comment 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>                  0038 uni_max_len: 0000000e
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>                  003c offset     : 00000000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>                  0040 uni_str_len: 0000000e
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904)
>                  0044 buffer     : S.a.m.b.a. .3...0...2.1.c...
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(791)
>      0060 status: WERR_OK
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called srvsvc successfully
>[2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 192
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 44
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76bf name: srvsvc len: 1024
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 100.
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 007c
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 00000064
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:19, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..124]
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=180
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=48704
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  124 (0x7C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  124 (0x7C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=125
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 7C 00 00 00 01 00 00  ........ .|......
>  [010] 00 64 00 00 00 00 00 00  00 65 00 00 00 01 00 00  .d...... .e......
>  [020] 00 F4 01 00 00 01 00 00  00 04 00 00 00 09 00 00  ........ ........
>  [030] 00 03 9A 00 00 01 00 00  00 06 00 00 00 00 00 00  ........ ........
>  [040] 00 06 00 00 00 43 00 48  00 45 00 56 00 59 00 00  .....C.H .E.V.Y..
>  [050] 00 0E 00 00 00 00 00 00  00 0E 00 00 00 53 00 61  ........ .....S.a
>  [060] 00 6D 00 62 00 61 00 20  00 33 00 2E 00 30 00 2E  .m.b.a.  .3...0..
>  [070] 00 32 00 31 00 63 00 00  00 00 00 00 00           .2.1.c.. .....
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 13 of length 45
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48768
>  smt_wct=3
>  smb_vwv[ 0]=30399 (0x76BF)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76bf
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76bf (pipes_open=1)
>[2006/05/09 08:52:19, 5] smbd/pipes.c:(272)
>  reply_pipe_close: pnum:76bf
>[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1165)
>  closed pipe name srvsvc pnum=76bf (pipes_open=0)
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48768
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 100
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x64
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 14 of length 104
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=48832
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2006/05/09 08:52:19, 4] smbd/nttrans.c:(330)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2006/05/09 08:52:19, 3] smbd/nttrans.c:(351)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(179)
>  Open pipe requested wkssvc (pipes_open=0)
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(285)
>  Create pipe requested wkssvc
>[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(92)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(362)
>  Created internal pipe wkssvc (pipes_open=0)
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(262)
>  Opened pipe wkssvc with handle 76c0 (pipes_open=1)
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name wkssvc pnum=76c0
>[2006/05/09 08:52:19, 5] smbd/nttrans.c:(400)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=48832
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=49152 (0xC000)
>  smb_vwv[ 3]=  374 (0x176)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 136
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x88
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 15 of length 140
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48896
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30400 (0x76C0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] EE 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [010] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [020] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [030] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [040] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBwriteX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c0
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76c0 (pipes_open=1)
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c0 name: wkssvc open: Yes len: 72
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 72
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0b
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0048
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 11
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1495)
>  api_pipe_bind_req: decode request. 1495
>[2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(1505)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_rb 
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 00000000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0008 num_contexts: 01
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000c context_id  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      000e num_transfer_syntaxes: 01
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      00000f smb_io_rpc_iface 
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          000010 smb_io_uuid uuid
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0010 data   : 6bffd098
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0014 data   : a112
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0016 data   : 3610
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              0018 data   : 98 33 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0020 version: 00000001
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000024 smb_io_rpc_iface 
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          000024 smb_io_uuid uuid
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0024 data   : 8a885d04
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0028 data   : 1ceb
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              002a data   : 11c9
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              002c data   : 9f e8 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              002e data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0034 version: 00000002
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1548)
>  api_pipe_bind_req: make response. 1548
>[2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(959)
>  check_bind_req for \PIPE\wkssvc
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\samr
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\NETLOGON
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\srvsvc
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\wkssvc
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_ba 
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 000053f0
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000008 smb_io_rpc_addr_str 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          0008 len: 000d
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>          000a str: \PIPE\ntsvcs.
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000017 smb_io_rpc_results 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>          0018 num_results: 01
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          001c result     : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>          001e reason     : 0000
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000020 smb_io_rpc_iface 
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          000020 smb_io_uuid uuid
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0020 data   : 8a885d04
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0024 data   : 1ceb
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>              0026 data   : 11c9
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              0028 data   : 9f e8 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819)
>              002a data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0030 version: 00000002
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0c
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0044
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 56
>[2006/05/09 08:52:19, 3] smbd/pipes.c:(207)
>  writeX-IPC pnum=76c0 nwritten=72
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=47
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48896
>  smt_wct=6
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   72 (0x48)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 59
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x3b
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 16 of length 63
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48960
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30400 (0x76C0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBreadX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c0
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76c0 (pipes_open=1)
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c0 name: wkssvc len: 1024
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1049)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2006/05/09 08:52:19, 3] smbd/pipes.c:(251)
>  readX-IPC pnum=76c0 min=1024 max=1024 nread=68
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=127
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=48960
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=   68 (0x44)
>  smb_vwv[ 6]=   59 (0x3B)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=68
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 05 00 0C 03 10 00 00 00  44 00 00 00 01 00 00 00  ........ D.......
>  [010] B8 10 B8 10 F0 53 00 00  0D 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
>  [020] 6E 74 73 76 63 73 00 00  01 00 00 00 00 00 00 00  ntsvcs.. ........
>  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [040] 02 00 00 00                                       .... 
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 144
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x90
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 17 of length 148
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=49024
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30400 (0x76C0)
>  smb_bcc=77
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 F0 E4 34 02 08 00 00  .$...... ...4....
>  [030] 00 00 00 00 00 08 00 00  00 5C 00 5C 00 63 00 68  ........ .\.\.c.h
>  [040] 00 65 00 76 00 79 00 00  00 64 00 00 00           .e.v.y.. .d...
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2006/05/09 08:52:19, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:19, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:19, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c0
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76c0 (pipes_open=1)
>[2006/05/09 08:52:19, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 76c0)
>[2006/05/09 08:52:19, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d480 max_trans_reply: 1024
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c0 name: wkssvc open: Yes len: 60
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 60
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 003c
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 00000024
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 0000
>[2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 74
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\wkssvc
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[0].fn == 12016d7f0
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 wks_io_q_query_info 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      0000 ptr_srv_name: 0234e4f0
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000004 smb_io_unistr2 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0004 uni_max_len: 00000008
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0008 offset     : 00000000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          000c uni_str_len: 00000008
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904)
>          0010 buffer     : \.\.c.h.e.v.y...
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0020 switch_value: 0064
>[2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(66)
>  _wks_query_info: 66
>[2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(40)
>  create_wks_info_100: 40
>[2006/05/09 08:52:19, 5] rpc_parse/parse_wks.c:(79)
>  Init WKS_INFO_100: 79
>[2006/05/09 08:52:19, 5] rpc_parse/parse_wks.c:(139)
>  init_wks_r_unknown_0: 139
>[2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(76)
>  _wks_query_info: 76
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 wks_io_r_query_info 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0000 switch_value: 0064
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      0004 ptr_1       : 00000001
>[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84)
>      000008 wks_io_wks_info_100 inf
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0008 platform_id : 000001f4
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          000c ptr_compname: 00000001
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0010 ptr_lan_grp : 00000001
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0014 ver_major   : 00000004
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>          0018 ver_minor   : 00000009
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          00001c smb_io_unistr2 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              001c uni_max_len: 00000006
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0020 offset     : 00000000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0024 uni_str_len: 00000006
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904)
>              0028 buffer     : C.H.E.V.Y...
>[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84)
>          000034 smb_io_unistr2 
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0034 uni_max_len: 0000000a
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              0038 offset     : 00000000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>              003c uni_str_len: 0000000a
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904)
>              0040 buffer     : W.O.R.K.G.R.O.U.P...
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(761)
>      0054 status      : NT_STATUS_OK
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called wkssvc successfully
>[2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 120
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 44
>[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c0 name: wkssvc len: 1024
>[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 88.
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0070
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 00000058
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:19, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..112]
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=168
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=49024
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  112 (0x70)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  112 (0x70)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=113
>[2006/05/09 08:52:19, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 70 00 00 00 01 00 00  ........ .p......
>  [010] 00 58 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .X...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 06 00 00  00 00 00 00 00 06 00 00  ........ ........
>  [040] 00 43 00 48 00 45 00 56  00 59 00 00 00 0A 00 00  .C.H.E.V .Y......
>  [050] 00 00 00 00 00 0A 00 00  00 57 00 4F 00 52 00 4B  ........ .W.O.R.K
>  [060] 00 47 00 52 00 4F 00 55  00 50 00 00 00 00 00 00  .G.R.O.U .P......
>  [070] 00                                                . 
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:19, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:19, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:19, 3] smbd/process.c:(1194)
>  Transaction 18 of length 45
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49088
>  smt_wct=3
>  smb_vwv[ 0]=30400 (0x76C0)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:19, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:19, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c0
>[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76c0 (pipes_open=1)
>[2006/05/09 08:52:19, 5] smbd/pipes.c:(272)
>  reply_pipe_close: pnum:76c0
>[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1165)
>  closed pipe name wkssvc pnum=76c0 (pipes_open=0)
>[2006/05/09 08:52:19, 5] lib/util.c:(454)
>[2006/05/09 08:52:19, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49088
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:19, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:19, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 100
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x64
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 19 of length 104
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=49152
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179)
>  Open pipe requested srvsvc (pipes_open=0)
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285)
>  Create pipe requested srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362)
>  Created internal pipe srvsvc (pipes_open=0)
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262)
>  Opened pipe srvsvc with handle 76c1 (pipes_open=1)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name srvsvc pnum=76c1
>[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=49152
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=49408 (0xC100)
>  smb_vwv[ 3]=  374 (0x176)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 136
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x88
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 20 of length 140
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49216
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30401 (0x76C1)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] EE 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [010] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [020] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [030] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [040] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBwriteX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c1
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76c1 (pipes_open=1)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c1 name: srvsvc open: Yes len: 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0b
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0048
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 11
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495)
>  api_pipe_bind_req: decode request. 1495
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_rb 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0008 num_contexts: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000c context_id  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      000e num_transfer_syntaxes: 01
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      00000f smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000010 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0010 data   : 4b324fc8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0014 data   : 1670
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0016 data   : 01d3
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0018 data   : 12 78 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              001a data   : 5a 47 bf 6e e1 88 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0020 version: 00000003
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000024 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000024 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0024 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0028 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              002a data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002c data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002e data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0034 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548)
>  api_pipe_bind_req: make response. 1548
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959)
>  check_bind_req for \PIPE\srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\samr
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\NETLOGON
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\srvsvc
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_ba 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 000053f0
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000008 smb_io_rpc_addr_str 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 len: 000d
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000a str: \PIPE\ntsvcs.
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000017 smb_io_rpc_results 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>          0018 num_results: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001c result     : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001e reason     : 0000
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000020 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000020 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0020 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0024 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0026 data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0028 data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002a data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0030 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0044
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 56
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(207)
>  writeX-IPC pnum=76c1 nwritten=72
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=47
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49216
>  smt_wct=6
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   72 (0x48)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 59
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x3b
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 21 of length 63
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49280
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30401 (0x76C1)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBreadX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c1
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76c1 (pipes_open=1)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c1 name: srvsvc len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(251)
>  readX-IPC pnum=76c1 min=1024 max=1024 nread=68
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=127
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49280
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=   68 (0x44)
>  smb_vwv[ 6]=   59 (0x3B)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=68
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 05 00 0C 03 10 00 00 00  44 00 00 00 01 00 00 00  ........ D.......
>  [010] B8 10 B8 10 F0 53 00 00  0D 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
>  [020] 6E 74 73 76 63 73 00 00  01 00 00 00 00 00 00 00  ntsvcs.. ........
>  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [040] 02 00 00 00                                       .... 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 168
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0xa8
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 22 of length 172
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=168
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=49344
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   84 (0x54)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   84 (0x54)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30401 (0x76C1)
>  smb_bcc=101
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 54 00 00 00 01 00 00  ........ .T......
>  [020] 00 3C 00 00 00 00 00 0F  00 44 98 03 00 08 00 00  .<...... .D......
>  [030] 00 00 00 00 00 08 00 00  00 5C 00 5C 00 63 00 68  ........ .\.\.c.h
>  [040] 00 65 00 76 00 79 00 00  00 01 00 00 00 01 00 00  .e.v.y.. ........
>  [050] 00 6C E1 7E 01 00 00 00  00 00 00 00 00 FF FF FF  .l.~.... ........
>  [060] FF 00 00 00 00                                    ..... 
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=84 params=0 setup=2
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c1
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76c1 (pipes_open=1)
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 76c1)
>[2006/05/09 08:52:20, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d480 max_trans_reply: 1024
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c1 name: srvsvc open: Yes len: 84
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 84
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 84
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 84, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 68
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 68
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0054
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 68
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 68, incoming data = 68
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 0000003c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 000f
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 74
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\srvsvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: srvsvc op 0xf - api_rpcTNP: rpc command: SRV_NET_SHARE_ENUM_ALL
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[3].fn == 12017a720
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 srv_io_q_net_share_enum 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 ptr_srv_name: 00039844
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000004 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 uni_max_len: 00000008
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0008 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          000c uni_str_len: 00000008
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>          0010 buffer     : \.\.c.h.e.v.y...
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000020 srv_io_srv_share_ctr share_ctr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0020 info_level: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0024 switch_value: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0028 ptr_share_info: 017ee16c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          002c num_entries: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0030 ptr_entries: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0034 preferred_len: ffffffff
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000038 smb_io_enum_hnd enum_hnd
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0038 ptr_hnd: 00000000
>[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1443)
>  _srv_net_share_enum: 1443
>[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(752)
>  init_srv_r_net_share_enum: 752
>[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(524)
>  init_srv_share_info_ctr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(142)
>  init_srv_share_info1: audit        0 Audited /bin directory
>[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(101)
>  init_srv_share_info1_str
>[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(142)
>  init_srv_share_info1: IPC$        3 IPC Service (Samba 3.0.21c)
>[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(101)
>  init_srv_share_info1_str
>[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(142)
>  init_srv_share_info1: ADMIN$        3 IPC Service (Samba 3.0.21c)
>[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(101)
>  init_srv_share_info1_str
>[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(142)
>  init_srv_share_info1: pavan        0 Home Directories
>[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(101)
>  init_srv_share_info1_str
>[2006/05/09 08:52:20, 5] rpc_parse/parse_misc.c:(159)
>  smb_io_enum_hnd
>[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1455)
>  _srv_net_share_enum: 1455
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 srv_io_r_net_share_enum 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 srv_io_srv_share_ctr share_ctr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0000 info_level: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 switch_value: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0008 ptr_share_info: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          000c num_entries: 00000004
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0010 ptr_entries: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0014 num_entries2: 00000004
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000018 srv_io_share_info1 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0018 ptr_netname: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              001c type       : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0020 ptr_remark : 00000001
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000024 srv_io_share_info1 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0024 ptr_netname: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0028 type       : 00000003
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              002c ptr_remark : 00000001
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000030 srv_io_share_info1 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0030 ptr_netname: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0034 type       : 00000003
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0038 ptr_remark : 00000001
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          00003c srv_io_share_info1 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              003c ptr_netname: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0040 type       : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0044 ptr_remark : 00000001
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000048 srv_io_share_info1_str 
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              000048 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0048 uni_max_len: 00000006
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  004c offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0050 uni_str_len: 00000006
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  0054 buffer     : a.u.d.i.t...
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              000060 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0060 uni_max_len: 00000017
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0064 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0068 uni_str_len: 00000017
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  006c buffer     : A.u.d.i.t.e.d. ./.b.i.n. .d.i.r.e.c.t.o.r.y...
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          00009a srv_io_share_info1_str 
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              00009c smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  009c uni_max_len: 00000005
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  00a0 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  00a4 uni_str_len: 00000005
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  00a8 buffer     : I.P.C.$...
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              0000b4 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  00b4 uni_max_len: 0000001c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  00b8 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  00bc uni_str_len: 0000001c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  00c0 buffer     : I.P.C. .S.e.r.v.i.c.e. .(.S.a.m.b.a. .3...0...2.1.c.)...
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          0000f8 srv_io_share_info1_str 
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              0000f8 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  00f8 uni_max_len: 00000007
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  00fc offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0100 uni_str_len: 00000007
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  0104 buffer     : A.D.M.I.N.$...
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              000114 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0114 uni_max_len: 0000001c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0118 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  011c uni_str_len: 0000001c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  0120 buffer     : I.P.C. .S.e.r.v.i.c.e. .(.S.a.m.b.a. .3...0...2.1.c.)...
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000158 srv_io_share_info1_str 
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              000158 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0158 uni_max_len: 00000006
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  015c offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0160 uni_str_len: 00000006
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  0164 buffer     : p.a.v.a.n...
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              000170 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0170 uni_max_len: 00000011
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0174 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0178 uni_str_len: 00000011
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  017c buffer     : H.o.m.e. .D.i.r.e.c.t.o.r.i.e.s...
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      01a0 total_entries: 00000004
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      0001a4 smb_io_enum_hnd enum_hnd
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          01a4 ptr_hnd: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791)
>      01a8 status: WERR_OK
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called srvsvc successfully
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 544
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 68
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c1 name: srvsvc len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 428.
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 01c4
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 000001ac
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..452]
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=508
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=49344
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  452 (0x1C4)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  452 (0x1C4)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=453
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 C4 01 00 00 01 00 00  ........ ........
>  [010] 00 AC 01 00 00 00 00 00  00 01 00 00 00 01 00 00  ........ ........
>  [020] 00 01 00 00 00 04 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 01 00 00 00 00 00 00  00 01 00 00 00 01 00 00  ........ ........
>  [040] 00 03 00 00 00 01 00 00  00 01 00 00 00 03 00 00  ........ ........
>  [050] 00 01 00 00 00 01 00 00  00 00 00 00 00 01 00 00  ........ ........
>  [060] 00 06 00 00 00 00 00 00  00 06 00 00 00 61 00 75  ........ .....a.u
>  [070] 00 64 00 69 00 74 00 00  00 17 00 00 00 00 00 00  .d.i.t.. ........
>  [080] 00 17 00 00 00 41 00 75  00 64 00 69 00 74 00 65  .....A.u .d.i.t.e
>  [090] 00 64 00 20 00 2F 00 62  00 69 00 6E 00 20 00 64  .d. ./.b .i.n. .d
>  [0A0] 00 69 00 72 00 65 00 63  00 74 00 6F 00 72 00 79  .i.r.e.c .t.o.r.y
>  [0B0] 00 00 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [0C0] 00 49 00 50 00 43 00 24  00 00 00 00 00 1C 00 00  .I.P.C.$ ........
>  [0D0] 00 00 00 00 00 1C 00 00  00 49 00 50 00 43 00 20  ........ .I.P.C. 
>  [0E0] 00 53 00 65 00 72 00 76  00 69 00 63 00 65 00 20  .S.e.r.v .i.c.e. 
>  [0F0] 00 28 00 53 00 61 00 6D  00 62 00 61 00 20 00 33  .(.S.a.m .b.a. .3
>  [100] 00 2E 00 30 00 2E 00 32  00 31 00 63 00 29 00 00  ...0...2 .1.c.)..
>  [110] 00 07 00 00 00 00 00 00  00 07 00 00 00 41 00 44  ........ .....A.D
>  [120] 00 4D 00 49 00 4E 00 24  00 00 00 00 00 1C 00 00  .M.I.N.$ ........
>  [130] 00 00 00 00 00 1C 00 00  00 49 00 50 00 43 00 20  ........ .I.P.C. 
>  [140] 00 53 00 65 00 72 00 76  00 69 00 63 00 65 00 20  .S.e.r.v .i.c.e. 
>  [150] 00 28 00 53 00 61 00 6D  00 62 00 61 00 20 00 33  .(.S.a.m .b.a. .3
>  [160] 00 2E 00 30 00 2E 00 32  00 31 00 63 00 29 00 00  ...0...2 .1.c.)..
>  [170] 00 06 00 00 00 00 00 00  00 06 00 00 00 70 00 61  ........ .....p.a
>  [180] 00 76 00 61 00 6E 00 00  00 11 00 00 00 00 00 00  .v.a.n.. ........
>  [190] 00 11 00 00 00 48 00 6F  00 6D 00 65 00 20 00 44  .....H.o .m.e. .D
>  [1A0] 00 69 00 72 00 65 00 63  00 74 00 6F 00 72 00 69  .i.r.e.c .t.o.r.i
>  [1B0] 00 65 00 73 00 00 00 00  00 04 00 00 00 00 00 00  .e.s.... ........
>  [1C0] 00 00 00 00 00                                    ..... 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 23 of length 45
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49408
>  smt_wct=3
>  smb_vwv[ 0]=30401 (0x76C1)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c1
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76c1 (pipes_open=1)
>[2006/05/09 08:52:20, 5] smbd/pipes.c:(272)
>  reply_pipe_close: pnum:76c1
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165)
>  closed pipe name srvsvc pnum=76c1 (pipes_open=0)
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49408
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 102
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x66
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 24 of length 106
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=102
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=220
>  smb_uid=101
>  smb_mid=49472
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 4096 (0x1000)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  768 (0x300)
>  smb_bcc=19
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 73 00 70 00 6F  00 6F 00 6C 00 73 00 73  .\.s.p.o .o.l.s.s
>  [010] 00 00 00                                          ... 
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330)
>  nt_open_pipe: Opening pipe \spoolss.
>[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351)
>  nt_open_pipe: Known pipe spoolss opening.
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179)
>  Open pipe requested spoolss (pipes_open=0)
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285)
>  Create pipe requested spoolss
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77)
>  init_pipe_handles: created handle list for pipe spoolss
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe spoolss
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362)
>  Created internal pipe spoolss (pipes_open=0)
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262)
>  Opened pipe spoolss with handle 76c2 (pipes_open=1)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name spoolss pnum=76c2
>[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400)
>  do_ntcreate_pipe_open: open pipe = \spoolss
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=220
>  smb_uid=101
>  smb_mid=49472
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=49664 (0xC200)
>  smb_vwv[ 3]=  374 (0x176)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 136
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x88
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 25 of length 140
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49536
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30402 (0x76C2)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] EE 05 00 0B 03 10 00 00  00 48 00 00 00 17 00 00  ........ .H......
>  [010] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [020] 00 78 56 34 12 34 12 CD  AB EF 00 01 23 45 67 89  .xV4.4.. ....#Eg.
>  [030] AB 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [040] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBwriteX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c2
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=1)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c2 name: spoolss open: Yes len: 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0b
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0048
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000017
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 11
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495)
>  api_pipe_bind_req: decode request. 1495
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505)
>  api_pipe_bind_req: \PIPE\spoolss -> \PIPE\spoolss
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_rb 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0008 num_contexts: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000c context_id  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      000e num_transfer_syntaxes: 01
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      00000f smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000010 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0010 data   : 12345678
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0014 data   : 1234
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0016 data   : abcd
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0018 data   : ef 00 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              001a data   : 01 23 45 67 89 ab 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0020 version: 00000001
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000024 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000024 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0024 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0028 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              002a data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002c data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002e data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0034 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548)
>  api_pipe_bind_req: make response. 1548
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959)
>  check_bind_req for \PIPE\spoolss
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\samr
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\NETLOGON
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\wkssvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\winreg
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\spoolss
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_ba 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 000053f0
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000008 smb_io_rpc_addr_str 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 len: 000e
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000a str: \PIPE\spoolss.
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000018 smb_io_rpc_results 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>          0018 num_results: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001c result     : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001e reason     : 0000
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000020 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000020 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0020 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0024 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0026 data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0028 data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002a data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0030 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0044
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000017
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 56
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(207)
>  writeX-IPC pnum=76c2 nwritten=72
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=47
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49536
>  smt_wct=6
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   72 (0x48)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 59
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x3b
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 26 of length 63
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49600
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30402 (0x76C2)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBreadX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c2
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=1)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c2 name: spoolss len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049)
>  read_from_pipe: spoolss: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(251)
>  readX-IPC pnum=76c2 min=1024 max=1024 nread=68
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=127
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49600
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=   68 (0x44)
>  smb_vwv[ 6]=   59 (0x3B)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=68
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 05 00 0C 03 10 00 00 00  44 00 00 00 17 00 00 00  ........ D.......
>  [010] B8 10 B8 10 F0 53 00 00  0E 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
>  [020] 73 70 6F 6F 6C 73 73 00  01 00 00 00 00 00 00 00  spoolss. ........
>  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [040] 02 00 00 00                                       .... 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 262
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x106
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 27 of length 266
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=262
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=220
>  smb_uid=101
>  smb_mid=49664
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  178 (0xB2)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  178 (0xB2)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30402 (0x76C2)
>  smb_bcc=195
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 B2 00 00 00 17 00 00  ........ ........
>  [020] 00 9A 00 00 00 00 00 45  00 B8 FF 39 00 08 00 00  .......E ...9....
>  [030] 00 00 00 00 00 08 00 00  00 5C 00 5C 00 63 00 68  ........ .\.\.c.h
>  [040] 00 65 00 76 00 79 00 00  00 00 00 00 00 00 00 00  .e.v.y.. ........
>  [050] 00 00 00 00 00 00 00 00  00 01 00 00 00 01 00 00  ........ ........
>  [060] 00 1C F5 95 00 1C 00 00  00 C8 93 39 00 78 F5 95  ........ ...9.x..
>  [070] 00 28 0A 00 00 03 00 00  00 00 00 00 00 00 00 39  .(...... .......9
>  [080] 00 0B 00 00 00 00 00 00  00 0B 00 00 00 5C 00 5C  ........ .....\.\
>  [090] 00 4E 00 54 00 32 00 31  00 38 00 32 00 30 00 31  .N.T.2.1 .8.2.0.1
>  [0A0] 00 00 00 5C 00 09 00 00  00 00 00 00 00 09 00 00  ...\.... ........
>  [0B0] 00 6B 00 61 00 6D 00 61  00 6E 00 68 00 61 00 6C  .k.a.m.a .n.h.a.l
>  [0C0] 00 00 00                                          ... 
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=178 params=0 setup=2
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c2
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=1)
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 76c2)
>[2006/05/09 08:52:20, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d480 max_trans_reply: 1024
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c2 name: spoolss open: Yes len: 178
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 178
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 178
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 178, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 162
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 162
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 00b2
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000017
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 162
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 162, incoming data = 162
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 0000009a
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 0045
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 75
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\spoolss
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[1].fn == 120184250
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 spoolss_io_q_open_printer_ex 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 ptr: 0039ffb8
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000004 smb_io_unistr2 printername
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 uni_max_len: 00000008
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0008 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          000c uni_str_len: 00000008
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>          0010 buffer     : \.\.c.h.e.v.y...
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000020 spoolss_io_printer_default 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0020 datatype_ptr: 00000000
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000024 smb_io_unistr2 - NULL datatype
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000024 spoolss_io_devmode_cont 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0024 size: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0028 devmode_ptr: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          002c access_required: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0030 user_switch: 00000001
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000034 spool_io_user_level 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0034 level: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0038 ptr: 0095f51c
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          00003c  
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              003c size: 0000001c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0040 ptr: 003993c8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0044 ptr: 0095f578
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0048 build: 00000a28
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              004c major: 00000003
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0050 minor: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0054 processor: 00390000
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              000058 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0058 uni_max_len: 0000000b
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  005c offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0060 uni_str_len: 0000000b
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  0064 buffer     : \.\.N.T.2.1.8.2.0.1...
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              00007c smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  007c uni_max_len: 00000009
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0080 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0084 uni_str_len: 00000009
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  0088 buffer     : k.a.m.a.n.h.a.l...
>  checking name: \\chevy
>[2006/05/09 08:52:20, 10] rpc_server/srv_spoolss_nt.c:(556)
>  open_printer_hnd: name [\\chevy]
>[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(142)
>  Opened policy hnd[1] [000] 00 00 00 00 01 00 00 00  00 00 00 00 EC 0A 60 44  ........ ......`D
>  [010] 55 2C 06 00                                       U,.. 
>[2006/05/09 08:52:20, 3] rpc_server/srv_spoolss_nt.c:(416)
>  Setting printer type=\\chevy
>  Printer is a print server
>[2006/05/09 08:52:20, 4] rpc_server/srv_spoolss_nt.c:(452)
>  Setting printer name=\\chevy (len=7)
>[2006/05/09 08:52:20, 5] rpc_server/srv_spoolss_nt.c:(591)
>  1 printer handles active
>[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162)
>  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 EC 0A 60 44  ........ ......`D
>  [010] 55 2C 06 00                                       U,.. 
>[2006/05/09 08:52:20, 4] rpc_server/srv_spoolss_nt.c:(1638)
>  Setting print server access = SERVER_ACCESS_ENUMERATE
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 spoolss_io_r_open_printer_ex 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_pol_hnd printer handle
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0000 data1: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 data2: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 data3: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          000a data4: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000c data5: ec 0a 60 44 55 2c 06 00 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791)
>      0014 status code: WERR_OK
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called spoolss successfully
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 168
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 162
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c2 name: spoolss len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: spoolss: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0030
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000017
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 00000018
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=220
>  smb_uid=101
>  smb_mid=49664
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 17 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 01 00 00  ........ ........
>  [020] 00 00 00 00 00 EC 0A 60  44 55 2C 06 00 00 00 00  .......` DU,.....
>  [030] 00                                                . 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 128
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x80
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 28 of length 132
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=220
>  smb_uid=101
>  smb_mid=49728
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30402 (0x76C2)
>  smb_bcc=61
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 2C 00 00 00 18 00 00  ........ .,......
>  [020] 00 14 00 00 00 00 00 1D  00 00 00 00 00 01 00 00  ........ ........
>  [030] 00 00 00 00 00 EC 0A 60  44 55 2C 06 00           .......` DU,..
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c2
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=1)
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 76c2)
>[2006/05/09 08:52:20, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d480 max_trans_reply: 1024
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c2 name: spoolss open: Yes len: 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 28
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 002c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000018
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 28
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 00000014
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 001d
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 0
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\spoolss
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[3].fn == 120184930
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 spoolss_io_q_closeprinter 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_pol_hnd printer handle
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0000 data1: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 data2: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 data3: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          000a data4: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000c data5: ec 0a 60 44 55 2c 06 00 
>[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162)
>  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 EC 0A 60 44  ........ ......`D
>  [010] 55 2C 06 00                                       U,.. 
>[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162)
>  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 EC 0A 60 44  ........ ......`D
>  [010] 55 2C 06 00                                       U,.. 
>[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162)
>  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 EC 0A 60 44  ........ ......`D
>  [010] 55 2C 06 00                                       U,.. 
>[2006/05/09 08:52:20, 3] rpc_server/srv_lsa_hnd.c:(200)
>  Closed policy
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 spoolss_io_r_closeprinter 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_pol_hnd printer handle
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0000 data1: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 data2: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 data3: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          000a data4: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791)
>      0014 status: WERR_OK
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called spoolss successfully
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 28
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c2 name: spoolss len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: spoolss: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0030
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000018
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 00000018
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=220
>  smb_uid=101
>  smb_mid=49728
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 18 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [020] 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [030] 00                                                . 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 100
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x64
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 29 of length 104
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=49792
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179)
>  Open pipe requested wkssvc (pipes_open=1)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210)
>  open_rpc_pipe_p: name spoolss pnum=76c2
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285)
>  Create pipe requested wkssvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362)
>  Created internal pipe wkssvc (pipes_open=1)
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262)
>  Opened pipe wkssvc with handle 76c3 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name wkssvc pnum=76c3
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name spoolss pnum=76c2
>[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=49792
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=49920 (0xC300)
>  smb_vwv[ 3]=  374 (0x176)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 136
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x88
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 30 of length 140
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49856
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30403 (0x76C3)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] EE 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [010] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [020] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [030] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [040] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBwriteX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c3
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76c3 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c3 name: wkssvc open: Yes len: 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0b
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0048
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 11
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495)
>  api_pipe_bind_req: decode request. 1495
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_rb 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0008 num_contexts: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000c context_id  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      000e num_transfer_syntaxes: 01
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      00000f smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000010 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0010 data   : 6bffd098
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0014 data   : a112
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0016 data   : 3610
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0018 data   : 98 33 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0020 version: 00000001
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000024 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000024 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0024 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0028 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              002a data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002c data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002e data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0034 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548)
>  api_pipe_bind_req: make response. 1548
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959)
>  check_bind_req for \PIPE\wkssvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\samr
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\NETLOGON
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\wkssvc
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_ba 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 000053f0
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000008 smb_io_rpc_addr_str 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 len: 000d
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000a str: \PIPE\ntsvcs.
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000017 smb_io_rpc_results 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>          0018 num_results: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001c result     : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001e reason     : 0000
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000020 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000020 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0020 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0024 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0026 data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0028 data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002a data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0030 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0044
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 56
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(207)
>  writeX-IPC pnum=76c3 nwritten=72
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=47
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49856
>  smt_wct=6
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   72 (0x48)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 59
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x3b
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 31 of length 63
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49920
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30403 (0x76C3)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBreadX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c3
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76c3 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c3 name: wkssvc len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(251)
>  readX-IPC pnum=76c3 min=1024 max=1024 nread=68
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=127
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=49920
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=   68 (0x44)
>  smb_vwv[ 6]=   59 (0x3B)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=68
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 05 00 0C 03 10 00 00 00  44 00 00 00 01 00 00 00  ........ D.......
>  [010] B8 10 B8 10 F0 53 00 00  0D 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
>  [020] 6E 74 73 76 63 73 00 00  01 00 00 00 00 00 00 00  ntsvcs.. ........
>  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [040] 02 00 00 00                                       .... 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 144
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x90
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 32 of length 148
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=49984
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30403 (0x76C3)
>  smb_bcc=77
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 F0 DF 7E 01 08 00 00  .$...... ...~....
>  [030] 00 00 00 00 00 08 00 00  00 5C 00 5C 00 63 00 68  ........ .\.\.c.h
>  [040] 00 65 00 76 00 79 00 00  00 64 00 00 00           .e.v.y.. .d...
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c3
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76c3 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 76c3)
>[2006/05/09 08:52:20, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d900 max_trans_reply: 1024
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c3 name: wkssvc open: Yes len: 60
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 60
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 003c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 00000024
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 0000
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 74
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\wkssvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[0].fn == 12016d7f0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 wks_io_q_query_info 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 ptr_srv_name: 017edff0
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000004 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 uni_max_len: 00000008
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0008 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          000c uni_str_len: 00000008
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>          0010 buffer     : \.\.c.h.e.v.y...
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0020 switch_value: 0064
>[2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(66)
>  _wks_query_info: 66
>[2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(40)
>  create_wks_info_100: 40
>[2006/05/09 08:52:20, 5] rpc_parse/parse_wks.c:(79)
>  Init WKS_INFO_100: 79
>[2006/05/09 08:52:20, 5] rpc_parse/parse_wks.c:(139)
>  init_wks_r_unknown_0: 139
>[2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(76)
>  _wks_query_info: 76
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 wks_io_r_query_info 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0000 switch_value: 0064
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0004 ptr_1       : 00000001
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000008 wks_io_wks_info_100 inf
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0008 platform_id : 000001f4
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          000c ptr_compname: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0010 ptr_lan_grp : 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0014 ver_major   : 00000004
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0018 ver_minor   : 00000009
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          00001c smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              001c uni_max_len: 00000006
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0020 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0024 uni_str_len: 00000006
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>              0028 buffer     : C.H.E.V.Y...
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000034 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0034 uni_max_len: 0000000a
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0038 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              003c uni_str_len: 0000000a
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>              0040 buffer     : W.O.R.K.G.R.O.U.P...
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(761)
>      0054 status      : NT_STATUS_OK
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called wkssvc successfully
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 120
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 44
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c3 name: wkssvc len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 88.
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0070
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 00000058
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..112]
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=168
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=49984
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  112 (0x70)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  112 (0x70)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=113
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 70 00 00 00 01 00 00  ........ .p......
>  [010] 00 58 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .X...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 06 00 00  00 00 00 00 00 06 00 00  ........ ........
>  [040] 00 43 00 48 00 45 00 56  00 59 00 00 00 0A 00 00  .C.H.E.V .Y......
>  [050] 00 00 00 00 00 0A 00 00  00 57 00 4F 00 52 00 4B  ........ .W.O.R.K
>  [060] 00 47 00 52 00 4F 00 55  00 50 00 00 00 00 00 00  .G.R.O.U .P......
>  [070] 00                                                . 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 33 of length 45
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50048
>  smt_wct=3
>  smb_vwv[ 0]=30403 (0x76C3)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c3
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76c3 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 5] smbd/pipes.c:(272)
>  reply_pipe_close: pnum:76c3
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165)
>  closed pipe name wkssvc pnum=76c3 (pipes_open=1)
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50048
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 100
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x64
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 34 of length 104
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=50112
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179)
>  Open pipe requested srvsvc (pipes_open=1)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210)
>  open_rpc_pipe_p: name spoolss pnum=76c2
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285)
>  Create pipe requested srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362)
>  Created internal pipe srvsvc (pipes_open=1)
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262)
>  Opened pipe srvsvc with handle 76c4 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name srvsvc pnum=76c4
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name spoolss pnum=76c2
>[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=50112
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=50176 (0xC400)
>  smb_vwv[ 3]=  374 (0x176)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 136
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x88
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 35 of length 140
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50176
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30404 (0x76C4)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] EE 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [010] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [020] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [030] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [040] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBwriteX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c4
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76c4 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c4 name: srvsvc open: Yes len: 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0b
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0048
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 11
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495)
>  api_pipe_bind_req: decode request. 1495
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_rb 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0008 num_contexts: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000c context_id  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      000e num_transfer_syntaxes: 01
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      00000f smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000010 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0010 data   : 4b324fc8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0014 data   : 1670
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0016 data   : 01d3
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0018 data   : 12 78 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              001a data   : 5a 47 bf 6e e1 88 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0020 version: 00000003
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000024 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000024 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0024 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0028 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              002a data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002c data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002e data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0034 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548)
>  api_pipe_bind_req: make response. 1548
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959)
>  check_bind_req for \PIPE\srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\samr
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\NETLOGON
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\srvsvc
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_ba 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 000053f0
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000008 smb_io_rpc_addr_str 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 len: 000d
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000a str: \PIPE\ntsvcs.
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000017 smb_io_rpc_results 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>          0018 num_results: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001c result     : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001e reason     : 0000
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000020 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000020 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0020 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0024 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0026 data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0028 data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002a data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0030 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0044
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 56
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(207)
>  writeX-IPC pnum=76c4 nwritten=72
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=47
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50176
>  smt_wct=6
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   72 (0x48)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 59
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x3b
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 36 of length 63
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50240
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30404 (0x76C4)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBreadX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c4
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76c4 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c4 name: srvsvc len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(251)
>  readX-IPC pnum=76c4 min=1024 max=1024 nread=68
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=127
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50240
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=   68 (0x44)
>  smb_vwv[ 6]=   59 (0x3B)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=68
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 05 00 0C 03 10 00 00 00  44 00 00 00 01 00 00 00  ........ D.......
>  [010] B8 10 B8 10 F0 53 00 00  0D 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
>  [020] 6E 74 73 76 63 73 00 00  01 00 00 00 00 00 00 00  ntsvcs.. ........
>  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [040] 02 00 00 00                                       .... 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 144
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x90
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 37 of length 148
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=50304
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30404 (0x76C4)
>  smb_bcc=77
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 15  00 F0 DF 7E 01 08 00 00  .$...... ...~....
>  [030] 00 00 00 00 00 08 00 00  00 5C 00 5C 00 63 00 68  ........ .\.\.c.h
>  [040] 00 65 00 76 00 79 00 00  00 65 00 00 00           .e.v.y.. .e...
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c4
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76c4 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 76c4)
>[2006/05/09 08:52:20, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d900 max_trans_reply: 1024
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c4 name: srvsvc open: Yes len: 60
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 60
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 003c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 00000024
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 0015
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 74
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\srvsvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[11].fn == 12017a0c0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 srv_io_q_net_srv_get_info 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 ptr_srv_name  : 017edff0
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000004 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 uni_max_len: 00000008
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0008 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          000c uni_str_len: 00000008
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>          0010 buffer     : \.\.c.h.e.v.y...
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0020 switch_value  : 00000065
>[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1235)
>  srv_net_srv_get_info: 1235
>[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(2809)
>  init_srv_info_101
>[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(3044)
>  init_srv_r_net_srv_get_info
>[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1280)
>  srv_net_srv_get_info: 1280
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 srv_io_r_net_srv_get_info 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 srv_io_info_ctr ctr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0000 switch_value: 00000065
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 ptr_srv_ctr : 00000001
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000008 srv_io_info_101 sv101
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0008 platform_id : 000001f4
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              000c ptr_name    : 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0010 ver_major   : 00000004
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0014 ver_minor   : 00000009
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0018 srv_type    : 00009a03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              001c ptr_comment : 00000001
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              000020 smb_io_unistr2 uni_name    
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0020 uni_max_len: 00000006
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0024 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0028 uni_str_len: 00000006
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  002c buffer     : C.H.E.V.Y...
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              000038 smb_io_unistr2 uni_comment 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0038 uni_max_len: 0000000e
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  003c offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0040 uni_str_len: 0000000e
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  0044 buffer     : S.a.m.b.a. .3...0...2.1.c...
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791)
>      0060 status: WERR_OK
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called srvsvc successfully
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 192
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 44
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c4 name: srvsvc len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 100.
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 007c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 00000064
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..124]
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=180
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=50304
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  124 (0x7C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  124 (0x7C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=125
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 7C 00 00 00 01 00 00  ........ .|......
>  [010] 00 64 00 00 00 00 00 00  00 65 00 00 00 01 00 00  .d...... .e......
>  [020] 00 F4 01 00 00 01 00 00  00 04 00 00 00 09 00 00  ........ ........
>  [030] 00 03 9A 00 00 01 00 00  00 06 00 00 00 00 00 00  ........ ........
>  [040] 00 06 00 00 00 43 00 48  00 45 00 56 00 59 00 00  .....C.H .E.V.Y..
>  [050] 00 0E 00 00 00 00 00 00  00 0E 00 00 00 53 00 61  ........ .....S.a
>  [060] 00 6D 00 62 00 61 00 20  00 33 00 2E 00 30 00 2E  .m.b.a.  .3...0..
>  [070] 00 32 00 31 00 63 00 00  00 00 00 00 00           .2.1.c.. .....
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 38 of length 45
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50368
>  smt_wct=3
>  smb_vwv[ 0]=30404 (0x76C4)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c4
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76c4 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 5] smbd/pipes.c:(272)
>  reply_pipe_close: pnum:76c4
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165)
>  closed pipe name srvsvc pnum=76c4 (pipes_open=1)
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50368
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 100
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x64
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 39 of length 104
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=50432
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179)
>  Open pipe requested wkssvc (pipes_open=1)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210)
>  open_rpc_pipe_p: name spoolss pnum=76c2
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285)
>  Create pipe requested wkssvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362)
>  Created internal pipe wkssvc (pipes_open=1)
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262)
>  Opened pipe wkssvc with handle 76c5 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name wkssvc pnum=76c5
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name spoolss pnum=76c2
>[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=50432
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=50432 (0xC500)
>  smb_vwv[ 3]=  374 (0x176)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 136
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x88
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 40 of length 140
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50496
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30405 (0x76C5)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] EE 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [010] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [020] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [030] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [040] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBwriteX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c5
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76c5 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c5 name: wkssvc open: Yes len: 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0b
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0048
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 11
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495)
>  api_pipe_bind_req: decode request. 1495
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_rb 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0008 num_contexts: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000c context_id  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      000e num_transfer_syntaxes: 01
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      00000f smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000010 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0010 data   : 6bffd098
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0014 data   : a112
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0016 data   : 3610
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0018 data   : 98 33 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0020 version: 00000001
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000024 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000024 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0024 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0028 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              002a data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002c data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002e data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0034 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548)
>  api_pipe_bind_req: make response. 1548
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959)
>  check_bind_req for \PIPE\wkssvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\samr
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\NETLOGON
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\wkssvc
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_ba 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 000053f0
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000008 smb_io_rpc_addr_str 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 len: 000d
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000a str: \PIPE\ntsvcs.
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000017 smb_io_rpc_results 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>          0018 num_results: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001c result     : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001e reason     : 0000
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000020 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000020 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0020 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0024 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0026 data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0028 data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002a data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0030 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0044
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 56
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(207)
>  writeX-IPC pnum=76c5 nwritten=72
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=47
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50496
>  smt_wct=6
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   72 (0x48)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 59
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x3b
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 41 of length 63
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50560
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30405 (0x76C5)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBreadX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c5
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76c5 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c5 name: wkssvc len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(251)
>  readX-IPC pnum=76c5 min=1024 max=1024 nread=68
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=127
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50560
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=   68 (0x44)
>  smb_vwv[ 6]=   59 (0x3B)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=68
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 05 00 0C 03 10 00 00 00  44 00 00 00 01 00 00 00  ........ D.......
>  [010] B8 10 B8 10 F0 53 00 00  0D 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
>  [020] 6E 74 73 76 63 73 00 00  01 00 00 00 00 00 00 00  ntsvcs.. ........
>  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [040] 02 00 00 00                                       .... 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 144
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x90
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 42 of length 148
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=50624
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30405 (0x76C5)
>  smb_bcc=77
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 F0 DF 7E 01 08 00 00  .$...... ...~....
>  [030] 00 00 00 00 00 08 00 00  00 5C 00 5C 00 63 00 68  ........ .\.\.c.h
>  [040] 00 65 00 76 00 79 00 00  00 64 00 00 00           .e.v.y.. .d...
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c5
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76c5 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 76c5)
>[2006/05/09 08:52:20, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d900 max_trans_reply: 1024
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c5 name: wkssvc open: Yes len: 60
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 60
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 003c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 00000024
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 0000
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 74
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\wkssvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[0].fn == 12016d7f0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 wks_io_q_query_info 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 ptr_srv_name: 017edff0
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000004 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 uni_max_len: 00000008
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0008 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          000c uni_str_len: 00000008
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>          0010 buffer     : \.\.c.h.e.v.y...
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0020 switch_value: 0064
>[2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(66)
>  _wks_query_info: 66
>[2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(40)
>  create_wks_info_100: 40
>[2006/05/09 08:52:20, 5] rpc_parse/parse_wks.c:(79)
>  Init WKS_INFO_100: 79
>[2006/05/09 08:52:20, 5] rpc_parse/parse_wks.c:(139)
>  init_wks_r_unknown_0: 139
>[2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(76)
>  _wks_query_info: 76
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 wks_io_r_query_info 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0000 switch_value: 0064
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0004 ptr_1       : 00000001
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000008 wks_io_wks_info_100 inf
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0008 platform_id : 000001f4
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          000c ptr_compname: 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0010 ptr_lan_grp : 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0014 ver_major   : 00000004
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0018 ver_minor   : 00000009
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          00001c smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              001c uni_max_len: 00000006
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0020 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0024 uni_str_len: 00000006
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>              0028 buffer     : C.H.E.V.Y...
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000034 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0034 uni_max_len: 0000000a
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0038 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              003c uni_str_len: 0000000a
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>              0040 buffer     : W.O.R.K.G.R.O.U.P...
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(761)
>      0054 status      : NT_STATUS_OK
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called wkssvc successfully
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 120
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 44
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c5 name: wkssvc len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 88.
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0070
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 00000058
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..112]
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=168
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=50624
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  112 (0x70)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  112 (0x70)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=113
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 70 00 00 00 01 00 00  ........ .p......
>  [010] 00 58 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .X...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 06 00 00  00 00 00 00 00 06 00 00  ........ ........
>  [040] 00 43 00 48 00 45 00 56  00 59 00 00 00 0A 00 00  .C.H.E.V .Y......
>  [050] 00 00 00 00 00 0A 00 00  00 57 00 4F 00 52 00 4B  ........ .W.O.R.K
>  [060] 00 47 00 52 00 4F 00 55  00 50 00 00 00 00 00 00  .G.R.O.U .P......
>  [070] 00                                                . 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 43 of length 45
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50688
>  smt_wct=3
>  smb_vwv[ 0]=30405 (0x76C5)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c5
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name wkssvc pnum=76c5 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 5] smbd/pipes.c:(272)
>  reply_pipe_close: pnum:76c5
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165)
>  closed pipe name wkssvc pnum=76c5 (pipes_open=1)
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50688
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 100
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x64
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 44 of length 104
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=50752
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179)
>  Open pipe requested srvsvc (pipes_open=1)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210)
>  open_rpc_pipe_p: name spoolss pnum=76c2
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285)
>  Create pipe requested srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362)
>  Created internal pipe srvsvc (pipes_open=1)
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262)
>  Opened pipe srvsvc with handle 76c6 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name srvsvc pnum=76c6
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name spoolss pnum=76c2
>[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=50752
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=50688 (0xC600)
>  smb_vwv[ 3]=  374 (0x176)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 136
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x88
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 45 of length 140
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50816
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30406 (0x76C6)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] EE 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [010] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [020] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [030] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [040] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBwriteX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c6
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76c6 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c6 name: srvsvc open: Yes len: 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0b
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0048
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 11
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495)
>  api_pipe_bind_req: decode request. 1495
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_rb 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0008 num_contexts: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000c context_id  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      000e num_transfer_syntaxes: 01
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      00000f smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000010 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0010 data   : 4b324fc8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0014 data   : 1670
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0016 data   : 01d3
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0018 data   : 12 78 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              001a data   : 5a 47 bf 6e e1 88 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0020 version: 00000003
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000024 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000024 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0024 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0028 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              002a data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002c data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002e data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0034 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548)
>  api_pipe_bind_req: make response. 1548
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959)
>  check_bind_req for \PIPE\srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\samr
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\NETLOGON
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\srvsvc
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_ba 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 000053f0
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000008 smb_io_rpc_addr_str 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 len: 000d
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000a str: \PIPE\ntsvcs.
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000017 smb_io_rpc_results 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>          0018 num_results: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001c result     : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001e reason     : 0000
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000020 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000020 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0020 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0024 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0026 data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0028 data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002a data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0030 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0044
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 56
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(207)
>  writeX-IPC pnum=76c6 nwritten=72
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=47
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50816
>  smt_wct=6
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   72 (0x48)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 59
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x3b
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 46 of length 63
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50880
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30406 (0x76C6)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBreadX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c6
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76c6 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c6 name: srvsvc len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(251)
>  readX-IPC pnum=76c6 min=1024 max=1024 nread=68
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=127
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=50880
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=   68 (0x44)
>  smb_vwv[ 6]=   59 (0x3B)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=68
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 05 00 0C 03 10 00 00 00  44 00 00 00 01 00 00 00  ........ D.......
>  [010] B8 10 B8 10 F0 53 00 00  0D 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
>  [020] 6E 74 73 76 63 73 00 00  01 00 00 00 00 00 00 00  ntsvcs.. ........
>  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [040] 02 00 00 00                                       .... 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 144
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x90
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 47 of length 148
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=50944
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30406 (0x76C6)
>  smb_bcc=77
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 15  00 F0 DF 7E 01 08 00 00  .$...... ...~....
>  [030] 00 00 00 00 00 08 00 00  00 5C 00 5C 00 63 00 68  ........ .\.\.c.h
>  [040] 00 65 00 76 00 79 00 00  00 65 00 00 00           .e.v.y.. .e...
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c6
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76c6 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 76c6)
>[2006/05/09 08:52:20, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d900 max_trans_reply: 1024
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c6 name: srvsvc open: Yes len: 60
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 60
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 003c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 00000024
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 0015
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 74
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\srvsvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[11].fn == 12017a0c0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 srv_io_q_net_srv_get_info 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 ptr_srv_name  : 017edff0
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000004 smb_io_unistr2 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 uni_max_len: 00000008
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0008 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          000c uni_str_len: 00000008
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>          0010 buffer     : \.\.c.h.e.v.y...
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0020 switch_value  : 00000065
>[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1235)
>  srv_net_srv_get_info: 1235
>[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(2809)
>  init_srv_info_101
>[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(3044)
>  init_srv_r_net_srv_get_info
>[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1280)
>  srv_net_srv_get_info: 1280
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 srv_io_r_net_srv_get_info 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 srv_io_info_ctr ctr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0000 switch_value: 00000065
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 ptr_srv_ctr : 00000001
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000008 srv_io_info_101 sv101
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0008 platform_id : 000001f4
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              000c ptr_name    : 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0010 ver_major   : 00000004
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0014 ver_minor   : 00000009
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0018 srv_type    : 00009a03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              001c ptr_comment : 00000001
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              000020 smb_io_unistr2 uni_name    
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0020 uni_max_len: 00000006
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0024 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0028 uni_str_len: 00000006
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  002c buffer     : C.H.E.V.Y...
>[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84)
>              000038 smb_io_unistr2 uni_comment 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0038 uni_max_len: 0000000e
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  003c offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>                  0040 uni_str_len: 0000000e
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>                  0044 buffer     : S.a.m.b.a. .3...0...2.1.c...
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791)
>      0060 status: WERR_OK
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called srvsvc successfully
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 192
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 44
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c6 name: srvsvc len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 100.
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 007c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 00000064
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..124]
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=180
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=50944
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  124 (0x7C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  124 (0x7C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=125
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 7C 00 00 00 01 00 00  ........ .|......
>  [010] 00 64 00 00 00 00 00 00  00 65 00 00 00 01 00 00  .d...... .e......
>  [020] 00 F4 01 00 00 01 00 00  00 04 00 00 00 09 00 00  ........ ........
>  [030] 00 03 9A 00 00 01 00 00  00 06 00 00 00 00 00 00  ........ ........
>  [040] 00 06 00 00 00 43 00 48  00 45 00 56 00 59 00 00  .....C.H .E.V.Y..
>  [050] 00 0E 00 00 00 00 00 00  00 0E 00 00 00 53 00 61  ........ .....S.a
>  [060] 00 6D 00 62 00 61 00 20  00 33 00 2E 00 30 00 2E  .m.b.a.  .3...0..
>  [070] 00 32 00 31 00 63 00 00  00 00 00 00 00           .2.1.c.. .....
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 48 of length 45
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=51008
>  smt_wct=3
>  smb_vwv[ 0]=30406 (0x76C6)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c6
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name srvsvc pnum=76c6 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 5] smbd/pipes.c:(272)
>  reply_pipe_close: pnum:76c6
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165)
>  closed pipe name srvsvc pnum=76c6 (pipes_open=1)
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=51008
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 100
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x64
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 49 of length 104
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51072
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  768 (0x300)
>  smb_bcc=17
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 77 00 69 00 6E  00 72 00 65 00 67 00 00  .\.w.i.n .r.e.g..
>  [010] 00                                                . 
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0
>[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330)
>  nt_open_pipe: Opening pipe \winreg.
>[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351)
>  nt_open_pipe: Known pipe winreg opening.
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179)
>  Open pipe requested winreg (pipes_open=1)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210)
>  open_rpc_pipe_p: name spoolss pnum=76c2
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285)
>  Create pipe requested winreg
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77)
>  init_pipe_handles: created handle list for pipe winreg
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe winreg
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362)
>  Created internal pipe winreg (pipes_open=1)
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262)
>  Opened pipe winreg with handle 76c7 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name winreg pnum=76c7
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269)
>  open pipes: name spoolss pnum=76c2
>[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400)
>  do_ntcreate_pipe_open: open pipe = \winreg
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51072
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=50944 (0xC700)
>  smb_vwv[ 3]=  374 (0x176)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:20, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:20, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:20, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 136
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x88
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 50 of length 140
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=51136
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30407 (0x76C7)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] EE 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [010] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [020] 00 01 D0 8C 33 44 22 F1  31 AA AA 90 00 38 00 10  ....3D". 1....8..
>  [030] 03 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [040] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBwriteX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:20, 5] auth/auth_util.c:(437)
>  NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410
>  contains 5 SIDs
>  SID[  0]: S-1-5-21-4112424572-1378032116-4237619202-1410
>  SID[  1]: S-1-5-21-4112424572-1378032116-4237619202-1031
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:52:20, 5] auth/auth_util.c:(454)
>  UNIX token of user 205
>  Primary group is 15 and contains 1 supplementary groups
>  Group[  0]: 15
>[2006/05/09 08:52:20, 5] smbd/uid.c:(308)
>  change_to_user uid=(0,205) gid=(0,15)
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c7
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name winreg pnum=76c7 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c7 name: winreg open: Yes len: 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0b
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0048
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 11
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495)
>  api_pipe_bind_req: decode request. 1495
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505)
>  api_pipe_bind_req: \PIPE\winreg -> \PIPE\winreg
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_rb 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0008 num_contexts: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000c context_id  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      000e num_transfer_syntaxes: 01
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      00000f smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000010 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0010 data   : 338cd001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0014 data   : 2244
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0016 data   : 31f1
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0018 data   : aa aa 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              001a data   : 90 00 38 00 10 03 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0020 version: 00000001
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000024 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000024 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0024 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0028 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              002a data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002c data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002e data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0034 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548)
>  api_pipe_bind_req: make response. 1548
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959)
>  check_bind_req for \PIPE\winreg
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\lsarpc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\samr
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\NETLOGON
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\srvsvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\wkssvc
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964)
>  checking \PIPE\winreg
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_ba 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_rpc_hdr_bba 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0000 max_tsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0002 max_rsize: 10b8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 assoc_gid: 000053f0
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000008 smb_io_rpc_addr_str 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 len: 000d
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000a str: \PIPE\winreg.
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000017 smb_io_rpc_results 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>          0018 num_results: 01
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001c result     : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          001e reason     : 0000
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000020 smb_io_rpc_iface 
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          000020 smb_io_uuid uuid
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0020 data   : 8a885d04
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0024 data   : 1ceb
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>              0026 data   : 11c9
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              0028 data   : 9f e8 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>              002a data   : 08 00 2b 10 48 60 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0030 version: 00000002
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 0c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0044
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 56
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(207)
>  writeX-IPC pnum=76c7 nwritten=72
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=47
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=51136
>  smt_wct=6
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   72 (0x48)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 59
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x3b
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 51 of length 63
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=51200
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=30407 (0x76C7)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBreadX (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c7
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name winreg pnum=76c7 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c7 name: winreg len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049)
>  read_from_pipe: winreg: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2006/05/09 08:52:20, 3] smbd/pipes.c:(251)
>  readX-IPC pnum=76c7 min=1024 max=1024 nread=68
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=127
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=51200
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=   68 (0x44)
>  smb_vwv[ 6]=   59 (0x3B)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=68
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 05 00 0C 03 10 00 00 00  44 00 00 00 01 00 00 00  ........ D.......
>  [010] B8 10 B8 10 F0 53 00 00  0D 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
>  [020] 77 69 6E 72 65 67 00 00  01 00 00 00 00 00 00 00  winreg.. ........
>  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [040] 02 00 00 00                                       .... 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 52 of length 124
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51264
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   36 (0x24)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   36 (0x24)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30407 (0x76C7)
>  smb_bcc=53
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 24 00 00 00 01 00 00  ........ .$......
>  [020] 00 0C 00 00 00 00 00 02  00 28 E3 7E 01 F8 B1 01  ........ .(.~....
>  [030] 00 00 00 00 02                                    ..... 
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=36 params=0 setup=2
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c7
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name winreg pnum=76c7 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "winreg" (pnum 76c7)
>[2006/05/09 08:52:20, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d900 max_trans_reply: 1024
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c7 name: winreg open: Yes len: 36
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 36
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 36
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 36, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 20
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 20
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0024
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 20
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 20, incoming data = 20
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 0000000c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 0002
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 74
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\winreg
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: winreg op 0x2 - api_rpcTNP: rpc command: REG_OPEN_HKLM
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[3].fn == 120162b10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 reg_io_q_open_hive 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 ptr: 017ee328
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0004 server: b1f8
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0008 access: 02000000
>[2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(205, 15) : sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:20, 3] smbd/uid.c:(392)
>  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
>[2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:20, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:20, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (205, 15) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:20, 10] registry/reg_db.c:(265)
>  regdb_open: refcount reset (1)
>[2006/05/09 08:52:20, 7] registry/reg_frontend.c:(359)
>  regkey_open_internal: name = [HKLM]
>[2006/05/09 08:52:20, 10] registry/reg_cachehook.c:(95)
>  reghook_cache_find: Searching for keyname [/HKLM]
>[2006/05/09 08:52:20, 10] lib/adt_tree.c:(341)
>  pathtree_find: Enter [/HKLM]
>[2006/05/09 08:52:20, 10] lib/adt_tree.c:(413)
>  pathtree_find: Exit
>[2006/05/09 08:52:20, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x02000000, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410.
>[2006/05/09 08:52:20, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:52:20, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(142)
>  Opened policy hnd[1] [000] 00 00 00 00 02 00 00 00  00 00 00 00 EC 0A 60 44  ........ ......`D
>  [010] 55 2C 06 00                                       U,.. 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 reg_io_r_open_hive 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_pol_hnd 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0000 data1: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 data2: 00000002
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 data3: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          000a data4: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000c data5: ec 0a 60 44 55 2c 06 00 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791)
>      0014 status: WERR_OK
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called winreg successfully
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 538
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 20
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c7 name: winreg len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0030
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000001
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 00000018
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51264
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 01 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 02 00 00  ........ ........
>  [020] 00 00 00 00 00 EC 0A 60  44 55 2C 06 00 00 00 00  .......` DU,.....
>  [030] 00                                                . 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 228
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0xe4
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 53 of length 232
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=228
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51328
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  144 (0x90)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  144 (0x90)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30407 (0x76C7)
>  smb_bcc=161
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 90 00 00 00 02 00 00  ........ ........
>  [020] 00 78 00 00 00 00 00 0F  00 00 00 00 00 02 00 00  .x...... ........
>  [030] 00 00 00 00 00 EC 0A 60  44 55 2C 06 00 46 00 46  .......` DU,..F.F
>  [040] 00 10 15 83 75 23 00 00  00 00 00 00 00 23 00 00  ....u#.. .....#..
>  [050] 00 53 00 4F 00 46 00 54  00 57 00 41 00 52 00 45  .S.O.F.T .W.A.R.E
>  [060] 00 5C 00 4D 00 69 00 63  00 72 00 6F 00 73 00 6F  .\.M.i.c .r.o.s.o
>  [070] 00 66 00 74 00 5C 00 53  00 63 00 68 00 65 00 64  .f.t.\.S .c.h.e.d
>  [080] 00 75 00 6C 00 69 00 6E  00 67 00 41 00 67 00 65  .u.l.i.n .g.A.g.e
>  [090] 00 6E 00 74 00 00 00 00  00 00 00 00 00 19 00 02  .n.t.... ........
>  [0A0] 00                                                . 
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=144 params=0 setup=2
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c7
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name winreg pnum=76c7 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "winreg" (pnum 76c7)
>[2006/05/09 08:52:20, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d900 max_trans_reply: 1024
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c7 name: winreg open: Yes len: 144
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 144
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 144
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 144, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 128
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 128
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0090
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000002
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 128
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 128, incoming data = 128
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 00000078
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 000f
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 0
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\winreg
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: winreg op 0xf - api_rpcTNP: rpc command: REG_OPEN_ENTRY
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[1].fn == 120162de0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 reg_io_q_open_entry 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_pol_hnd 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0000 data1: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 data2: 00000002
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 data3: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          000a data4: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000c data5: ec 0a 60 44 55 2c 06 00 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000014 prs_unistr4 name
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0014 length: 0046
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0016 size: 0046
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0018 ptr: 75831510
>[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84)
>          00001c smb_io_unistr2 name
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              001c uni_max_len: 00000023
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0020 offset     : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>              0024 uni_str_len: 00000023
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904)
>              0028 buffer     : S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.S.c.h.e.d.u.l.i.n.g.A.g.e.n.t...
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0070 unknown_0        : 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0074 access: 00020019
>[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162)
>  Found policy hnd[0] [000] 00 00 00 00 02 00 00 00  00 00 00 00 EC 0A 60 44  ........ ......`D
>  [010] 55 2C 06 00                                       U,.. 
>[2006/05/09 08:52:20, 10] registry/reg_db.c:(248)
>  regdb_open: incrementing refcount (1)
>[2006/05/09 08:52:20, 7] registry/reg_frontend.c:(359)
>  regkey_open_internal: name = [HKLM\SOFTWARE\Microsoft\SchedulingAgent]
>[2006/05/09 08:52:20, 10] registry/reg_cachehook.c:(95)
>  reghook_cache_find: Searching for keyname [/HKLM/SOFTWARE/Microsoft/SchedulingAgent]
>[2006/05/09 08:52:20, 10] lib/adt_tree.c:(341)
>  pathtree_find: Enter [/HKLM/SOFTWARE/Microsoft/SchedulingAgent]
>[2006/05/09 08:52:20, 10] lib/adt_tree.c:(413)
>  pathtree_find: Exit
>[2006/05/09 08:52:20, 5] registry/reg_db.c:(457)
>  regdb_fetch_keys: tdb lookup failed to locate key [HKLM\SOFTWARE\Microsoft\SchedulingAgent]
>[2006/05/09 08:52:20, 10] registry/reg_db.c:(279)
>  regdb_close: decrementing refcount (1)
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 reg_io_r_open_entry 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_pol_hnd handle
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0000 data1: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 data2: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 data3: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          000a data4: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791)
>      0014 status: WERR_BADFILE
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called winreg successfully
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 94
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 128
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c7 name: winreg len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0030
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000002
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 00000018
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51328
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 02 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [020] 00 00 00 00 00 00 00 00  00 00 00 00 00 02 00 00  ........ ........
>  [030] 00                                                . 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 128
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x80
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 54 of length 132
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51392
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30407 (0x76C7)
>  smb_bcc=61
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 00  .\.P.I.P .E.\....
>  [010] 00 05 00 00 03 10 00 00  00 2C 00 00 00 03 00 00  ........ .,......
>  [020] 00 14 00 00 00 00 00 05  00 00 00 00 00 02 00 00  ........ ........
>  [030] 00 00 00 00 00 EC 0A 60  44 55 2C 06 00           .......` DU,..
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBtrans (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(538)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(560)
>  calling named_pipe
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(334)
>  named pipe command on <> name
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(265)
>  api_fd_reply
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c7
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name winreg pnum=76c7 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 3] smbd/ipc.c:(294)
>  Got API command 0x26 on pipe "winreg" (pnum 76c7)
>[2006/05/09 08:52:20, 10] smbd/ipc.c:(299)
>  api_fd_reply: p:14010d900 max_trans_reply: 1024
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934)
>  write_to_pipe: 76c7 name: winreg open: Yes len: 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390)
>  fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 16
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 28
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 002c
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000003
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478)
>  unmarshall_rpc_header: using little-endian RPC
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956)
>  write_to_pipe: data_left = 28
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715)
>  process_complete_pdu: processing packet type 0
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr_req req
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0000 alloc_hint: 00000014
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0004 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0006 opnum     : 0005
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 0
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195)
>  Requested \PIPE\winreg
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230)
>  api_rpcTNP: winreg op 0x5 - api_rpcTNP: rpc command: REG_CLOSE
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255)
>  api_rpc_cmds[0].fn == 120162a20
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 reg_io_q_close 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_pol_hnd 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0000 data1: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 data2: 00000002
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 data3: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          000a data4: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000c data5: ec 0a 60 44 55 2c 06 00 
>[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162)
>  Found policy hnd[0] [000] 00 00 00 00 02 00 00 00  00 00 00 00 EC 0A 60 44  ........ ......`D
>  [010] 55 2C 06 00                                       U,.. 
>[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162)
>  Found policy hnd[0] [000] 00 00 00 00 02 00 00 00  00 00 00 00 EC 0A 60 44  ........ ......`D
>  [010] 55 2C 06 00                                       U,.. 
>[2006/05/09 08:52:20, 3] rpc_server/srv_lsa_hnd.c:(200)
>  Closed policy
>[2006/05/09 08:52:20, 10] registry/reg_db.c:(279)
>  regdb_close: decrementing refcount (0)
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 reg_io_r_close 
>[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84)
>      000000 smb_io_pol_hnd 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0000 data1: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>          0004 data2: 00000000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          0008 data3: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>          000a data4: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791)
>      0014 status: WERR_OK
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277)
>  api_rpcTNP: called winreg successfully
>[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525)
>  free_pipe_context: destroying talloc pool of size 0
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960)
>  write_to_pipe: data_used = 28
>[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992)
>  read_from_pipe: 76c7 name: winreg len: 1024
>[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063)
>  read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000000 smb_io_rpc_hdr hdr
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0000 major     : 05
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0001 minor     : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0002 pkt_type  : 02
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0003 flags     : 03
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0004 pack_type0: 10
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0005 pack_type1: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0006 pack_type2: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0007 pack_type3: 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0008 frag_len  : 0030
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      000a auth_len  : 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      000c call_id   : 00000003
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84)
>  000010 smb_io_rpc_hdr_resp resp
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703)
>      0010 alloc_hint: 00000018
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674)
>      0014 context_id: 0000
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0016 cancel_ct : 00
>[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614)
>      0017 reserved  : 00
>[2006/05/09 08:52:20, 5] smbd/ipc.c:(58)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51392
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2006/05/09 08:52:20, 10] lib/util.c:(2058)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 03 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [020] 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [030] 00                                                . 
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:20, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:20, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:20, 3] smbd/process.c:(1194)
>  Transaction 55 of length 45
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=51456
>  smt_wct=3
>  smb_vwv[ 0]=30407 (0x76C7)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:20, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x14011b050
>[2006/05/09 08:52:20, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261)
>  search for pipe pnum=76c7
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name winreg pnum=76c7 (pipes_open=2)
>[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264)
>  pipe name spoolss pnum=76c2 (pipes_open=2)
>[2006/05/09 08:52:20, 5] smbd/pipes.c:(272)
>  reply_pipe_close: pnum:76c7
>[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235)
>  close_policy_by_pipe: deleted handle list for pipe winreg
>[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165)
>  closed pipe name winreg pnum=76c7 (pipes_open=1)
>[2006/05/09 08:52:20, 5] lib/util.c:(454)
>[2006/05/09 08:52:20, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=51456
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:20, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:20, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:22, 10] lib/util_sock.c:(618)
>  got smb length of 78
>[2006/05/09 08:52:22, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x4e
>[2006/05/09 08:52:22, 3] smbd/process.c:(1194)
>  Transaction 56 of length 82
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=78
>  smb_com=0x75
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=51520
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=   78 (0x4E)
>  smb_vwv[ 2]=    8 (0x8)
>  smb_vwv[ 3]=    1 (0x1)
>  smb_bcc=35
>[2006/05/09 08:52:22, 10] lib/util.c:(2058)
>  [000] 00 5C 00 5C 00 43 00 48  00 45 00 56 00 59 00 5C  .\.\.C.H .E.V.Y.\
>  [010] 00 50 00 41 00 56 00 41  00 4E 00 00 00 3F 3F 3F  .P.A.V.A .N...???
>  [020] 3F 3F 00                                          ??. 
>[2006/05/09 08:52:22, 3] smbd/process.c:(993)
>  switch message SMBtconX (pid 404565) conn 0x0
>[2006/05/09 08:52:22, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:22, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:22, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:22, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:22, 4] smbd/reply.c:(660)
>  Client requested device type [?????] for share [PAVAN]
>[2006/05/09 08:52:22, 5] smbd/service.c:(824)
>  making a connection to 'homes' service [PAVAN] created at session setup time
>[2006/05/09 08:52:22, 3] lib/access.c:(291)
>  only_ipaddrs_in_list: list has non-ip address (.india.hp.com)
>[2006/05/09 08:52:22, 3] lib/access.c:(316)
>  check_access: hostnames in host allow/deny list.
>[2006/05/09 08:52:22, 2] lib/access.c:(322)
>  Allowed connection from nt218201.india.hp.com (15.76.218.201)
>[2006/05/09 08:52:22, 5] lib/username.c:(290)
>  Finding user pavan
>[2006/05/09 08:52:22, 5] lib/username.c:(234)
>  Trying _Get_Pwnam(), username as lowercase is pavan
>[2006/05/09 08:52:22, 10] lib/util_pw.c:(98)
>  Got pavan from pwnam_cache
>[2006/05/09 08:52:22, 5] lib/username.c:(266)
>  Get_Pwnam_internals did find user [pavan]!
>[2006/05/09 08:52:22, 3] smbd/service.c:(488)
>  Connect path is '/usr/users/pavan' for service [pavan]
>[2006/05/09 08:52:22, 4] rpc_server/srv_srvsvc_nt.c:(240)
>  get_share_security: using default secdesc for pavan
>[2006/05/09 08:52:22, 10] lib/util_seaccess.c:(175)
>  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
>[2006/05/09 08:52:22, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x00000002, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410.
>[2006/05/09 08:52:22, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:52:22, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2
>[2006/05/09 08:52:22, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (2) granted.
>[2006/05/09 08:52:22, 3] smbd/vfs.c:(216)
>  Initialising default vfs hooks
>[2006/05/09 08:52:22, 5] smbd/connection.c:(170)
>  claiming pavan 0
>[2006/05/09 08:52:22, 10] smbd/uid.c:(124)
>  is_share_read_only_for_user: share pavan is read-write for unix user pavan
>[2006/05/09 08:52:22, 4] rpc_server/srv_srvsvc_nt.c:(240)
>  get_share_security: using default secdesc for pavan
>[2006/05/09 08:52:22, 10] lib/util_seaccess.c:(175)
>  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
>[2006/05/09 08:52:22, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x00000002, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410.
>[2006/05/09 08:52:22, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:52:22, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2
>[2006/05/09 08:52:22, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (2) granted.
>[2006/05/09 08:52:22, 4] rpc_server/srv_srvsvc_nt.c:(240)
>  get_share_security: using default secdesc for pavan
>[2006/05/09 08:52:22, 10] lib/util_seaccess.c:(175)
>  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
>[2006/05/09 08:52:22, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x00000002, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410.
>[2006/05/09 08:52:22, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:52:22, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2
>[2006/05/09 08:52:22, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (2) granted.
>[2006/05/09 08:52:22, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:22, 5] auth/auth_util.c:(437)
>  NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410
>  contains 5 SIDs
>  SID[  0]: S-1-5-21-4112424572-1378032116-4237619202-1410
>  SID[  1]: S-1-5-21-4112424572-1378032116-4237619202-1031
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:52:22, 5] auth/auth_util.c:(454)
>  UNIX token of user 205
>  Primary group is 15 and contains 1 supplementary groups
>  Group[  0]: 15
>[2006/05/09 08:52:22, 5] smbd/uid.c:(308)
>  change_to_user uid=(0,205) gid=(0,15)
>[2006/05/09 08:52:22, 1] smbd/service.c:(693)
>  nt218201 (15.76.218.201) connect to service pavan initially as user pavan (uid=205, gid=15) (pid 404565)
>[2006/05/09 08:52:22, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:22, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:22, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:22, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:22, 3] smbd/reply.c:(707)
>  tconX service=PAVAN 
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=54
>  smb_com=0x75
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=51520
>  smt_wct=3
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    1 (0x1)
>  smb_bcc=13
>[2006/05/09 08:52:22, 10] lib/util.c:(2058)
>  [000] 41 3A 00 4E 00 54 00 46  00 53 00 00 00           A:.N.T.F .S...
>[2006/05/09 08:52:22, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:22, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:22, 10] lib/util_sock.c:(618)
>  got smb length of 76
>[2006/05/09 08:52:22, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x4c
>[2006/05/09 08:52:22, 3] smbd/process.c:(1194)
>  Transaction 57 of length 80
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=76
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51584
>  smt_wct=15
>  smb_vwv[ 0]=    8 (0x8)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    8 (0x8)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=11
>[2006/05/09 08:52:22, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 00 00                 ........ ...
>[2006/05/09 08:52:22, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:22, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:22, 5] auth/auth_util.c:(437)
>  NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410
>  contains 5 SIDs
>  SID[  0]: S-1-5-21-4112424572-1378032116-4237619202-1410
>  SID[  1]: S-1-5-21-4112424572-1378032116-4237619202-1031
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:52:22, 5] auth/auth_util.c:(454)
>  UNIX token of user 205
>  Primary group is 15 and contains 1 supplementary groups
>  Group[  0]: 15
>[2006/05/09 08:52:22, 5] smbd/uid.c:(308)
>  change_to_user uid=(0,205) gid=(0,15)
>[2006/05/09 08:52:22, 4] smbd/vfs.c:(738)
>  vfs_ChDir to /usr/users/pavan
>[2006/05/09 08:52:22, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:22, 5] smbd/filename.c:(108)
>  unix_convert called on file ""
>[2006/05/09 08:52:22, 5] smbd/filename.c:(137)
>  conversion finished "" -> .
>[2006/05/09 08:52:22, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo . (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300)
>  dos_mode: .
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning d
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334)
>  dos_mode returning d
>[2006/05/09 08:52:22, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:22, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:24 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 10
>[2006/05/09 08:52:22, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:22, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51584
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:22, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 C6 E2  ........ Z.s.....
>  [010] 5E 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  ^.s..... Z.s.....
>  [020] 5A 17 73 C6 01 10 00 00  00 00 00 00 00           Z.s..... .....
>[2006/05/09 08:52:22, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:22, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:22, 10] lib/util_sock.c:(618)
>  got smb length of 86
>[2006/05/09 08:52:22, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x56
>[2006/05/09 08:52:22, 3] smbd/process.c:(1194)
>  Transaction 58 of length 90
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=86
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51648
>  smt_wct=15
>  smb_vwv[ 0]=   18 (0x12)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   10 (0xA)
>  smb_vwv[ 3]=16384 (0x4000)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   18 (0x12)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    1 (0x1)
>  smb_bcc=21
>[2006/05/09 08:52:22, 10] lib/util.c:(2058)
>  [000] 00 00 00 16 00 56 05 06  00 04 01 00 00 00 00 5C  .....V.. .......\
>  [010] 00 2A 00 00 00                                    .*... 
>[2006/05/09 08:52:22, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:22, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:22, 3] smbd/trans2.c:(1629)
>  call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=0, close_if_end = 2 requires_resume_key = 4 level = 0x104, max_data_bytes = 16384
>[2006/05/09 08:52:22, 5] smbd/filename.c:(108)
>  unix_convert called on file "*"
>[2006/05/09 08:52:22, 10] smbd/statcache.c:(215)
>  stat_cache_lookup: lookup failed for name [*]
>[2006/05/09 08:52:22, 5] smbd/filename.c:(185)
>  unix_convert begin: name = *, dirpath = , start = *
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276)
>  is_mangled * ?
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215)
>  is_mangled_component * (len 1) ?
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276)
>  is_mangled * ?
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215)
>  is_mangled_component * (len 1) ?
>[2006/05/09 08:52:22, 5] smbd/filename.c:(335)
>  New file *
>[2006/05/09 08:52:22, 5] smbd/trans2.c:(1688)
>  dir=./, mask = *
>[2006/05/09 08:52:22, 5] smbd/dir.c:(391)
>  dptr_create dir=./
>[2006/05/09 08:52:22, 3] smbd/dir.c:(510)
>  creating new dirptr 256 for path ./, expect_close = 1
>[2006/05/09 08:52:22, 4] smbd/trans2.c:(1745)
>  dptr_num is 256, wcard = *, attr = 22
>[2006/05/09 08:52:22, 8] smbd/trans2.c:(1750)
>  dirpath=<./> dontdescend=<>
>[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078)
>  get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 0
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300)
>  dos_mode: ./.
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning d
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334)
>  dos_mode returning d
>[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169)
>  get_lanman2_dir_entry found ./. fname=.
>[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310)
>  get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078)
>  get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 2147483648
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300)
>  dos_mode: ./..
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning d
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334)
>  dos_mode returning d
>[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169)
>  get_lanman2_dir_entry found ./.. fname=..
>[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310)
>  get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078)
>  get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 64
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300)
>  dos_mode: ./.cshrc
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334)
>  dos_mode returning ha
>[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169)
>  get_lanman2_dir_entry found ./.cshrc fname=.cshrc
>[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310)
>  get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616)
>  name_map: .cshrc -> 46EB5320 -> _JOE4O~0 (cache=1)
>[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078)
>  get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 84
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300)
>  dos_mode: ./bin
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning d
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334)
>  dos_mode returning d
>[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169)
>  get_lanman2_dir_entry found ./bin fname=bin
>[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310)
>  get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078)
>  get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 108
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300)
>  dos_mode: ./.login
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334)
>  dos_mode returning ha
>[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169)
>  get_lanman2_dir_entry found ./.login fname=.login
>[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310)
>  get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616)
>  name_map: .login -> 6257D060 -> _RABK2~O (cache=1)
>[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078)
>  get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 136
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300)
>  dos_mode: ./.profile
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334)
>  dos_mode returning ha
>[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169)
>  get_lanman2_dir_entry found ./.profile fname=.profile
>[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310)
>  get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616)
>  name_map: .profile -> 5B1248D4 -> _P9OQF~O (cache=1)
>[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078)
>  get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 176
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300)
>  dos_mode: ./autobook_12.html
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169)
>  get_lanman2_dir_entry found ./autobook_12.html fname=autobook_12.html
>[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310)
>  get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616)
>  name_map: autobook_12.html -> 61CF5FF0 -> AR4ZWM~O (cache=1)
>[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078)
>  get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 216
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300)
>  dos_mode: ./New Text Document.txt
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169)
>  get_lanman2_dir_entry found ./New Text Document.txt fname=New Text Document.txt
>[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310)
>  get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616)
>  name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1)
>[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078)
>  get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset -1
>[2006/05/09 08:52:22, 5] smbd/trans2.c:(1798)
>  call_trans2findfirst - (2) closing dptr_num 256
>[2006/05/09 08:52:22, 4] smbd/dir.c:(238)
>  closing dptr key 256
>[2006/05/09 08:52:22, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 10, data_sent_thistime = 888, useable_space = 131010
>[2006/05/09 08:52:22, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 10, data_to_send = 888, paramsize = 10, datasize = 888
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=956
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51648
>  smt_wct=10
>  smb_vwv[ 0]=   10 (0xA)
>  smb_vwv[ 1]=  888 (0x378)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=   10 (0xA)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  888 (0x378)
>  smb_vwv[ 7]=   68 (0x44)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=901
>[2006/05/09 08:52:22, 10] lib/util.c:(2058)
>  [000] 00 FD FF 08 00 01 00 00  00 F0 02 00 00 60 00 00  ........ .....`..
>  [010] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 C6 E2  ........ Z.s.....
>  [020] 5E 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  ^.s..... Z.s.....
>  [030] 5A 17 73 C6 01 00 00 00  00 00 00 00 00 00 00 00  Z.s..... ........
>  [040] 00 00 00 00 00 10 00 00  00 02 00 00 00 00 00 00  ........ ........
>  [050] 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [060] 00 00 00 00 00 00 00 00  00 00 00 2E 00 64 00 00  ........ .....d..
>  [070] 00 00 00 00 00 00 22 06  B2 60 5C C6 01 00 BD C0  ......". .`\.....
>  [080] E7 4F 64 C6 01 00 22 06  B2 60 5C C6 01 00 22 06  .Od...". .`\...".
>  [090] B2 60 5C C6 01 00 00 00  00 00 00 00 00 00 00 00  .`\..... ........
>  [0A0] 00 00 00 00 00 10 00 00  00 04 00 00 00 00 00 00  ........ ........
>  [0B0] 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [0C0] 00 00 00 00 00 00 00 00  00 00 00 2E 00 2E 00 00  ........ ........
>  [0D0] 00 6C 00 00 00 00 00 00  00 80 57 20 ED 6D 75 C2  .l...... ..W .mu.
>  [0E0] 01 80 FE 37 6F 72 63 C6  01 80 57 20 ED 6D 75 C2  ...7orc. ..W .mu.
>  [0F0] 01 80 57 20 ED 6D 75 C2  01 0F 05 00 00 00 00 00  ..W .mu. ........
>  [100] 00 00 00 10 00 00 00 00  00 22 00 00 00 0C 00 00  ........ ."......
>  [110] 00 00 00 00 00 10 00 5F  00 4A 00 4F 00 45 00 34  ......._ .J.O.E.4
>  [120] 00 4F 00 7E 00 30 00 00  00 00 00 00 00 00 00 2E  .O.~.0.. ........
>  [130] 00 63 00 73 00 68 00 72  00 63 00 00 00 64 00 00  .c.s.h.r .c...d..
>  [140] 00 00 00 00 00 80 35 22  2F FB 6C C6 01 00 98 E3  ......5" /.l.....
>  [150] 4A 08 73 C6 01 80 35 22  2F FB 6C C6 01 80 35 22  J.s...5" /.l...5"
>  [160] 2F FB 6C C6 01 00 00 00  00 00 00 00 00 00 00 00  /.l..... ........
>  [170] 00 00 00 00 00 10 00 00  00 06 00 00 00 00 00 00  ........ ........
>  [180] 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [190] 00 00 00 00 00 00 00 00  00 00 00 62 00 69 00 6E  ........ ...b.i.n
>  [1A0] 00 6C 00 00 00 00 00 00  00 00 B9 F4 EA 46 4A C5  .l...... .....FJ.
>  [1B0] 01 00 22 06 B2 60 5C C6  01 00 B9 F4 EA 46 4A C5  .."..`\. .....FJ.
>  [1C0] 01 00 B9 F4 EA 46 4A C5  01 B8 05 00 00 00 00 00  .....FJ. ........
>  [1D0] 00 00 00 10 00 00 00 00  00 22 00 00 00 0C 00 00  ........ ."......
>  [1E0] 00 00 00 00 00 10 00 5F  00 52 00 41 00 42 00 4B  ......._ .R.A.B.K
>  [1F0] 00 32 00 7E 00 4F 00 00  00 00 00 00 00 00 00 2E  .2.~.O.. ........
>[2006/05/09 08:52:22, 4] smbd/trans2.c:(1832)
>  SMBtrans2 mask=* directory=./ dirtype=22 numentries=8
>[2006/05/09 08:52:22, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:22, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:22, 10] lib/util_sock.c:(618)
>  got smb length of 100
>[2006/05/09 08:52:22, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x64
>[2006/05/09 08:52:22, 3] smbd/process.c:(1194)
>  Transaction 59 of length 104
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51712
>  smt_wct=15
>  smb_vwv[ 0]=   32 (0x20)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   32 (0x20)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=35
>[2006/05/09 08:52:22, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 64 00 65 00 73  ........ .\.d.e.s
>  [010] 00 6B 00 74 00 6F 00 70  00 2E 00 69 00 6E 00 69  .k.t.o.p ...i.n.i
>  [020] 00 00 00                                          ... 
>[2006/05/09 08:52:22, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:22, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:22, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:22, 5] smbd/filename.c:(108)
>  unix_convert called on file "desktop.ini"
>[2006/05/09 08:52:22, 10] smbd/statcache.c:(215)
>  stat_cache_lookup: lookup failed for name [DESKTOP.INI]
>[2006/05/09 08:52:22, 5] smbd/filename.c:(185)
>  unix_convert begin: name = desktop.ini, dirpath = , start = desktop.ini
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276)
>  is_mangled desktop.ini ?
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215)
>  is_mangled_component desktop.ini (len 11) ?
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276)
>  is_mangled desktop.ini ?
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215)
>  is_mangled_component desktop.ini (len 11) ?
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276)
>  is_mangled desktop.ini ?
>[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215)
>  is_mangled_component desktop.ini (len 11) ?
>[2006/05/09 08:52:22, 5] smbd/filename.c:(335)
>  New file desktop.ini
>[2006/05/09 08:52:22, 3] smbd/trans2.c:(2886)
>  call_trans2qfilepathinfo: SMB_VFS_STAT of desktop.ini failed (No such file or directory)
>[2006/05/09 08:52:22, 10] smbd/trans2.c:(2622)
>  set_bad_path_error: err = 2 bad_path = 0
>[2006/05/09 08:52:22, 3] smbd/error.c:(142)
>  error packet at smbd/trans2.c(2629) cmd=50 (SMBtrans2) NT_STATUS_OBJECT_NAME_NOT_FOUND
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x32
>  smb_rcls=52
>  smb_reh=0
>  smb_err=49152
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51712
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:22, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:22, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:22, 10] lib/util_sock.c:(618)
>  got smb length of 86
>[2006/05/09 08:52:22, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x56
>[2006/05/09 08:52:22, 3] smbd/process.c:(1194)
>  Transaction 60 of length 90
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=86
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51776
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4096 (0x1000)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=  256 (0x100)
>  smb_vwv[ 8]= 4096 (0x1000)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]= 1792 (0x700)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=  256 (0x100)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_bcc=3
>[2006/05/09 08:52:22, 10] lib/util.c:(2058)
>  [000] 00 00 00                                          ... 
>[2006/05/09 08:52:22, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x140168050
>[2006/05/09 08:52:22, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:22, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x10, access_mask = 0x100001 file_attributes = 0x0, share_access = 0x7, create_disposition = 0x1 create_options = 0x1 root_dir_fid = 0x0
>[2006/05/09 08:52:22, 5] smbd/filename.c:(108)
>  unix_convert called on file ""
>[2006/05/09 08:52:22, 5] smbd/filename.c:(137)
>  conversion finished "" -> .
>[2006/05/09 08:52:22, 5] smbd/open.c:(1801)
>  open_directory: opening directory ., access_mask = 0x100001, share_access = 0x7 create_options = 0x1, create_disposition = 0x1
>[2006/05/09 08:52:22, 5] smbd/files.c:(127)
>  allocated file structure 463, fnum = 4559 (1 used)
>[2006/05/09 08:52:22, 10] locking/locking.c:(538)
>  unparse_share_modes: del: 0, num: 1
>[2006/05/09 08:52:22, 10] locking/locking.c:(416)
>  print_share_mode_table: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300)
>  dos_mode: .
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning d
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334)
>  dos_mode returning d
>[2006/05/09 08:52:22, 5] smbd/nttrans.c:(910)
>  reply_ntcreate_and_X: fnum = 4559, open name = .
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51776
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=52992 (0xCF00)
>  smb_vwv[ 3]=  273 (0x111)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]= 7698 (0x1E12)
>  smb_vwv[ 7]= 5978 (0x175A)
>  smb_vwv[ 8]=50803 (0xC673)
>  smb_vwv[ 9]=    1 (0x1)
>  smb_vwv[10]=64363 (0xFB6B)
>  smb_vwv[11]= 6088 (0x17C8)
>  smb_vwv[12]=50803 (0xC673)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]= 7698 (0x1E12)
>  smb_vwv[15]= 5978 (0x175A)
>  smb_vwv[16]=50803 (0xC673)
>  smb_vwv[17]=    1 (0x1)
>  smb_vwv[18]= 7698 (0x1E12)
>  smb_vwv[19]= 5978 (0x175A)
>  smb_vwv[20]=50803 (0xC673)
>  smb_vwv[21]= 4097 (0x1001)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=    0 (0x0)
>  smb_vwv[32]= 1792 (0x700)
>  smb_vwv[33]=  256 (0x100)
>  smb_bcc=0
>[2006/05/09 08:52:22, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:22, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:22, 10] lib/util_sock.c:(618)
>  got smb length of 76
>[2006/05/09 08:52:22, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x4c
>[2006/05/09 08:52:22, 3] smbd/process.c:(1194)
>  Transaction 61 of length 80
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=76
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51840
>  smt_wct=15
>  smb_vwv[ 0]=    8 (0x8)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=    8 (0x8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    8 (0x8)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=11
>[2006/05/09 08:52:22, 10] lib/util.c:(2058)
>  [000] 00 00 00 EE 03 00 00 00  00 00 00                 ........ ...
>[2006/05/09 08:52:22, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:22, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:22, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1006
>[2006/05/09 08:52:22, 5] smbd/filename.c:(108)
>  unix_convert called on file ""
>[2006/05/09 08:52:22, 5] smbd/filename.c:(137)
>  conversion finished "" -> .
>[2006/05/09 08:52:22, 10] locking/locking.c:(440)
>  parse_share_modes: delete_on_close: 0, num_share_modes: 1
>[2006/05/09 08:52:22, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:22, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo . (fnum = -1) level=1006 call=5 total_data=0
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300)
>  dos_mode: .
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning d
>[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334)
>  dos_mode returning d
>[2006/05/09 08:52:22, 10] smbd/trans2.c:(3228)
>  call_trans2qfilepathinfo: SMB_FILE_INTERNAL_INFORMATION
>[2006/05/09 08:52:22, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 8, useable_space = 131010
>[2006/05/09 08:52:22, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 8, paramsize = 2, datasize = 8
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=68
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51840
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=    8 (0x8)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    8 (0x8)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=13
>[2006/05/09 08:52:22, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 29 BC 00  00 8D 80 FE B9           .....).. .....
>[2006/05/09 08:52:22, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:22, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:22, 10] lib/util_sock.c:(618)
>  got smb length of 84
>[2006/05/09 08:52:22, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x54
>[2006/05/09 08:52:22, 3] smbd/process.c:(1194)
>  Transaction 62 of length 88
>[2006/05/09 08:52:22, 5] lib/util.c:(454)
>[2006/05/09 08:52:22, 5] lib/util.c:(457)
>  size=84
>  smb_com=0xa0
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51904
>  smt_wct=23
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 8192 (0x2000)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=21504 (0x5400)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]= 1024 (0x400)
>  smb_vwv[18]=    4 (0x4)
>  smb_vwv[19]=   23 (0x17)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]= 4559 (0x11CF)
>  smb_vwv[22]=    0 (0x0)
>  smb_bcc=3
>[2006/05/09 08:52:22, 10] lib/util.c:(2058)
>  [000] 00 00 00                                          ... 
>[2006/05/09 08:52:22, 3] smbd/process.c:(993)
>  switch message SMBnttrans (pid 404565) conn 0x140168050
>[2006/05/09 08:52:22, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:22, 10] smbd/nttrans.c:(2806)
>  reply_nttrans: setup_count = 8
>[2006/05/09 08:52:22, 10] lib/util.c:(2058)
>  [000] 17 00 00 00 CF 11 00 00                           ........ 
>[2006/05/09 08:52:22, 3] smbd/nttrans.c:(1853)
>  call_nt_transact_notify_change
>[2006/05/09 08:52:22, 3] smbd/nttrans.c:(1867)
>  call_nt_transact_notify_change: notify change called on directory name = .
>[2006/05/09 08:52:22, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:22, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 86
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x56
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 63 of length 90
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=86
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51969
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=33024 (0x8100)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  768 (0x300)
>  smb_bcc=3
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00                                          ... 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:23, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x16, access_mask = 0x81 file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x0 root_dir_fid = 0x0
>[2006/05/09 08:52:23, 5] smbd/filename.c:(108)
>  unix_convert called on file ""
>[2006/05/09 08:52:23, 5] smbd/filename.c:(137)
>  conversion finished "" -> .
>[2006/05/09 08:52:23, 3] smbd/dosmode.c:(121)
>  unix_mode(.) returning 0740
>[2006/05/09 08:52:23, 10] smbd/open.c:(1085)
>  open_file_ntcreate: fname=., dos_attrs=0x0 access_mask=0x81 share_access=0x3 create_disposition = 0x1 create_options=0x0 unix mode=0740 oplock_request=3
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300)
>  dos_mode: .
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning d
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334)
>  dos_mode returning d
>[2006/05/09 08:52:23, 10] smbd/open.c:(1258)
>  open_file_ntcreate: fname=., after mapping access_mask=0x81
>[2006/05/09 08:52:23, 5] smbd/files.c:(127)
>  allocated file structure 464, fnum = 4560 (2 used)
>[2006/05/09 08:52:23, 10] locking/locking.c:(440)
>  parse_share_modes: delete_on_close: 0, num_share_modes: 1
>[2006/05/09 08:52:23, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] smbd/open.c:(382)
>  share_conflict: entry->access_mask = 0x100001, entry->share_access = 0x7, entry->private_options = 0x1
>[2006/05/09 08:52:23, 10] smbd/open.c:(389)
>  share_conflict: access_mask = 0x81, share_access = 0x3
>[2006/05/09 08:52:23, 10] smbd/open.c:(438)
>  share_conflict: [1] am (0x100001) & right (0x6) = 0x0
>[2006/05/09 08:52:23, 10] smbd/open.c:(438)
>  share_conflict: [1] sa (0x3) & share (0x2) = 0x2
>[2006/05/09 08:52:23, 10] smbd/open.c:(440)
>  share_conflict: [2] am (0x81) & right (0x6) = 0x0
>[2006/05/09 08:52:23, 10] smbd/open.c:(440)
>  share_conflict: [2] sa (0x7) & share (0x2) = 0x2
>[2006/05/09 08:52:23, 10] smbd/open.c:(443)
>  share_conflict: [3] am (0x100001) & right (0x21) = 0x1
>[2006/05/09 08:52:23, 10] smbd/open.c:(443)
>  share_conflict: [3] sa (0x3) & share (0x1) = 0x1
>[2006/05/09 08:52:23, 10] smbd/open.c:(445)
>  share_conflict: [4] am (0x81) & right (0x21) = 0x1
>[2006/05/09 08:52:23, 10] smbd/open.c:(445)
>  share_conflict: [4] sa (0x7) & share (0x1) = 0x1
>[2006/05/09 08:52:23, 10] smbd/open.c:(448)
>  share_conflict: [5] am (0x100001) & right (0x10000) = 0x0
>[2006/05/09 08:52:23, 10] smbd/open.c:(448)
>  share_conflict: [5] sa (0x3) & share (0x4) = 0x0
>[2006/05/09 08:52:23, 10] smbd/open.c:(450)
>  share_conflict: [6] am (0x81) & right (0x10000) = 0x0
>[2006/05/09 08:52:23, 10] smbd/open.c:(450)
>  share_conflict: [6] sa (0x7) & share (0x4) = 0x4
>[2006/05/09 08:52:23, 10] smbd/open.c:(453)
>  share_conflict: No conflict.
>[2006/05/09 08:52:23, 4] smbd/open.c:(1488)
>  calling open_file with flags=0x0 flags2=0x0 mode=0740
>[2006/05/09 08:52:23, 10] smbd/open.c:(54)
>  fd_open: name ., flags = 00 mode = 0740, fd = 25. 
>[2006/05/09 08:52:23, 5] smbd/files.c:(449)
>  freed files structure 4560 (1 used)
>[2006/05/09 08:52:23, 5] smbd/open.c:(1801)
>  open_directory: opening directory ., access_mask = 0x81, share_access = 0x3 create_options = 0x0, create_disposition = 0x1
>[2006/05/09 08:52:23, 5] smbd/files.c:(127)
>  allocated file structure 465, fnum = 4561 (2 used)
>[2006/05/09 08:52:23, 10] locking/locking.c:(440)
>  parse_share_modes: delete_on_close: 0, num_share_modes: 1
>[2006/05/09 08:52:23, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] smbd/open.c:(382)
>  share_conflict: entry->access_mask = 0x100001, entry->share_access = 0x7, entry->private_options = 0x1
>[2006/05/09 08:52:23, 10] smbd/open.c:(389)
>  share_conflict: access_mask = 0x81, share_access = 0x3
>[2006/05/09 08:52:23, 10] smbd/open.c:(438)
>  share_conflict: [1] am (0x100001) & right (0x6) = 0x0
>[2006/05/09 08:52:23, 10] smbd/open.c:(438)
>  share_conflict: [1] sa (0x3) & share (0x2) = 0x2
>[2006/05/09 08:52:23, 10] smbd/open.c:(440)
>  share_conflict: [2] am (0x81) & right (0x6) = 0x0
>[2006/05/09 08:52:23, 10] smbd/open.c:(440)
>  share_conflict: [2] sa (0x7) & share (0x2) = 0x2
>[2006/05/09 08:52:23, 10] smbd/open.c:(443)
>  share_conflict: [3] am (0x100001) & right (0x21) = 0x1
>[2006/05/09 08:52:23, 10] smbd/open.c:(443)
>  share_conflict: [3] sa (0x3) & share (0x1) = 0x1
>[2006/05/09 08:52:23, 10] smbd/open.c:(445)
>  share_conflict: [4] am (0x81) & right (0x21) = 0x1
>[2006/05/09 08:52:23, 10] smbd/open.c:(445)
>  share_conflict: [4] sa (0x7) & share (0x1) = 0x1
>[2006/05/09 08:52:23, 10] smbd/open.c:(448)
>  share_conflict: [5] am (0x100001) & right (0x10000) = 0x0
>[2006/05/09 08:52:23, 10] smbd/open.c:(448)
>  share_conflict: [5] sa (0x3) & share (0x4) = 0x0
>[2006/05/09 08:52:23, 10] smbd/open.c:(450)
>  share_conflict: [6] am (0x81) & right (0x10000) = 0x0
>[2006/05/09 08:52:23, 10] smbd/open.c:(450)
>  share_conflict: [6] sa (0x7) & share (0x4) = 0x4
>[2006/05/09 08:52:23, 10] smbd/open.c:(453)
>  share_conflict: No conflict.
>[2006/05/09 08:52:23, 10] locking/locking.c:(538)
>  unparse_share_modes: del: 0, num: 2
>[2006/05/09 08:52:23, 10] locking/locking.c:(416)
>  print_share_mode_table: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] locking/locking.c:(416)
>  print_share_mode_table: share_mode_entry[1]:  pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x0, file_id = 3, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300)
>  dos_mode: .
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning d
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334)
>  dos_mode returning d
>[2006/05/09 08:52:23, 5] smbd/nttrans.c:(910)
>  reply_ntcreate_and_X: fnum = 4561, open name = .
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51969
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=53504 (0xD100)
>  smb_vwv[ 3]=  273 (0x111)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]= 7698 (0x1E12)
>  smb_vwv[ 7]= 5978 (0x175A)
>  smb_vwv[ 8]=50803 (0xC673)
>  smb_vwv[ 9]=    1 (0x1)
>  smb_vwv[10]=64363 (0xFB6B)
>  smb_vwv[11]= 6088 (0x17C8)
>  smb_vwv[12]=50803 (0xC673)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]= 7698 (0x1E12)
>  smb_vwv[15]= 5978 (0x175A)
>  smb_vwv[16]=50803 (0xC673)
>  smb_vwv[17]=    1 (0x1)
>  smb_vwv[18]= 7698 (0x1E12)
>  smb_vwv[19]= 5978 (0x175A)
>  smb_vwv[20]=50803 (0xC673)
>  smb_vwv[21]= 4097 (0x1001)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=    0 (0x0)
>  smb_vwv[32]= 1792 (0x700)
>  smb_vwv[33]=  256 (0x100)
>  smb_bcc=0
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 84
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x54
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 64 of length 88
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=84
>  smb_com=0xa0
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52033
>  smt_wct=23
>  smb_vwv[ 0]=    4 (0x4)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]= 4096 (0x1000)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=21504 (0x5400)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]= 1024 (0x400)
>  smb_vwv[18]=    2 (0x2)
>  smb_vwv[19]=16484 (0x4064)
>  smb_vwv[20]=   20 (0x14)
>  smb_vwv[21]= 4561 (0x11D1)
>  smb_vwv[22]=    1 (0x1)
>  smb_bcc=3
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00                                          ... 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBnttrans (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:23, 10] smbd/nttrans.c:(2806)
>  reply_nttrans: setup_count = 8
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 64 40 14 00 D1 11 01 00                           d@...... 
>[2006/05/09 08:52:23, 10] smbd/nttrans.c:(2130)
>  call_nt_transact_ioctl: function[0x00144064] FID[0x11D1] isFSctl[0x01] compfilter[0x00]
>[2006/05/09 08:52:23, 5] smbd/nttrans.c:(2227)
>  FSCTL_GET_SHADOW_COPY_DATA: connectpath /usr/users/pavan, not supported.
>[2006/05/09 08:52:23, 3] smbd/error.c:(142)
>  error packet at smbd/nttrans.c(2229) cmd=160 (SMBnttrans) NT_STATUS_NOT_SUPPORTED
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=35
>  smb_com=0xa0
>  smb_rcls=187
>  smb_reh=0
>  smb_err=49152
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52033
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 65 of length 45
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=52097
>  smt_wct=3
>  smb_vwv[ 0]= 4561 (0x11D1)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:23, 3] smbd/reply.c:(3257)
>  close directory fnum=4561
>[2006/05/09 08:52:23, 10] locking/locking.c:(440)
>  parse_share_modes: delete_on_close: 0, num_share_modes: 2
>[2006/05/09 08:52:23, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[1]:  pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x0, file_id = 3, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] locking/locking.c:(538)
>  unparse_share_modes: del: 0, num: 2
>[2006/05/09 08:52:23, 10] locking/locking.c:(416)
>  print_share_mode_table: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] locking/locking.c:(416)
>  print_share_mode_table: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x40, file_id = 3, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 5] smbd/files.c:(449)
>  freed files structure 4561 (1 used)
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=52097
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 88
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x58
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 66 of length 92
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=88
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52161
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=  512 (0x200)
>  smb_vwv[ 3]= 4096 (0x1000)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=32768 (0x8000)
>  smb_vwv[ 8]= 4096 (0x1000)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=32768 (0x8000)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]= 8192 (0x2000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  768 (0x300)
>  smb_bcc=5
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 5C 00 00 00                                    .\... 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:23, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x10, access_mask = 0x100080 file_attributes = 0x80, share_access = 0x3, create_disposition = 0x1 create_options = 0x200000 root_dir_fid = 0x0
>[2006/05/09 08:52:23, 5] smbd/filename.c:(108)
>  unix_convert called on file ""
>[2006/05/09 08:52:23, 5] smbd/filename.c:(137)
>  conversion finished "" -> .
>[2006/05/09 08:52:23, 3] smbd/dosmode.c:(121)
>  unix_mode(.) returning 0740
>[2006/05/09 08:52:23, 10] smbd/open.c:(1085)
>  open_file_ntcreate: fname=., dos_attrs=0x80 access_mask=0x100080 share_access=0x3 create_disposition = 0x1 create_options=0x200000 unix mode=0740 oplock_request=0
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300)
>  dos_mode: .
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning d
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334)
>  dos_mode returning d
>[2006/05/09 08:52:23, 10] smbd/open.c:(1258)
>  open_file_ntcreate: fname=., after mapping access_mask=0x100080
>[2006/05/09 08:52:23, 5] smbd/files.c:(127)
>  allocated file structure 466, fnum = 4562 (2 used)
>[2006/05/09 08:52:23, 10] locking/locking.c:(440)
>  parse_share_modes: delete_on_close: 0, num_share_modes: 2
>[2006/05/09 08:52:23, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x40, file_id = 3, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 4] smbd/open.c:(1488)
>  calling open_file with flags=0x0 flags2=0x0 mode=0740
>[2006/05/09 08:52:23, 5] smbd/files.c:(449)
>  freed files structure 4562 (1 used)
>[2006/05/09 08:52:23, 5] smbd/open.c:(1801)
>  open_directory: opening directory ., access_mask = 0x100080, share_access = 0x3 create_options = 0x200000, create_disposition = 0x1
>[2006/05/09 08:52:23, 5] smbd/files.c:(127)
>  allocated file structure 467, fnum = 4563 (2 used)
>[2006/05/09 08:52:23, 10] locking/locking.c:(440)
>  parse_share_modes: delete_on_close: 0, num_share_modes: 2
>[2006/05/09 08:52:23, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x40, file_id = 3, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] locking/locking.c:(538)
>  unparse_share_modes: del: 0, num: 2
>[2006/05/09 08:52:23, 10] locking/locking.c:(416)
>  print_share_mode_table: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] locking/locking.c:(416)
>  print_share_mode_table: share_mode_entry[1]:  pid = 404565, share_access = 0x3, private_options = 0x200000, access_mask = 0x100080, mid = 0x0, type= 0x0, file_id = 5, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300)
>  dos_mode: .
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning d
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334)
>  dos_mode returning d
>[2006/05/09 08:52:23, 5] smbd/nttrans.c:(910)
>  reply_ntcreate_and_X: fnum = 4563, open name = .
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52161
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=54016 (0xD300)
>  smb_vwv[ 3]=  273 (0x111)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]= 7698 (0x1E12)
>  smb_vwv[ 7]= 5978 (0x175A)
>  smb_vwv[ 8]=50803 (0xC673)
>  smb_vwv[ 9]=    1 (0x1)
>  smb_vwv[10]=64363 (0xFB6B)
>  smb_vwv[11]= 6088 (0x17C8)
>  smb_vwv[12]=50803 (0xC673)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]= 7698 (0x1E12)
>  smb_vwv[15]= 5978 (0x175A)
>  smb_vwv[16]=50803 (0xC673)
>  smb_vwv[17]=    1 (0x1)
>  smb_vwv[18]= 7698 (0x1E12)
>  smb_vwv[19]= 5978 (0x175A)
>  smb_vwv[20]=50803 (0xC673)
>  smb_vwv[21]= 4097 (0x1001)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=    0 (0x0)
>  smb_vwv[32]= 1792 (0x700)
>  smb_vwv[33]=  256 (0x100)
>  smb_bcc=0
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 84
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x54
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 67 of length 88
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=84
>  smb_com=0xa0
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52225
>  smt_wct=23
>  smb_vwv[ 0]=    4 (0x4)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=   64 (0x40)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=21504 (0x5400)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]= 1024 (0x400)
>  smb_vwv[18]=    2 (0x2)
>  smb_vwv[19]=  168 (0xA8)
>  smb_vwv[20]=    9 (0x9)
>  smb_vwv[21]= 4563 (0x11D3)
>  smb_vwv[22]=    1 (0x1)
>  smb_bcc=3
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00                                          ... 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBnttrans (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:23, 10] smbd/nttrans.c:(2806)
>  reply_nttrans: setup_count = 8
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] A8 00 09 00 D3 11 01 00                           ........ 
>[2006/05/09 08:52:23, 10] smbd/nttrans.c:(2130)
>  call_nt_transact_ioctl: function[0x000900A8] FID[0x11D3] isFSctl[0x01] compfilter[0x00]
>[2006/05/09 08:52:23, 10] smbd/nttrans.c:(2162)
>  FSCTL_GET_REPARSE_POINT: called on FID[0x11D3](but not implemented)
>[2006/05/09 08:52:23, 3] smbd/error.c:(142)
>  error packet at smbd/nttrans.c(95) cmd=160 (SMBnttrans) NT_STATUS_NOT_A_REPARSE_POINT
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=35
>  smb_com=0xa0
>  smb_rcls=117
>  smb_reh=2
>  smb_err=49152
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52225
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 68 of length 45
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=52289
>  smt_wct=3
>  smb_vwv[ 0]= 4563 (0x11D3)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:23, 3] smbd/reply.c:(3257)
>  close directory fnum=4563
>[2006/05/09 08:52:23, 10] locking/locking.c:(440)
>  parse_share_modes: delete_on_close: 0, num_share_modes: 2
>[2006/05/09 08:52:23, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[1]:  pid = 404565, share_access = 0x3, private_options = 0x200000, access_mask = 0x100080, mid = 0x0, type= 0x0, file_id = 5, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] locking/locking.c:(538)
>  unparse_share_modes: del: 0, num: 2
>[2006/05/09 08:52:23, 10] locking/locking.c:(416)
>  print_share_mode_table: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 10] locking/locking.c:(416)
>  print_share_mode_table: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x200000, access_mask = 0x100080, mid = 0x0, type= 0x40, file_id = 5, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:23, 5] smbd/files.c:(449)
>  freed files structure 4563 (1 used)
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=52289
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 236
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0xec
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 69 of length 240
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=236
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=0
>  smb_mid=52353
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=  236 (0xEC)
>  smb_vwv[ 2]=16644 (0x4104)
>  smb_vwv[ 3]=   50 (0x32)
>  smb_vwv[ 4]=    1 (0x1)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=   74 (0x4A)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=  212 (0xD4)
>  smb_vwv[11]=40960 (0xA000)
>  smb_bcc=177
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 60 48 06 06 2B 06 01 05  05 02 A0 3E 30 3C A0 0E  `H..+... ...>0<..
>  [010] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A2 2A  0...+... ..7....*
>  [020] 04 28 4E 54 4C 4D 53 53  50 00 01 00 00 00 97 82  .(NTLMSS P.......
>  [030] 08 E2 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [040] 00 00 05 01 28 0A 00 00  00 0F 00 57 00 69 00 6E  ....(... ...W.i.n
>  [050] 00 64 00 6F 00 77 00 73  00 20 00 32 00 30 00 30  .d.o.w.s . .2.0.0
>  [060] 00 32 00 20 00 53 00 65  00 72 00 76 00 69 00 63  .2. .S.e .r.v.i.c
>  [070] 00 65 00 20 00 50 00 61  00 63 00 6B 00 20 00 32  .e. .P.a .c.k. .2
>  [080] 00 20 00 32 00 36 00 30  00 30 00 00 00 57 00 69  . .2.6.0 .0...W.i
>  [090] 00 6E 00 64 00 6F 00 77  00 73 00 20 00 32 00 30  .n.d.o.w .s. .2.0
>  [0A0] 00 30 00 32 00 20 00 35  00 2E 00 31 00 00 00 00  .0.2. .5 ...1....
>  [0B0] 00                                                . 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBsesssetupX (pid 404565) conn 0x0
>[2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:23, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(822)
>  wct=12 flg2=0xc807
>[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(633)
>  Doing spnego session setup
>[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(663)
>  NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[]
>[2006/05/09 08:52:23, 10] smbd/password.c:(182)
>  register_vuid: allocated vuid = 102
>[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(525)
>  Got OID 1 3 6 1 4 1 311 2 2 10
>[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(528)
>  Got secblob of size 40
>[2006/05/09 08:52:23, 5] auth/auth.c:(485)
>  Making default auth method list for standalone security=user, encrypt passwords = yes
>[2006/05/09 08:52:23, 5] auth/auth.c:(388)
>  load_auth_module: Attempting to find an auth method to match guest
>[2006/05/09 08:52:23, 5] auth/auth.c:(413)
>  load_auth_module: auth method guest has a valid init
>[2006/05/09 08:52:23, 5] auth/auth.c:(388)
>  load_auth_module: Attempting to find an auth method to match sam
>[2006/05/09 08:52:23, 5] auth/auth.c:(413)
>  load_auth_module: auth method sam has a valid init
>[2006/05/09 08:52:23, 3] libsmb/ntlmssp.c:(63)
>  Got NTLMSSP neg_flags=0xe2088297
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_NEGOTIATE_OEM
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_LM_KEY
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>    NTLMSSP_NEGOTIATE_56
>[2006/05/09 08:52:23, 5] auth/auth.c:(95)
>  auth_get_challenge: module guest did not want to specify a challenge
>[2006/05/09 08:52:23, 5] auth/auth.c:(95)
>  auth_get_challenge: module sam did not want to specify a challenge
>[2006/05/09 08:52:23, 5] auth/auth.c:(135)
>  auth_context challenge created by random
>[2006/05/09 08:52:23, 5] auth/auth.c:(136)
>  challenge is: 
>[2006/05/09 08:52:23, 5] lib/util.c:(2058)
>  [000] C9 FA 9C 98 A8 9E 02 25                           .......% 
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=290
>  smb_com=0x73
>  smb_rcls=22
>  smb_reh=0
>  smb_err=49152
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=52353
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=  189 (0xBD)
>  smb_bcc=247
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] A1 81 BA 30 81 B7 A0 03  0A 01 01 A1 0C 06 0A 2B  ...0.... .......+
>  [010] 06 01 04 01 82 37 02 02  0A A2 81 A1 04 81 9E 4E  .....7.. .......N
>  [020] 54 4C 4D 53 53 50 00 02  00 00 00 0A 00 0A 00 30  TLMSSP.. .......0
>  [030] 00 00 00 B5 82 8A 60 C9  FA 9C 98 A8 9E 02 25 00  ......`. ......%.
>  [040] 00 00 00 00 00 00 00 64  00 64 00 3A 00 00 00 43  .......d .d.:...C
>  [050] 00 48 00 45 00 56 00 59  00 02 00 0A 00 43 00 48  .H.E.V.Y .....C.H
>  [060] 00 45 00 56 00 59 00 01  00 0A 00 43 00 48 00 45  .E.V.Y.. ...C.H.E
>  [070] 00 56 00 59 00 04 00 18  00 69 00 6E 00 64 00 69  .V.Y.... .i.n.d.i
>  [080] 00 61 00 2E 00 68 00 70  00 2E 00 63 00 6F 00 6D  .a...h.p ...c.o.m
>  [090] 00 03 00 24 00 63 00 68  00 65 00 76 00 79 00 2E  ...$.c.h .e.v.y..
>  [0A0] 00 69 00 6E 00 64 00 69  00 61 00 2E 00 68 00 70  .i.n.d.i .a...h.p
>  [0B0] 00 2E 00 63 00 6F 00 6D  00 00 00 00 00 55 00 6E  ...c.o.m .....U.n
>  [0C0] 00 69 00 78 00 00 00 53  00 61 00 6D 00 62 00 61  .i.x...S .a.m.b.a
>  [0D0] 00 20 00 33 00 2E 00 30  00 2E 00 32 00 31 00 63  . .3...0 ...2.1.c
>  [0E0] 00 00 00 57 00 4F 00 52  00 4B 00 47 00 52 00 4F  ...W.O.R .K.G.R.O
>  [0F0] 00 55 00 50 00 00 00                              .U.P... 
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 274
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x112
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 70 of length 278
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=274
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=52417
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=  274 (0x112)
>  smb_vwv[ 2]=16644 (0x4104)
>  smb_vwv[ 3]=   50 (0x32)
>  smb_vwv[ 4]=    1 (0x1)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=  113 (0x71)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=  212 (0xD4)
>  smb_vwv[11]=40960 (0xA000)
>  smb_bcc=215
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] A1 6F 30 6D A2 6B 04 69  4E 54 4C 4D 53 53 50 00  .o0m.k.i NTLMSSP.
>  [010] 03 00 00 00 01 00 01 00  58 00 00 00 00 00 00 00  ........ X.......
>  [020] 59 00 00 00 00 00 00 00  48 00 00 00 00 00 00 00  Y....... H.......
>  [030] 48 00 00 00 10 00 10 00  48 00 00 00 10 00 10 00  H....... H.......
>  [040] 59 00 00 00 15 8A 88 62  05 01 28 0A 00 00 00 0F  Y......b ..(.....
>  [050] 4E 00 54 00 32 00 31 00  38 00 32 00 30 00 31 00  N.T.2.1. 8.2.0.1.
>  [060] 00 34 4B E5 5B 01 57 BA  DB 53 87 D6 9C 0B CC 3C  .4K.[.W. .S.....<
>  [070] B7 57 00 69 00 6E 00 64  00 6F 00 77 00 73 00 20  .W.i.n.d .o.w.s. 
>  [080] 00 32 00 30 00 30 00 32  00 20 00 53 00 65 00 72  .2.0.0.2 . .S.e.r
>  [090] 00 76 00 69 00 63 00 65  00 20 00 50 00 61 00 63  .v.i.c.e . .P.a.c
>  [0A0] 00 6B 00 20 00 32 00 20  00 32 00 36 00 30 00 30  .k. .2.  .2.6.0.0
>  [0B0] 00 00 00 57 00 69 00 6E  00 64 00 6F 00 77 00 73  ...W.i.n .d.o.w.s
>  [0C0] 00 20 00 32 00 30 00 30  00 32 00 20 00 35 00 2E  . .2.0.0 .2. .5..
>  [0D0] 00 31 00 00 00 00 00                              .1..... 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBsesssetupX (pid 404565) conn 0x0
>[2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:23, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(822)
>  wct=12 flg2=0xc807
>[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(633)
>  Doing spnego session setup
>[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(663)
>  NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[]
>[2006/05/09 08:52:23, 3] libsmb/ntlmssp.c:(661)
>  Got user=[] domain=[] workstation=[NT218201] len1=1 len2=0
>[2006/05/09 08:52:23, 6] param/loadparm.c:(2947)
>  lp_file_list_changed()
>  file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf  last mod_time: Tue May  9 08:51:35 2006
>  
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(162)
>  make_user_info_map: Mapping user []\[] from workstation [NT218201]
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(69)
>  attempting to make a user_info for  ()
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(79)
>  making strings for 's user_info struct
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(121)
>  making blobs for 's user_info struct
>[2006/05/09 08:52:23, 10] auth/auth_util.c:(139)
>  made an encrypted user_info for  ()
>[2006/05/09 08:52:23, 3] auth/auth.c:(218)
>  check_ntlm_password:  Checking password for unmapped user []\[]@[NT218201] with the new password interface
>[2006/05/09 08:52:23, 3] auth/auth.c:(221)
>  check_ntlm_password:  mapped user is: [CHEVY]\[]@[NT218201]
>[2006/05/09 08:52:23, 10] auth/auth.c:(230)
>  check_ntlm_password: auth_context challenge created by random
>[2006/05/09 08:52:23, 10] auth/auth.c:(233)
>  challenge is: 
>[2006/05/09 08:52:23, 5] lib/util.c:(2058)
>  [000] C9 FA 9C 98 A8 9E 02 25                           .......% 
>[2006/05/09 08:52:23, 10] lib/account_pol.c:(332)
>  account_policy_get: name: password history, val: 0
>[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(616)
>  pdb_set_username: setting username nobody, was 
>[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(643)
>  pdb_set_domain: setting domain CHEVY, was 
>[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(670)
>  pdb_set_nt_username: setting nt username , was 
>[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(697)
>  pdb_set_full_name: setting full name nobody, was 
>[2006/05/09 08:52:23, 4] lib/substitute.c:(359)
>  Home server: chevy
>[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(805)
>  pdb_set_homedir: setting home dir \\chevy\nobody, was 
>[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(778)
>  pdb_set_dir_drive: setting dir drive , was NULL
>[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(724)
>  pdb_set_logon_script: setting logon script , was 
>[2006/05/09 08:52:23, 4] lib/substitute.c:(359)
>  Home server: chevy
>[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(751)
>  pdb_set_profile_path: setting profile path \\chevy\nobody\profile, was 
>[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(884)
>  pdb_set_workstations: setting workstations , was 
>[2006/05/09 08:52:23, 10] lib/account_pol.c:(332)
>  account_policy_get: name: password history, val: 0
>[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(543)
>  pdb_set_user_sid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-501
>[2006/05/09 08:52:23, 10] passdb/pdb_compat.c:(72)
>  pdb_set_user_sid_from_rid:
>  	setting user sid S-1-5-21-4112424572-1378032116-4237619202-501 from rid 501
>[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(579)
>  pdb_set_group_sid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-514
>[2006/05/09 08:52:23, 10] passdb/pdb_compat.c:(99)
>  pdb_set_group_sid_from_rid:
>  	setting group sid S-1-5-21-4112424572-1378032116-4237619202-514 from rid 514
>[2006/05/09 08:52:23, 3] auth/auth.c:(267)
>  check_ntlm_password: guest authentication for user [] succeeded
>[2006/05/09 08:52:23, 5] auth/auth.c:(302)
>  check_ntlm_password:  guest authentication for user [] -> [] -> [nobody] succeeded
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(1485)
>  attempting to free (and zero) a user_info structure
>[2006/05/09 08:52:23, 10] auth/auth_util.c:(1488)
>  structure was created for 
>[2006/05/09 08:52:23, 10] auth/auth_ntlmssp.c:(119)
>  Got NT session key of length 16
>[2006/05/09 08:52:23, 10] auth/auth_ntlmssp.c:(126)
>  Got LM session key of length 16
>[2006/05/09 08:52:23, 10] libsmb/ntlmssp.c:(755)
>  ntlmssp_server_auth: Using unmodified nt session key.
>[2006/05/09 08:52:23, 3] libsmb/ntlmssp_sign.c:(338)
>  NTLMSSP Sign/Seal - Initialising with flags:
>[2006/05/09 08:52:23, 3] libsmb/ntlmssp.c:(63)
>  Got NTLMSSP neg_flags=0x60088235
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_SEAL
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2006/05/09 08:52:23, 10] smbd/password.c:(182)
>  register_vuid: allocated vuid = 103
>[2006/05/09 08:52:23, 10] lib/util_pw.c:(98)
>  Got nobody from pwnam_cache
>[2006/05/09 08:52:23, 10] smbd/password.c:(252)
>  register_vuid: (65534,65534) nobody  CHEVY guest=1
>[2006/05/09 08:52:23, 3] smbd/password.c:(257)
>  User name: nobody	Real name: nobody
>[2006/05/09 08:52:23, 3] smbd/password.c:(276)
>  UNIX uid 65534 is UNIX user nobody, and will be vuid 103
>[2006/05/09 08:52:23, 6] param/loadparm.c:(2947)
>  lp_file_list_changed()
>  file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf  last mod_time: Tue May  9 08:51:35 2006
>  
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=110
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=103
>  smb_mid=52417
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    9 (0x9)
>  smb_bcc=67
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] A1 07 30 05 A0 03 0A 01  00 55 00 6E 00 69 00 78  ..0..... .U.n.i.x
>  [010] 00 00 00 53 00 61 00 6D  00 62 00 61 00 20 00 33  ...S.a.m .b.a. .3
>  [020] 00 2E 00 30 00 2E 00 32  00 31 00 63 00 00 00 57  ...0...2 .1.c...W
>  [030] 00 4F 00 52 00 4B 00 47  00 52 00 4F 00 55 00 50  .O.R.K.G .R.O.U.P
>  [040] 00 00 00                                          ... 
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 76
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x4c
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 71 of length 80
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=76
>  smb_com=0x75
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=103
>  smb_mid=52481
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=   76 (0x4C)
>  smb_vwv[ 2]=    8 (0x8)
>  smb_vwv[ 3]=    1 (0x1)
>  smb_bcc=33
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 5C 00 5C 00 43 00 48  00 45 00 56 00 59 00 5C  .\.\.C.H .E.V.Y.\
>  [010] 00 49 00 50 00 43 00 24  00 00 00 3F 3F 3F 3F 3F  .I.P.C.$ ...?????
>  [020] 00                                                . 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBtconX (pid 404565) conn 0x0
>[2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:23, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:23, 4] smbd/reply.c:(660)
>  Client requested device type [?????] for share [IPC$]
>[2006/05/09 08:52:23, 5] smbd/service.c:(860)
>  making a connection to 'normal' service ipc$
>[2006/05/09 08:52:23, 3] lib/access.c:(291)
>  only_ipaddrs_in_list: list has non-ip address (.india.hp.com)
>[2006/05/09 08:52:23, 3] lib/access.c:(316)
>  check_access: hostnames in host allow/deny list.
>[2006/05/09 08:52:23, 2] lib/access.c:(322)
>  Allowed connection from nt218201.india.hp.com (15.76.218.201)
>[2006/05/09 08:52:23, 5] lib/username.c:(290)
>  Finding user nobody
>[2006/05/09 08:52:23, 5] lib/username.c:(234)
>  Trying _Get_Pwnam(), username as lowercase is nobody
>[2006/05/09 08:52:23, 10] lib/util_pw.c:(98)
>  Got nobody from pwnam_cache
>[2006/05/09 08:52:23, 5] lib/username.c:(266)
>  Get_Pwnam_internals did find user [nobody]!
>[2006/05/09 08:52:23, 3] smbd/service.c:(488)
>  Connect path is '/tmp' for service [IPC$]
>[2006/05/09 08:52:23, 4] rpc_server/srv_srvsvc_nt.c:(240)
>  get_share_security: using default secdesc for IPC$
>[2006/05/09 08:52:23, 10] lib/util_seaccess.c:(175)
>  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
>[2006/05/09 08:52:23, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x00000002, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-501.
>[2006/05/09 08:52:23, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:52:23, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-501
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-514
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-32-546
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-132069
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2
>[2006/05/09 08:52:23, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (2) granted.
>[2006/05/09 08:52:23, 3] smbd/vfs.c:(216)
>  Initialising default vfs hooks
>[2006/05/09 08:52:23, 5] smbd/connection.c:(170)
>  claiming IPC$ 0
>[2006/05/09 08:52:23, 10] smbd/uid.c:(124)
>  is_share_read_only_for_user: share IPC$ is read-only for unix user nobody
>[2006/05/09 08:52:23, 4] rpc_server/srv_srvsvc_nt.c:(240)
>  get_share_security: using default secdesc for IPC$
>[2006/05/09 08:52:23, 10] lib/util_seaccess.c:(175)
>  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
>[2006/05/09 08:52:23, 10] lib/util_seaccess.c:(231)
>  se_access_check: requested access 0x00000001, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-501.
>[2006/05/09 08:52:23, 3] lib/util_seaccess.c:(250)
>[2006/05/09 08:52:23, 3] lib/util_seaccess.c:(251)
>  se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-501
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-514
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-32-546
>  se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-132069
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1
>[2006/05/09 08:52:23, 5] lib/util_seaccess.c:(308)
>  se_access_check: access (1) granted.
>[2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(437)
>  NT user token of user S-1-5-21-4112424572-1378032116-4237619202-501
>  contains 6 SIDs
>  SID[  0]: S-1-5-21-4112424572-1378032116-4237619202-501
>  SID[  1]: S-1-5-21-4112424572-1378032116-4237619202-514
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-32-546
>  SID[  5]: S-1-5-21-4112424572-1378032116-4237619202-132069
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(454)
>  UNIX token of user 65534
>  Primary group is 65534 and contains 1 supplementary groups
>  Group[  0]: 65534
>[2006/05/09 08:52:23, 5] smbd/uid.c:(308)
>  change_to_user uid=(0,65534) gid=(0,65534)
>[2006/05/09 08:52:23, 3] smbd/service.c:(693)
>  nt218201 (15.76.218.201) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 404565)
>[2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:23, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:23, 3] smbd/reply.c:(707)
>  tconX service=IPC$ 
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=48
>  smb_com=0x75
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=3
>  smb_pid=65279
>  smb_uid=103
>  smb_mid=52481
>  smt_wct=3
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    1 (0x1)
>  smb_bcc=7
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 49 50 43 00 00 00 00                              IPC.... 
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 72 of length 124
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52545
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(437)
>  NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410
>  contains 5 SIDs
>  SID[  0]: S-1-5-21-4112424572-1378032116-4237619202-1410
>  SID[  1]: S-1-5-21-4112424572-1378032116-4237619202-1031
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:52:23, 5] auth/auth_util.c:(454)
>  UNIX token of user 205
>  Primary group is 15 and contains 1 supplementary groups
>  Group[  0]: 15
>[2006/05/09 08:52:23, 5] smbd/uid.c:(308)
>  change_to_user uid=(0,205) gid=(0,15)
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:23, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:23, 10] smbd/statcache.c:(215)
>  stat_cache_lookup: lookup failed for name [NEW TEXT DOCUMENT.TXT]
>[2006/05/09 08:52:23, 5] smbd/statcache.c:(139)
>  stat_cache_add: Added entry (14011a280:size16) NEW TEXT DOCUMENT.TXT -> New Text Document.txt
>[2006/05/09 08:52:23, 5] smbd/filename.c:(180)
>  conversion finished New Text Document.txt -> New Text Document.txt
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52545
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 73 of length 124
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52609
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:23, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:23, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52609
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 74 of length 124
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52673
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:23, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:23, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52673
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 75 of length 124
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52737
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:23, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:23, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52737
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 76 of length 124
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52801
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:23, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:23, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52801
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 77 of length 124
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52865
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:23, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:23, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52865
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:23, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:23, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:23, 3] smbd/process.c:(1194)
>  Transaction 78 of length 124
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52929
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:23, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:23, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:23, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:23, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:23, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:23, 5] lib/util.c:(454)
>[2006/05/09 08:52:23, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52929
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:23, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:23, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:23, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:24, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:24, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:24, 3] smbd/process.c:(1194)
>  Transaction 79 of length 124
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52993
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:24, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:24, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:24, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:24, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=52993
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:24, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:24, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:24, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:24, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:24, 3] smbd/process.c:(1194)
>  Transaction 80 of length 124
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53057
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:24, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:24, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:24, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:24, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53057
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:24, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:24, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:24, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:24, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:24, 3] smbd/process.c:(1194)
>  Transaction 81 of length 124
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53121
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:24, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:24, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:24, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:24, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53121
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:24, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:24, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:24, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:24, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:24, 3] smbd/process.c:(1194)
>  Transaction 82 of length 124
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53185
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:24, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:24, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:24, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:24, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53185
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:24, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:24, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:24, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:24, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:24, 3] smbd/process.c:(1194)
>  Transaction 83 of length 124
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53249
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:24, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:24, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:24, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:24, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53249
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:24, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:24, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:24, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:24, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:24, 3] smbd/process.c:(1194)
>  Transaction 84 of length 124
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53313
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:24, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:24, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:24, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:24, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53313
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:24, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:24, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:24, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:24, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:24, 3] smbd/process.c:(1194)
>  Transaction 85 of length 124
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53377
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:24, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:24, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:24, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:24, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53377
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:24, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:24, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:24, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:24, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:24, 3] smbd/process.c:(1194)
>  Transaction 86 of length 124
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53441
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:24, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:24, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:24, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:24, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53441
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:24, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:24, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:24, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:24, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:24, 3] smbd/process.c:(1194)
>  Transaction 87 of length 124
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53505
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:24, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:24, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:24, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:24, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53505
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:24, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:24, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:24, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:24, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:24, 3] smbd/process.c:(1194)
>  Transaction 88 of length 124
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53569
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:24, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:24, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:24, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:24, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53569
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:24, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:24, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:24, 10] lib/util_sock.c:(618)
>  got smb length of 120
>[2006/05/09 08:52:24, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x78
>[2006/05/09 08:52:24, 3] smbd/process.c:(1194)
>  Transaction 89 of length 124
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=120
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53633
>  smt_wct=15
>  smb_vwv[ 0]=   52 (0x34)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   52 (0x34)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=55
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 EC 03 00 00 00  00 5C 00 4E 00 65 00 77  ........ .\.N.e.w
>  [010] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [020] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [030] 00 78 00 74 00 00 00                              .x.t... 
>[2006/05/09 08:52:24, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:24, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2006/05/09 08:52:24, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:24, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108)
>  call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118)
>  SMB_QFBI - create: Tue May  9 08:49:16 2006
>   access: Tue May  9 08:49:16 2006
>   write: Tue May  9 08:49:16 2006
>   change: Tue May  9 08:49:16 2006
>   mode: 20
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2006/05/09 08:52:24, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2006/05/09 08:52:24, 5] lib/util.c:(454)
>[2006/05/09 08:52:24, 5] lib/util.c:(457)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53633
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2006/05/09 08:52:24, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [010] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [020] 5A 17 73 C6 01 20 00 00  00 00 00 00 00           Z.s.. .. .....
>[2006/05/09 08:52:24, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:24, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:25, 10] lib/util_sock.c:(618)
>  got smb length of 126
>[2006/05/09 08:52:25, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x7e
>[2006/05/09 08:52:25, 3] smbd/process.c:(1194)
>  Transaction 90 of length 130
>[2006/05/09 08:52:25, 5] lib/util.c:(454)
>[2006/05/09 08:52:25, 5] lib/util.c:(457)
>  size=126
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53697
>  smt_wct=15
>  smb_vwv[ 0]=   58 (0x3A)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   10 (0xA)
>  smb_vwv[ 3]=16384 (0x4000)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   58 (0x3A)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    1 (0x1)
>  smb_bcc=61
>[2006/05/09 08:52:25, 10] lib/util.c:(2058)
>  [000] 00 00 00 16 00 56 05 07  00 04 01 00 00 00 00 5C  .....V.. .......\
>  [010] 00 4E 00 65 00 77 00 20  00 54 00 65 00 78 00 74  .N.e.w.  .T.e.x.t
>  [020] 00 20 00 44 00 6F 00 63  00 75 00 6D 00 65 00 6E  . .D.o.c .u.m.e.n
>  [030] 00 74 00 2E 00 74 00 78  00 74 00 00 00           .t...t.x .t...
>[2006/05/09 08:52:25, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:25, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:25, 3] smbd/trans2.c:(1629)
>  call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=1, close_if_end = 2 requires_resume_key = 4 level = 0x104, max_data_bytes = 16384
>[2006/05/09 08:52:25, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:25, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:25, 5] smbd/trans2.c:(1688)
>  dir=./, mask = New Text Document.txt
>[2006/05/09 08:52:25, 5] smbd/dir.c:(391)
>  dptr_create dir=./
>[2006/05/09 08:52:25, 3] smbd/dir.c:(510)
>  creating new dirptr 256 for path ./, expect_close = 1
>[2006/05/09 08:52:25, 4] smbd/trans2.c:(1745)
>  dptr_num is 256, wcard = New Text Document.txt, attr = 22
>[2006/05/09 08:52:25, 8] smbd/trans2.c:(1750)
>  dirpath=<./> dontdescend=<>
>[2006/05/09 08:52:25, 8] smbd/trans2.c:(1078)
>  get_lanman2_dir_entry:readdir on dirptr 0x1400ed200 now at offset -1
>[2006/05/09 08:52:25, 8] smbd/dosmode.c:(300)
>  dos_mode: ./New Text Document.txt
>[2006/05/09 08:52:25, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:25, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:25, 5] smbd/trans2.c:(1169)
>  get_lanman2_dir_entry found ./New Text Document.txt fname=New Text Document.txt
>[2006/05/09 08:52:25, 10] smbd/trans2.c:(1310)
>  get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2006/05/09 08:52:25, 10] smbd/mangle_hash2.c:(616)
>  name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1)
>[2006/05/09 08:52:25, 5] smbd/trans2.c:(1798)
>  call_trans2findfirst - (2) closing dptr_num 256
>[2006/05/09 08:52:25, 4] smbd/dir.c:(238)
>  closing dptr key 256
>[2006/05/09 08:52:25, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 10, data_sent_thistime = 136, useable_space = 131010
>[2006/05/09 08:52:25, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 10, data_to_send = 136, paramsize = 10, datasize = 136
>[2006/05/09 08:52:25, 5] lib/util.c:(454)
>[2006/05/09 08:52:25, 5] lib/util.c:(457)
>  size=204
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53697
>  smt_wct=10
>  smb_vwv[ 0]=   10 (0xA)
>  smb_vwv[ 1]=  136 (0x88)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=   10 (0xA)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  136 (0x88)
>  smb_vwv[ 7]=   68 (0x44)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=149
>[2006/05/09 08:52:25, 10] lib/util.c:(2058)
>  [000] 00 FD FF 01 00 01 00 00  00 00 00 00 00 88 00 00  ........ ........
>  [010] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [020] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [030] 5A 17 73 C6 01 00 00 00  00 00 00 00 00 00 00 00  Z.s..... ........
>  [040] 00 00 00 00 00 20 00 00  00 2A 00 00 00 00 00 00  ..... .. .*......
>  [050] 00 18 00 4E 00 35 00 32  00 48 00 5A 00 32 00 7E  ...N.5.2 .H.Z.2.~
>  [060] 00 54 00 2E 00 54 00 58  00 54 00 4E 00 65 00 77  .T...T.X .T.N.e.w
>  [070] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [080] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [090] 00 78 00 74 00                                    .x.t. 
>[2006/05/09 08:52:25, 4] smbd/trans2.c:(1832)
>  SMBtrans2 mask=New Text Document.txt directory=./ dirtype=22 numentries=1
>[2006/05/09 08:52:25, 10] smbd/mangle_hash2.c:(616)
>  name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1)
>[2006/05/09 08:52:25, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:25, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:25, 10] lib/util_sock.c:(618)
>  got smb length of 126
>[2006/05/09 08:52:25, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x7e
>[2006/05/09 08:52:25, 3] smbd/process.c:(1194)
>  Transaction 91 of length 130
>[2006/05/09 08:52:25, 5] lib/util.c:(454)
>[2006/05/09 08:52:25, 5] lib/util.c:(457)
>  size=126
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53761
>  smt_wct=15
>  smb_vwv[ 0]=   58 (0x3A)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   10 (0xA)
>  smb_vwv[ 3]=16384 (0x4000)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   58 (0x3A)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    1 (0x1)
>  smb_bcc=61
>[2006/05/09 08:52:25, 10] lib/util.c:(2058)
>  [000] 00 00 00 16 00 56 05 07  00 04 01 00 00 00 00 5C  .....V.. .......\
>  [010] 00 4E 00 65 00 77 00 20  00 54 00 65 00 78 00 74  .N.e.w.  .T.e.x.t
>  [020] 00 20 00 44 00 6F 00 63  00 75 00 6D 00 65 00 6E  . .D.o.c .u.m.e.n
>  [030] 00 74 00 2E 00 74 00 78  00 74 00 00 00           .t...t.x .t...
>[2006/05/09 08:52:25, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:25, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:25, 3] smbd/trans2.c:(1629)
>  call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=1, close_if_end = 2 requires_resume_key = 4 level = 0x104, max_data_bytes = 16384
>[2006/05/09 08:52:25, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:25, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:25, 5] smbd/trans2.c:(1688)
>  dir=./, mask = New Text Document.txt
>[2006/05/09 08:52:25, 5] smbd/dir.c:(391)
>  dptr_create dir=./
>[2006/05/09 08:52:25, 3] smbd/dir.c:(510)
>  creating new dirptr 256 for path ./, expect_close = 1
>[2006/05/09 08:52:25, 4] smbd/trans2.c:(1745)
>  dptr_num is 256, wcard = New Text Document.txt, attr = 22
>[2006/05/09 08:52:25, 8] smbd/trans2.c:(1750)
>  dirpath=<./> dontdescend=<>
>[2006/05/09 08:52:25, 8] smbd/trans2.c:(1078)
>  get_lanman2_dir_entry:readdir on dirptr 0x14010d420 now at offset -1
>[2006/05/09 08:52:25, 8] smbd/dosmode.c:(300)
>  dos_mode: ./New Text Document.txt
>[2006/05/09 08:52:25, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:25, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:25, 5] smbd/trans2.c:(1169)
>  get_lanman2_dir_entry found ./New Text Document.txt fname=New Text Document.txt
>[2006/05/09 08:52:25, 10] smbd/trans2.c:(1310)
>  get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2006/05/09 08:52:25, 10] smbd/mangle_hash2.c:(616)
>  name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1)
>[2006/05/09 08:52:25, 5] smbd/trans2.c:(1798)
>  call_trans2findfirst - (2) closing dptr_num 256
>[2006/05/09 08:52:25, 4] smbd/dir.c:(238)
>  closing dptr key 256
>[2006/05/09 08:52:25, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 10, data_sent_thistime = 136, useable_space = 131010
>[2006/05/09 08:52:25, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 10, data_to_send = 136, paramsize = 10, datasize = 136
>[2006/05/09 08:52:25, 5] lib/util.c:(454)
>[2006/05/09 08:52:25, 5] lib/util.c:(457)
>  size=204
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53761
>  smt_wct=10
>  smb_vwv[ 0]=   10 (0xA)
>  smb_vwv[ 1]=  136 (0x88)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=   10 (0xA)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  136 (0x88)
>  smb_vwv[ 7]=   68 (0x44)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=149
>[2006/05/09 08:52:25, 10] lib/util.c:(2058)
>  [000] 00 FD FF 01 00 01 00 00  00 00 00 00 00 88 00 00  ........ ........
>  [010] 00 00 00 00 00 00 12 1E  5A 17 73 C6 01 00 12 1E  ........ Z.s.....
>  [020] 5A 17 73 C6 01 00 12 1E  5A 17 73 C6 01 00 12 1E  Z.s..... Z.s.....
>  [030] 5A 17 73 C6 01 00 00 00  00 00 00 00 00 00 00 00  Z.s..... ........
>  [040] 00 00 00 00 00 20 00 00  00 2A 00 00 00 00 00 00  ..... .. .*......
>  [050] 00 18 00 4E 00 35 00 32  00 48 00 5A 00 32 00 7E  ...N.5.2 .H.Z.2.~
>  [060] 00 54 00 2E 00 54 00 58  00 54 00 4E 00 65 00 77  .T...T.X .T.N.e.w
>  [070] 00 20 00 54 00 65 00 78  00 74 00 20 00 44 00 6F  . .T.e.x .t. .D.o
>  [080] 00 63 00 75 00 6D 00 65  00 6E 00 74 00 2E 00 74  .c.u.m.e .n.t...t
>  [090] 00 78 00 74 00                                    .x.t. 
>[2006/05/09 08:52:25, 4] smbd/trans2.c:(1832)
>  SMBtrans2 mask=New Text Document.txt directory=./ dirtype=22 numentries=1
>[2006/05/09 08:52:25, 10] smbd/mangle_hash2.c:(616)
>  name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1)
>[2006/05/09 08:52:25, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:25, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:26, 10] lib/util_sock.c:(618)
>  got smb length of 130
>[2006/05/09 08:52:26, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x82
>[2006/05/09 08:52:26, 3] smbd/process.c:(1194)
>  Transaction 92 of length 134
>[2006/05/09 08:52:26, 5] lib/util.c:(454)
>[2006/05/09 08:52:26, 5] lib/util.c:(457)
>  size=130
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53825
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=11264 (0x2C00)
>  smb_vwv[ 3]= 4096 (0x1000)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=32768 (0x8000)
>  smb_vwv[ 8]=  256 (0x100)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]= 1792 (0x700)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]= 8192 (0x2000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_bcc=47
>[2006/05/09 08:52:26, 10] lib/util.c:(2058)
>  [000] 00 5C 00 4E 00 65 00 77  00 20 00 54 00 65 00 78  .\.N.e.w . .T.e.x
>  [010] 00 74 00 20 00 44 00 6F  00 63 00 75 00 6D 00 65  .t. .D.o .c.u.m.e
>  [020] 00 6E 00 74 00 2E 00 74  00 78 00 74 00 00 00     .n.t...t .x.t...
>[2006/05/09 08:52:26, 3] smbd/process.c:(993)
>  switch message SMBntcreateX (pid 404565) conn 0x140168050
>[2006/05/09 08:52:26, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:26, 10] smbd/nttrans.c:(497)
>  reply_ntcreateX: flags = 0x10, access_mask = 0x10080 file_attributes = 0x0, share_access = 0x7, create_disposition = 0x1 create_options = 0x200040 root_dir_fid = 0x0
>[2006/05/09 08:52:26, 5] smbd/filename.c:(108)
>  unix_convert called on file "New Text Document.txt"
>[2006/05/09 08:52:26, 10] smbd/statcache.c:(248)
>  stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt]
>[2006/05/09 08:52:26, 10] smbd/reply.c:(1862)
>  can_delete: New Text Document.txt, dirtype = 0
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:26, 3] smbd/dosmode.c:(121)
>  unix_mode(New Text Document.txt) returning 0740
>[2006/05/09 08:52:26, 10] smbd/open.c:(1085)
>  open_file_ntcreate: fname=New Text Document.txt, dos_attrs=0x0 access_mask=0x10080 share_access=0x7 create_disposition = 0x1 create_options=0x200040 unix mode=0740 oplock_request=0
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:26, 10] smbd/open.c:(1258)
>  open_file_ntcreate: fname=New Text Document.txt, after mapping access_mask=0x10080
>[2006/05/09 08:52:26, 5] smbd/files.c:(127)
>  allocated file structure 468, fnum = 4564 (2 used)
>[2006/05/09 08:52:26, 4] smbd/open.c:(1488)
>  calling open_file with flags=0x0 flags2=0x0 mode=0740
>[2006/05/09 08:52:26, 2] smbd/open.c:(347)
>  pavan opened file New Text Document.txt read=No write=No (numopen=2)
>[2006/05/09 08:52:26, 10] locking/locking.c:(538)
>  unparse_share_modes: del: 0, num: 1
>[2006/05/09 08:52:26, 10] locking/locking.c:(416)
>  print_share_mode_table: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:26, 5] smbd/nttrans.c:(910)
>  reply_ntcreate_and_X: fnum = 4564, open name = New Text Document.txt
>[2006/05/09 08:52:26, 5] lib/util.c:(454)
>[2006/05/09 08:52:26, 5] lib/util.c:(457)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53825
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=54272 (0xD400)
>  smb_vwv[ 3]=  273 (0x111)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]= 7698 (0x1E12)
>  smb_vwv[ 7]= 5978 (0x175A)
>  smb_vwv[ 8]=50803 (0xC673)
>  smb_vwv[ 9]=    1 (0x1)
>  smb_vwv[10]= 7698 (0x1E12)
>  smb_vwv[11]= 5978 (0x175A)
>  smb_vwv[12]=50803 (0xC673)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]= 7698 (0x1E12)
>  smb_vwv[15]= 5978 (0x175A)
>  smb_vwv[16]=50803 (0xC673)
>  smb_vwv[17]=    1 (0x1)
>  smb_vwv[18]= 7698 (0x1E12)
>  smb_vwv[19]= 5978 (0x175A)
>  smb_vwv[20]=50803 (0xC673)
>  smb_vwv[21]= 8193 (0x2001)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=    0 (0x0)
>  smb_vwv[32]= 1792 (0x700)
>  smb_vwv[33]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:26, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:26, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:26, 10] lib/util_sock.c:(618)
>  got smb length of 72
>[2006/05/09 08:52:26, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x48
>[2006/05/09 08:52:26, 3] smbd/process.c:(1194)
>  Transaction 93 of length 76
>[2006/05/09 08:52:26, 5] lib/util.c:(454)
>[2006/05/09 08:52:26, 5] lib/util.c:(457)
>  size=72
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53889
>  smt_wct=15
>  smb_vwv[ 0]=    4 (0x4)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=    8 (0x8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    4 (0x4)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    7 (0x7)
>  smb_bcc=7
>[2006/05/09 08:52:26, 10] lib/util.c:(2058)
>  [000] 00 00 00 D4 11 EE 03                              ....... 
>[2006/05/09 08:52:26, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:26, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:26, 3] smbd/trans2.c:(2799)
>  call_trans2qfilepathinfo: TRANSACT2_QFILEINFO: level = 1006
>[2006/05/09 08:52:26, 10] locking/locking.c:(440)
>  parse_share_modes: delete_on_close: 0, num_share_modes: 1
>[2006/05/09 08:52:26, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259
>[2006/05/09 08:52:26, 3] smbd/trans2.c:(2912)
>  call_trans2qfilepathinfo New Text Document.txt (fnum = 4564) level=1006 call=7 total_data=0
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:26, 10] smbd/trans2.c:(3228)
>  call_trans2qfilepathinfo: SMB_FILE_INTERNAL_INFORMATION
>[2006/05/09 08:52:26, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 8, useable_space = 131010
>[2006/05/09 08:52:26, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 8, paramsize = 2, datasize = 8
>[2006/05/09 08:52:26, 5] lib/util.c:(454)
>[2006/05/09 08:52:26, 5] lib/util.c:(457)
>  size=68
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53889
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=    8 (0x8)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    8 (0x8)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=13
>[2006/05/09 08:52:26, 10] lib/util.c:(2058)
>  [000] 00 00 00 00 00 83 BC 00  00 8D 80 FE B9           ........ .....
>[2006/05/09 08:52:26, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:26, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:26, 10] lib/util_sock.c:(618)
>  got smb length of 77
>[2006/05/09 08:52:26, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x4d
>[2006/05/09 08:52:26, 3] smbd/process.c:(1194)
>  Transaction 94 of length 81
>[2006/05/09 08:52:26, 5] lib/util.c:(454)
>[2006/05/09 08:52:26, 5] lib/util.c:(457)
>  size=77
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53953
>  smt_wct=15
>  smb_vwv[ 0]=    6 (0x6)
>  smb_vwv[ 1]=    1 (0x1)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    6 (0x6)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    1 (0x1)
>  smb_vwv[12]=   76 (0x4C)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    8 (0x8)
>  smb_bcc=12
>[2006/05/09 08:52:26, 10] lib/util.c:(2058)
>  [000] 00 00 00 D4 11 F5 03 00  00 00 00 01              ........ ....
>[2006/05/09 08:52:26, 3] smbd/process.c:(993)
>  switch message SMBtrans2 (pid 404565) conn 0x140168050
>[2006/05/09 08:52:26, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:26, 3] smbd/trans2.c:(3701)
>  call_trans2setfilepathinfo(8) New Text Document.txt (fnum 4564) info_level=1013 totdata=1
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(300)
>  dos_mode: New Text Document.txt
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(167)
>  dos_mode_from_sbuf returning a
>[2006/05/09 08:52:26, 8] smbd/dosmode.c:(334)
>  dos_mode returning a
>[2006/05/09 08:52:26, 10] locking/locking.c:(971)
>  set_delete_on_close: Adding delete on close flag for fnum = 4564, file New Text Document.txt
>[2006/05/09 08:52:26, 10] locking/locking.c:(440)
>  parse_share_modes: delete_on_close: 0, num_share_modes: 1
>[2006/05/09 08:52:26, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259
>[2006/05/09 08:52:26, 10] locking/locking.c:(538)
>  unparse_share_modes: del: 1, num: 1
>[2006/05/09 08:52:26, 10] locking/locking.c:(416)
>  print_share_mode_table: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259
>[2006/05/09 08:52:26, 9] smbd/trans2.c:(684)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 0, useable_space = 131012
>[2006/05/09 08:52:26, 9] smbd/trans2.c:(686)
>  t2_rep: params_to_send = 2, data_to_send = 0, paramsize = 2, datasize = 0
>[2006/05/09 08:52:26, 5] lib/util.c:(454)
>[2006/05/09 08:52:26, 5] lib/util.c:(457)
>  size=58
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51265
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=53953
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=3
>[2006/05/09 08:52:26, 10] lib/util.c:(2058)
>  [000] 00 00 00                                          ... 
>[2006/05/09 08:52:26, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:26, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:26, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:26, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:26, 3] smbd/process.c:(1194)
>  Transaction 95 of length 45
>[2006/05/09 08:52:26, 5] lib/util.c:(454)
>[2006/05/09 08:52:26, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=54017
>  smt_wct=3
>  smb_vwv[ 0]= 4564 (0x11D4)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:26, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x140168050
>[2006/05/09 08:52:26, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:26, 3] smbd/reply.c:(3269)
>  close fd=-1 fnum=4564 (numopen=2)
>[2006/05/09 08:52:26, 10] locking/locking.c:(440)
>  parse_share_modes: delete_on_close: 1, num_share_modes: 1
>[2006/05/09 08:52:26, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259
>[2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(255)
>  push_sec_ctx(205, 15) : sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:26, 3] smbd/uid.c:(392)
>  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
>[2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2006/05/09 08:52:26, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:26, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(385)
>  pop_sec_ctx (205, 15) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:26, 5] smbd/close.c:(238)
>  close_file: file New Text Document.txt. Delete on close was set - deleting file.
>[2006/05/09 08:52:26, 4] smbd/uid.c:(222)
>  change_to_user: Skipping user change - already user
>[2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:26, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:26, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:26, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:26, 10] smbd/notify.c:(163)
>  process_pending_change_notify_queue: dir . changed !
>[2006/05/09 08:52:26, 3] smbd/error.c:(142)
>  error packet at smbd/notify.c(55) cmd=160 (SMBnttrans) NT code 0x0000010c
>[2006/05/09 08:52:26, 5] lib/util.c:(454)
>[2006/05/09 08:52:26, 5] lib/util.c:(457)
>  size=71
>  smb_com=0xa0
>  smb_rcls=12
>  smb_reh=1
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=51904
>  smt_wct=18
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:26, 10] locking/posix.c:(1249)
>  posix_locking_close_file: file New Text Document.txt has no outstanding locks.
>[2006/05/09 08:52:26, 2] smbd/close.c:(305)
>  pavan closed file New Text Document.txt (numopen=1) 
>[2006/05/09 08:52:26, 5] smbd/files.c:(449)
>  freed files structure 4564 (1 used)
>[2006/05/09 08:52:26, 5] lib/util.c:(454)
>[2006/05/09 08:52:26, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=54017
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:26, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:26, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:26, 10] lib/util_sock.c:(618)
>  got smb length of 84
>[2006/05/09 08:52:26, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x54
>[2006/05/09 08:52:26, 3] smbd/process.c:(1194)
>  Transaction 96 of length 88
>[2006/05/09 08:52:26, 5] lib/util.c:(454)
>[2006/05/09 08:52:26, 5] lib/util.c:(457)
>  size=84
>  smb_com=0xa0
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=54080
>  smt_wct=23
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 8192 (0x2000)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=21504 (0x5400)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]= 1024 (0x400)
>  smb_vwv[18]=    4 (0x4)
>  smb_vwv[19]=    3 (0x3)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]= 4559 (0x11CF)
>  smb_vwv[22]=    1 (0x1)
>  smb_bcc=3
>[2006/05/09 08:52:26, 10] lib/util.c:(2058)
>  [000] 00 00 00                                          ... 
>[2006/05/09 08:52:26, 3] smbd/process.c:(993)
>  switch message SMBnttrans (pid 404565) conn 0x140168050
>[2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:26, 5] auth/auth_util.c:(437)
>  NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410
>  contains 5 SIDs
>  SID[  0]: S-1-5-21-4112424572-1378032116-4237619202-1410
>  SID[  1]: S-1-5-21-4112424572-1378032116-4237619202-1031
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:52:26, 5] auth/auth_util.c:(454)
>  UNIX token of user 205
>  Primary group is 15 and contains 1 supplementary groups
>  Group[  0]: 15
>[2006/05/09 08:52:26, 5] smbd/uid.c:(308)
>  change_to_user uid=(0,205) gid=(0,15)
>[2006/05/09 08:52:26, 10] smbd/nttrans.c:(2806)
>  reply_nttrans: setup_count = 8
>[2006/05/09 08:52:26, 10] lib/util.c:(2058)
>  [000] 03 00 00 00 CF 11 01 00                           ........ 
>[2006/05/09 08:52:26, 3] smbd/nttrans.c:(1853)
>  call_nt_transact_notify_change
>[2006/05/09 08:52:26, 3] smbd/nttrans.c:(1867)
>  call_nt_transact_notify_change: notify change called on directory name = .
>[2006/05/09 08:52:26, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:26, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:33, 10] lib/util_sock.c:(618)
>  got smb length of 39
>[2006/05/09 08:52:33, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x27
>[2006/05/09 08:52:33, 3] smbd/process.c:(1194)
>  Transaction 97 of length 43
>[2006/05/09 08:52:33, 5] lib/util.c:(454)
>[2006/05/09 08:52:33, 5] lib/util.c:(457)
>  size=39
>  smb_com=0x74
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=103
>  smb_mid=54145
>  smt_wct=2
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:33, 3] smbd/process.c:(993)
>  switch message SMBulogoffX (pid 404565) conn 0x0
>[2006/05/09 08:52:33, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:33, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:33, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:33, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:33, 5] auth/auth_util.c:(1511)
>  attempting to free (and zero) a server_info structure
>[2006/05/09 08:52:33, 3] smbd/reply.c:(1606)
>  ulogoffX vuid=103
>[2006/05/09 08:52:33, 5] lib/util.c:(454)
>[2006/05/09 08:52:33, 5] lib/util.c:(457)
>  size=39
>  smb_com=0x74
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=103
>  smb_mid=54145
>  smt_wct=2
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:33, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:33, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:33, 10] lib/util_sock.c:(618)
>  got smb length of 35
>[2006/05/09 08:52:33, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x23
>[2006/05/09 08:52:33, 3] smbd/process.c:(1194)
>  Transaction 98 of length 39
>[2006/05/09 08:52:33, 5] lib/util.c:(454)
>[2006/05/09 08:52:33, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x71
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=3
>  smb_pid=65279
>  smb_uid=103
>  smb_mid=54209
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:33, 3] smbd/process.c:(993)
>  switch message SMBtdis (pid 404565) conn 0x14016e050
>[2006/05/09 08:52:33, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:33, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:33, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:33, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:33, 4] smbd/vfs.c:(738)
>  vfs_ChDir to /tmp
>[2006/05/09 08:52:33, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:33, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:33, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:33, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:33, 3] smbd/service.c:(882)
>  nt218201 (15.76.218.201) closed connection to service IPC$
>[2006/05/09 08:52:33, 3] smbd/connection.c:(69)
>  Yielding connection to IPC$
>[2006/05/09 08:52:33, 4] smbd/vfs.c:(738)
>  vfs_ChDir to /
>[2006/05/09 08:52:33, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:33, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:33, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:33, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:33, 5] lib/util.c:(454)
>[2006/05/09 08:52:33, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x71
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=3
>  smb_pid=65279
>  smb_uid=103
>  smb_mid=54209
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:33, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:33, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:37, 10] lib/util_sock.c:(618)
>  got smb length of 36
>[2006/05/09 08:52:37, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x24
>[2006/05/09 08:52:37, 3] smbd/process.c:(1194)
>  Transaction 99 of length 40
>[2006/05/09 08:52:37, 5] lib/util.c:(454)
>[2006/05/09 08:52:37, 5] lib/util.c:(457)
>  size=36
>  smb_com=0xa4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=54080
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:37, 3] smbd/process.c:(993)
>  switch message SMBntcancel (pid 404565) conn 0x140168050
>[2006/05/09 08:52:37, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:37, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:37, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:37, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:37, 3] smbd/error.c:(142)
>  error packet at smbd/notify.c(55) cmd=160 (SMBnttrans) NT_STATUS_CANCELLED
>[2006/05/09 08:52:37, 5] lib/util.c:(454)
>[2006/05/09 08:52:37, 5] lib/util.c:(457)
>  size=71
>  smb_com=0xa0
>  smb_rcls=32
>  smb_reh=1
>  smb_err=49152
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=2236
>  smb_uid=101
>  smb_mid=54080
>  smt_wct=18
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_bcc=0
>[2006/05/09 08:52:37, 3] smbd/nttrans.c:(1564)
>  reply_ntcancel: cancel called on mid = 54080.
>[2006/05/09 08:52:37, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:37, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:37, 10] lib/util_sock.c:(618)
>  got smb length of 41
>[2006/05/09 08:52:37, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x29
>[2006/05/09 08:52:37, 3] smbd/process.c:(1194)
>  Transaction 100 of length 45
>[2006/05/09 08:52:37, 5] lib/util.c:(454)
>[2006/05/09 08:52:37, 5] lib/util.c:(457)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=54272
>  smt_wct=3
>  smb_vwv[ 0]= 4559 (0x11CF)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2006/05/09 08:52:37, 3] smbd/process.c:(993)
>  switch message SMBclose (pid 404565) conn 0x140168050
>[2006/05/09 08:52:37, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:37, 5] auth/auth_util.c:(437)
>  NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410
>  contains 5 SIDs
>  SID[  0]: S-1-5-21-4112424572-1378032116-4237619202-1410
>  SID[  1]: S-1-5-21-4112424572-1378032116-4237619202-1031
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2006/05/09 08:52:37, 5] auth/auth_util.c:(454)
>  UNIX token of user 205
>  Primary group is 15 and contains 1 supplementary groups
>  Group[  0]: 15
>[2006/05/09 08:52:37, 5] smbd/uid.c:(308)
>  change_to_user uid=(0,205) gid=(0,15)
>[2006/05/09 08:52:37, 4] smbd/vfs.c:(738)
>  vfs_ChDir to /usr/users/pavan
>[2006/05/09 08:52:37, 3] smbd/reply.c:(3257)
>  close directory fnum=4559
>[2006/05/09 08:52:37, 10] locking/locking.c:(440)
>  parse_share_modes: delete_on_close: 0, num_share_modes: 2
>[2006/05/09 08:52:37, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[0]:  pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:37, 10] locking/locking.c:(487)
>  parse_share_modes: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x200000, access_mask = 0x100080, mid = 0x0, type= 0x40, file_id = 5, dev = 0xb9fe808d, inode = 48169
>[2006/05/09 08:52:37, 5] smbd/files.c:(449)
>  freed files structure 4559 (0 used)
>[2006/05/09 08:52:37, 5] lib/util.c:(454)
>[2006/05/09 08:52:37, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=54272
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:37, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:37, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:52:49, 10] lib/util_sock.c:(618)
>  got smb length of 35
>[2006/05/09 08:52:49, 6] smbd/process.c:(1193)
>  got message type 0x0 of len 0x23
>[2006/05/09 08:52:49, 3] smbd/process.c:(1194)
>  Transaction 101 of length 39
>[2006/05/09 08:52:49, 5] lib/util.c:(454)
>[2006/05/09 08:52:49, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x71
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=54336
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:49, 3] smbd/process.c:(993)
>  switch message SMBtdis (pid 404565) conn 0x140168050
>[2006/05/09 08:52:49, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:49, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:49, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:49, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:49, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:49, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:49, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:49, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:49, 1] smbd/service.c:(882)
>  nt218201 (15.76.218.201) closed connection to service pavan
>[2006/05/09 08:52:49, 3] smbd/connection.c:(69)
>  Yielding connection to pavan
>[2006/05/09 08:52:49, 4] smbd/vfs.c:(738)
>  vfs_ChDir to /
>[2006/05/09 08:52:49, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:52:49, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:52:49, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:52:49, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:52:49, 5] lib/util.c:(454)
>[2006/05/09 08:52:49, 5] lib/util.c:(457)
>  size=35
>  smb_com=0x71
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=54336
>  smt_wct=0
>  smb_bcc=0
>[2006/05/09 08:52:49, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:52:49, 10] smbd/process.c:(299)
>  run_events: No events
>[2006/05/09 08:53:49, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:53:49, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:53:49, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:53:49, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:53:49, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60
>[2006/05/09 08:54:49, 3] smbd/sec_ctx.c:(287)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2006/05/09 08:54:49, 5] auth/auth_util.c:(433)
>  NT user token: (NULL)
>[2006/05/09 08:54:49, 5] auth/auth_util.c:(454)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2006/05/09 08:54:49, 5] smbd/uid.c:(323)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2006/05/09 08:54:49, 3] smbd/process.c:(1428)
>  Printcap cache time expired.
>[2006/05/09 08:54:49, 3] printing/pcap.c:(117)
>  reloading printcap cache
>[2006/05/09 08:54:49, 3] printing/pcap.c:(223)
>  reload status: ok
>[2006/05/09 08:54:49, 3] printing/pcap.c:(117)
>  reloading printcap cache
>[2006/05/09 08:54:49, 3] printing/pcap.c:(223)
>  reload status: ok
>[2006/05/09 08:54:49, 10] smbd/process.c:(1372)
>  change_notify_timeout: 60

Actions: View

Attachments on bug 3767: 1895