The Samba-Bugzilla – Attachment 1895 Details for
Bug 3767
New files aren't shown unless we refresh the folder
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
smbd.log at debug=10
smbd.txt (text/plain), 640.29 KB, created by
pavan
on 2006-05-10 02:06:30 UTC
(
hide
)
Description:
smbd.log at debug=10
Filename:
MIME Type:
Creator:
pavan
Created:
2006-05-10 02:06:30 UTC
Size:
640.29 KB
patch
obsolete
>[2006/05/09 08:51:57, 6] param/loadparm.c:(2947) > lp_file_list_changed() > file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 > >[2006/05/09 08:51:57, 2] lib/interface.c:(81) > added interface ip=15.70.194.216 bcast=15.70.194.255 nmask=255.255.255.0 >[2006/05/09 08:51:57, 5] lib/util.c:(260) > Netbios name list:- > my_netbios_names[0]="CHEVY" >[2006/05/09 08:51:57, 3] lib/util.c:(2177) > set_maxfiles: setrlimit for RLIMIT_NOFILE for 10020 max files failed with error Invalid argument >[2006/05/09 08:51:57, 1] smbd/files.c:(196) > file_init: Information only: requested 10000 open files, 4076 are available. >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/05/09 08:51:57, 3] smbd/uid.c:(392) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:51:57, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:51:57, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(950) > Trying to load: smbpasswd >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(94) > Attempting to register passdb backend smbpasswd >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(107) > Successfully added passdb backend 'smbpasswd' >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(94) > Attempting to register passdb backend tdbsam >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(107) > Successfully added passdb backend 'tdbsam' >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(94) > Attempting to register passdb backend guest >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(107) > Successfully added passdb backend 'guest' >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(822) > Attempting to find an passdb backend to match smbpasswd (smbpasswd) >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(843) > Found pdb backend smbpasswd >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(846) > pdb backend smbpasswd has a valid init >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(822) > Attempting to find an passdb backend to match guest (guest) >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(843) > Found pdb backend guest >[2006/05/09 08:51:57, 5] passdb/pdb_interface.c:(846) > pdb backend guest has a valid init >[2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(1371) > smbpasswd_getsampwrid: search by sid: S-1-5-21-4112424572-1378032116-4237619202-501 >[2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(1322) > getsampwnam (smbpasswd): search by name: nobody >[2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(184) > startsmbfilepwent_internal: opening file /usr/local/samba/private/smbpasswd >[2006/05/09 08:51:57, 5] passdb/pdb_smbpasswd.c:(487) > getsmbfilepwent: returning passwd entry for user pavan, uid 205 >[2006/05/09 08:51:57, 5] passdb/pdb_smbpasswd.c:(539) > getsmbfilepwent: end of file reached. >[2006/05/09 08:51:57, 7] passdb/pdb_smbpasswd.c:(301) > endsmbfilepwent_internal: closed password file. >[2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(616) > pdb_set_username: setting username nobody, was >[2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(697) > pdb_set_full_name: setting full name nobody, was >[2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(643) > pdb_set_domain: setting domain CHEVY, was >[2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(543) > pdb_set_user_sid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-501 >[2006/05/09 08:51:57, 10] passdb/pdb_compat.c:(72) > pdb_set_user_sid_from_rid: > setting user sid S-1-5-21-4112424572-1378032116-4237619202-501 from rid 501 >[2006/05/09 08:51:57, 10] passdb/pdb_get_set.c:(579) > pdb_set_group_sid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-514 >[2006/05/09 08:51:57, 10] passdb/pdb_compat.c:(99) > pdb_set_group_sid_from_rid: > setting group sid S-1-5-21-4112424572-1378032116-4237619202-514 from rid 514 >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/05/09 08:51:57, 3] smbd/uid.c:(392) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:51:57, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:51:57, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:51:57, 10] lib/system_smbd.c:(167) > sys_getgrouplist: user [nobody] >[2006/05/09 08:51:57, 10] lib/system_smbd.c:(175) > sys_getgrouplist(): disabled winbindd for group lookup [user == nobody] >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2006/05/09 08:51:57, 3] smbd/uid.c:(392) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2006/05/09 08:51:57, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:51:57, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:51:57, 8] lib/system_smbd.c:(49) > remove_duplicate_gids: Enter 2 gids >[2006/05/09 08:51:57, 8] lib/system_smbd.c:(67) > remove_duplicate_gids: Exit 1 gids >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2006/05/09 08:51:57, 3] smbd/uid.c:(392) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2006/05/09 08:51:57, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:51:57, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:51:57, 10] passdb/passdb.c:(1244) > local_gid_to_sid: Fall back to algorithmic mapping: 65534 -> S-1-5-21-4112424572-1378032116-4237619202-132069 >[2006/05/09 08:51:57, 10] passdb/lookup_sid.c:(406) > gid_to_sid: local 65534 -> S-1-5-21-4112424572-1378032116-4237619202-132069 >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:51:57, 10] lib/privileges.c:(565) > grant_privilege: S-1-1-0 > original privilege mask: > SE_PRIV 0x0 0x0 0x0 0x0 > new privilege mask: > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:51:57, 10] lib/privileges.c:(565) > grant_privilege: S-1-5-32-544 > original privilege mask: > SE_PRIV 0x0 0x0 0x0 0x0 > new privilege mask: > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:51:57, 10] lib/privileges.c:(565) > grant_privilege: S-1-5-32-548 > original privilege mask: > SE_PRIV 0x0 0x0 0x0 0x0 > new privilege mask: > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:51:57, 10] lib/privileges.c:(565) > grant_privilege: S-1-5-32-549 > original privilege mask: > SE_PRIV 0x0 0x0 0x0 0x0 > new privilege mask: > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:51:57, 10] lib/privileges.c:(565) > grant_privilege: S-1-5-32-550 > original privilege mask: > SE_PRIV 0x0 0x0 0x0 0x0 > new privilege mask: > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:51:57, 10] lib/privileges.c:(565) > grant_privilege: S-1-5-32-551 > original privilege mask: > SE_PRIV 0x0 0x0 0x0 0x0 > new privilege mask: > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:51:57, 10] auth/auth_util.c:(437) > NT user token of user S-1-5-21-4112424572-1378032116-4237619202-501 > contains 6 SIDs > SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-501 > SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-514 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-32-546 > SID[ 5]: S-1-5-21-4112424572-1378032116-4237619202-132069 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:51:57, 5] auth/auth_util.c:(896) > make_server_info_sam: made server info for user nobody -> nobody >[2006/05/09 08:51:57, 3] smbd/server.c:(840) > loaded services >[2006/05/09 08:51:57, 3] smbd/server.c:(855) > Becoming a daemon. >[2006/05/09 08:51:57, 8] lib/util.c:(1820) > fcntl_lock 9 8 0 1 2 >[2006/05/09 08:51:57, 8] lib/util.c:(1855) > fcntl_lock: Lock call successful >[2006/05/09 08:51:57, 5] tdb/tdbutil.c:(772) > tdb(unnamed): tdb_brlock failed (fd=10) at offset 4 rw_type=2 lck_type=8: Permission denied >[2006/05/09 08:51:57, 2] lib/tallocmsg.c:(61) > Registered MSG_REQ_POOL_USAGE >[2006/05/09 08:51:57, 2] lib/dmallocmsg.c:(71) > Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED >[2006/05/09 08:51:57, 5] lib/gencache.c:(59) > Opening cache file at /usr/local/samba/var/locks/gencache.tdb >[2006/05/09 08:51:57, 5] libsmb/namecache.c:(57) > namecache_enable: enabling netbios namecache, timeout 660 seconds >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM] with subkey [SOFTWARE] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE] with subkey [Microsoft] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft] with subkey [Windows NT] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT] with subkey [CurrentVersion] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] with subkey [Print] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] with subkey [Printers] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM] with subkey [SOFTWARE] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE] with subkey [Microsoft] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft] with subkey [Windows NT] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT] with subkey [CurrentVersion] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] with subkey [Ports] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Control\Print] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM] with subkey [SYSTEM] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Control] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control] with subkey [Print] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Print] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM] with subkey [SYSTEM] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Services] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services] with subkey [LanmanServer] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer] with subkey [Shares] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM] with subkey [SYSTEM] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Services] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services] with subkey [Eventlog] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM] with subkey [SOFTWARE] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE] with subkey [Microsoft] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft] with subkey [Windows NT] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT] with subkey [CurrentVersion] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] with subkey [Perflib] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM] with subkey [SOFTWARE] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE] with subkey [Microsoft] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft] with subkey [Windows NT] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT] with subkey [CurrentVersion] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] with subkey [Perflib] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib] with subkey [009] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM] with subkey [SYSTEM] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Control] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control] with subkey [Print] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Print] with subkey [Monitors] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM] with subkey [SYSTEM] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Control] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control] with subkey [ProductOptions] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM] with subkey [SYSTEM] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Control] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control] with subkey [Terminal Server] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server] with subkey [DefaultUserConfiguration] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM] with subkey [SYSTEM] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Services] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services] with subkey [TcpIp] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\TcpIp] with subkey [Parameters] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM] with subkey [SYSTEM] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM] with subkey [CurrentControlSet] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet] with subkey [Services] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services] with subkey [Netlogon] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\Netlogon] with subkey [Parameters] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKU] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKU] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKCR] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKCR] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKPD] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKPD] with subkey [NULL] >[2006/05/09 08:51:57, 6] registry/reg_db.c:(104) > init_registry_data: Adding [HKPT] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(129) > init_registry_data: Storing key [HKPT] with subkey [NULL] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(562) > regdb_fetch_values: Looking for value of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports] >[2006/05/09 08:51:57, 8] registry/reg_db.c:(514) > specific: [Samba Printer Port], len: 2 >[2006/05/09 08:51:57, 10] registry/reg_db.c:(562) > regdb_fetch_values: Looking for value of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] >[2006/05/09 08:51:57, 8] registry/reg_db.c:(514) > specific: [DefaultSpoolDirectory], len: 70 >[2006/05/09 08:51:57, 10] registry/reg_db.c:(562) > regdb_fetch_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog] >[2006/05/09 08:51:57, 8] registry/reg_db.c:(514) > specific: [DisplayName], len: 20 >[2006/05/09 08:51:57, 8] registry/reg_db.c:(514) > specific: [ErrorControl], len: 4 >[2006/05/09 08:51:57, 10] registry/reg_db.c:(562) > regdb_fetch_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog] >[2006/05/09 08:51:57, 8] registry/reg_db.c:(514) > specific: [DisplayName], len: 20 >[2006/05/09 08:51:57, 8] registry/reg_db.c:(514) > specific: [ErrorControl], len: 4 >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(61) > reghook_cache_add: Adding key [/HKLM/SYSTEM/CurrentControlSet/Control/Print] >[2006/05/09 08:51:57, 8] lib/adt_tree.c:(201) > pathtree_add: Enter >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(267) > pathtree_add: Successfully added node [HKLM/SYSTEM/CurrentControlSet/Control/Print] to tree >[2006/05/09 08:51:57, 8] lib/adt_tree.c:(270) > pathtree_add: Exit >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(61) > reghook_cache_add: Adding key [/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Print/Printers] >[2006/05/09 08:51:57, 8] lib/adt_tree.c:(201) > pathtree_add: Enter >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(267) > pathtree_add: Successfully added node [HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Print/Printers] to tree >[2006/05/09 08:51:57, 8] lib/adt_tree.c:(270) > pathtree_add: Exit >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(61) > reghook_cache_add: Adding key [/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Ports] >[2006/05/09 08:51:57, 8] lib/adt_tree.c:(201) > pathtree_add: Enter >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(267) > pathtree_add: Successfully added node [HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Ports] to tree >[2006/05/09 08:51:57, 8] lib/adt_tree.c:(270) > pathtree_add: Exit >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(61) > reghook_cache_add: Adding key [/HKLM/SYSTEM/CurrentControlSet/Services/LanmanServer/Shares] >[2006/05/09 08:51:57, 8] lib/adt_tree.c:(201) > pathtree_add: Enter >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(267) > pathtree_add: Successfully added node [HKLM/SYSTEM/CurrentControlSet/Services/LanmanServer/Shares] to tree >[2006/05/09 08:51:57, 8] lib/adt_tree.c:(270) > pathtree_add: Exit >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/05/09 08:51:57, 3] smbd/uid.c:(392) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:51:57, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:51:57, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(1322) > getsampwnam (smbpasswd): search by name: root >[2006/05/09 08:51:57, 10] passdb/pdb_smbpasswd.c:(184) > startsmbfilepwent_internal: opening file /usr/local/samba/private/smbpasswd >[2006/05/09 08:51:57, 5] passdb/pdb_smbpasswd.c:(487) > getsmbfilepwent: returning passwd entry for user pavan, uid 205 >[2006/05/09 08:51:57, 5] passdb/pdb_smbpasswd.c:(539) > getsmbfilepwent: end of file reached. >[2006/05/09 08:51:57, 7] passdb/pdb_smbpasswd.c:(301) > endsmbfilepwent_internal: closed password file. >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:51:57, 4] passdb/passdb.c:(1145) > local_uid_to_sid: User root [uid == 0] has no samba account >[2006/05/09 08:51:57, 8] passdb/passdb.c:(1107) > algorithmic_uid_to_sid: falling back to RID algorithm >[2006/05/09 08:51:57, 10] passdb/passdb.c:(1110) > algorithmic_uid_to_sid: uid (0) -> SID S-1-5-21-4112424572-1378032116-4237619202-1000. >[2006/05/09 08:51:57, 10] passdb/passdb.c:(1153) > local_uid_to_sid: uid (0) -> SID S-1-5-21-4112424572-1378032116-4237619202-1000 (root). >[2006/05/09 08:51:57, 10] passdb/lookup_sid.c:(364) > uid_to_sid: local 0 -> S-1-5-21-4112424572-1378032116-4237619202-1000 >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/05/09 08:51:57, 3] smbd/uid.c:(392) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:51:57, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:51:57, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:51:57, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:51:57, 10] passdb/passdb.c:(1244) > local_gid_to_sid: Fall back to algorithmic mapping: 1 -> S-1-5-21-4112424572-1378032116-4237619202-1003 >[2006/05/09 08:51:57, 10] passdb/lookup_sid.c:(406) > gid_to_sid: local 1 -> S-1-5-21-4112424572-1378032116-4237619202-1003 >[2006/05/09 08:51:57, 10] auth/auth_util.c:(437) > NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1000 > contains 6 SIDs > SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1000 > SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1003 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-32-544 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:51:57, 10] registry/reg_db.c:(248) > regdb_open: incrementing refcount (1) >[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) > regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services] >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) > reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) > pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) > pathtree_find: Exit >[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) > registry_access_check: using root's token >[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-32-544 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f > se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 >[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) > se_access_check: access (f003f) granted. >[2006/05/09 08:51:57, 10] registry/reg_db.c:(248) > regdb_open: incrementing refcount (2) >[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) > regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\Spooler] >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) > reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/Spooler] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) > pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/Spooler] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) > pathtree_find: Exit >[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) > registry_access_check: using root's token >[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-32-544 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f > se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 >[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) > se_access_check: access (f003f) granted. >[2006/05/09 08:51:57, 10] registry/reg_db.c:(592) > regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Spooler] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(279) > regdb_close: decrementing refcount (2) >[2006/05/09 08:51:57, 10] registry/reg_db.c:(248) > regdb_open: incrementing refcount (2) >[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) > regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\Spooler\Security] >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) > reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/Spooler/Security] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) > pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/Spooler/Security] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) > pathtree_find: Exit >[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) > registry_access_check: using root's token >[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-32-544 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f > se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 >[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) > se_access_check: access (f003f) granted. >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(84) > 000000 sec_io_desc sec_desc >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0000 revision : 0001 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0002 type : 8004 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0004 off_owner_sid: 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0008 off_grp_sid : 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 000c off_sacl : 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0010 off_dacl : 00000014 >[2006/05/09 08:51:57, 6] rpc_parse/parse_prs.c:(84) > 000014 sec_io_acl dacl >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0014 revision: 0002 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0018 num_aces : 00000004 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 00001c sec_io_ace ace_list[00]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 001c type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 001d flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000020 sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0020 mask: 0002018d >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000024 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0024 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0025 num_auths : 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0026 id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0027 id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0028 id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0029 id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 002a id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 002b id_auth[5] : 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 002c sub_auths : 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 001e size : 0014 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 000030 sec_io_ace ace_list[01]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0030 type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0031 flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000034 sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0034 mask: 000201fd >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000038 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0038 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0039 num_auths : 02 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003a id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003b id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003c id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003d id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003e id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003f id_auth[5] : 05 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 0040 sub_auths : 00000020 00000223 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0032 size : 0018 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 000048 sec_io_ace ace_list[02]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0048 type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0049 flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 00004c sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 004c mask: 000f01ff >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000050 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0050 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0051 num_auths : 02 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0052 id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0053 id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0054 id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0055 id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0056 id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0057 id_auth[5] : 05 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 0058 sub_auths : 00000020 00000225 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 004a size : 0018 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 000060 sec_io_ace ace_list[03]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0060 type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0061 flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000064 sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0064 mask: 000f01ff >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000068 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0068 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0069 num_auths : 02 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006a id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006b id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006c id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006d id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006e id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006f id_auth[5] : 05 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 0070 sub_auths : 00000020 00000220 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0062 size : 0018 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0016 size : 0064 >[2006/05/09 08:51:57, 10] registry/reg_db.c:(592) > regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Spooler\Security] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(279) > regdb_close: decrementing refcount (2) >[2006/05/09 08:51:57, 10] registry/reg_db.c:(248) > regdb_open: incrementing refcount (2) >[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) > regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\NETLOGON] >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) > reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/NETLOGON] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) > pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/NETLOGON] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) > pathtree_find: Exit >[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) > registry_access_check: using root's token >[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-32-544 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f > se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 >[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) > se_access_check: access (f003f) granted. >[2006/05/09 08:51:57, 10] registry/reg_db.c:(592) > regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\NETLOGON] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(279) > regdb_close: decrementing refcount (2) >[2006/05/09 08:51:57, 10] registry/reg_db.c:(248) > regdb_open: incrementing refcount (2) >[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) > regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\NETLOGON\Security] >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) > reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/NETLOGON/Security] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) > pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/NETLOGON/Security] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) > pathtree_find: Exit >[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) > registry_access_check: using root's token >[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-32-544 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f > se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 >[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) > se_access_check: access (f003f) granted. >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(84) > 000000 sec_io_desc sec_desc >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0000 revision : 0001 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0002 type : 8004 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0004 off_owner_sid: 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0008 off_grp_sid : 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 000c off_sacl : 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0010 off_dacl : 00000014 >[2006/05/09 08:51:57, 6] rpc_parse/parse_prs.c:(84) > 000014 sec_io_acl dacl >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0014 revision: 0002 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0018 num_aces : 00000004 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 00001c sec_io_ace ace_list[00]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 001c type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 001d flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000020 sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0020 mask: 0002018d >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000024 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0024 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0025 num_auths : 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0026 id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0027 id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0028 id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0029 id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 002a id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 002b id_auth[5] : 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 002c sub_auths : 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 001e size : 0014 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 000030 sec_io_ace ace_list[01]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0030 type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0031 flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000034 sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0034 mask: 000201fd >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000038 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0038 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0039 num_auths : 02 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003a id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003b id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003c id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003d id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003e id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003f id_auth[5] : 05 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 0040 sub_auths : 00000020 00000223 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0032 size : 0018 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 000048 sec_io_ace ace_list[02]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0048 type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0049 flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 00004c sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 004c mask: 000f01ff >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000050 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0050 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0051 num_auths : 02 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0052 id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0053 id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0054 id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0055 id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0056 id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0057 id_auth[5] : 05 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 0058 sub_auths : 00000020 00000225 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 004a size : 0018 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 000060 sec_io_ace ace_list[03]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0060 type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0061 flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000064 sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0064 mask: 000f01ff >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000068 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0068 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0069 num_auths : 02 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006a id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006b id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006c id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006d id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006e id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006f id_auth[5] : 05 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 0070 sub_auths : 00000020 00000220 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0062 size : 0018 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0016 size : 0064 >[2006/05/09 08:51:57, 10] registry/reg_db.c:(592) > regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\NETLOGON\Security] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(279) > regdb_close: decrementing refcount (2) >[2006/05/09 08:51:57, 10] registry/reg_db.c:(248) > regdb_open: incrementing refcount (2) >[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) > regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry] >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) > reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/RemoteRegistry] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) > pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/RemoteRegistry] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) > pathtree_find: Exit >[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) > registry_access_check: using root's token >[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-32-544 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f > se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 >[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) > se_access_check: access (f003f) granted. >[2006/05/09 08:51:57, 10] registry/reg_db.c:(592) > regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(279) > regdb_close: decrementing refcount (2) >[2006/05/09 08:51:57, 10] registry/reg_db.c:(248) > regdb_open: incrementing refcount (2) >[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) > regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry\Security] >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) > reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/RemoteRegistry/Security] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) > pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/RemoteRegistry/Security] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) > pathtree_find: Exit >[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) > registry_access_check: using root's token >[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-32-544 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f > se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 >[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) > se_access_check: access (f003f) granted. >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(84) > 000000 sec_io_desc sec_desc >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0000 revision : 0001 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0002 type : 8004 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0004 off_owner_sid: 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0008 off_grp_sid : 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 000c off_sacl : 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0010 off_dacl : 00000014 >[2006/05/09 08:51:57, 6] rpc_parse/parse_prs.c:(84) > 000014 sec_io_acl dacl >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0014 revision: 0002 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0018 num_aces : 00000004 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 00001c sec_io_ace ace_list[00]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 001c type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 001d flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000020 sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0020 mask: 0002018d >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000024 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0024 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0025 num_auths : 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0026 id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0027 id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0028 id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0029 id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 002a id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 002b id_auth[5] : 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 002c sub_auths : 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 001e size : 0014 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 000030 sec_io_ace ace_list[01]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0030 type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0031 flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000034 sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0034 mask: 000201fd >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000038 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0038 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0039 num_auths : 02 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003a id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003b id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003c id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003d id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003e id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003f id_auth[5] : 05 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 0040 sub_auths : 00000020 00000223 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0032 size : 0018 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 000048 sec_io_ace ace_list[02]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0048 type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0049 flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 00004c sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 004c mask: 000f01ff >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000050 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0050 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0051 num_auths : 02 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0052 id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0053 id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0054 id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0055 id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0056 id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0057 id_auth[5] : 05 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 0058 sub_auths : 00000020 00000225 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 004a size : 0018 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 000060 sec_io_ace ace_list[03]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0060 type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0061 flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000064 sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0064 mask: 000f01ff >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000068 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0068 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0069 num_auths : 02 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006a id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006b id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006c id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006d id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006e id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006f id_auth[5] : 05 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 0070 sub_auths : 00000020 00000220 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0062 size : 0018 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0016 size : 0064 >[2006/05/09 08:51:57, 10] registry/reg_db.c:(592) > regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry\Security] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(279) > regdb_close: decrementing refcount (2) >[2006/05/09 08:51:57, 10] registry/reg_db.c:(248) > regdb_open: incrementing refcount (2) >[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) > regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\WINS] >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) > reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/WINS] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) > pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/WINS] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) > pathtree_find: Exit >[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) > registry_access_check: using root's token >[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-32-544 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f > se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 >[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) > se_access_check: access (f003f) granted. >[2006/05/09 08:51:57, 10] registry/reg_db.c:(592) > regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\WINS] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(279) > regdb_close: decrementing refcount (2) >[2006/05/09 08:51:57, 10] registry/reg_db.c:(248) > regdb_open: incrementing refcount (2) >[2006/05/09 08:51:57, 7] registry/reg_frontend.c:(359) > regkey_open_internal: name = [HKLM\SYSTEM\CurrentControlSet\Services\WINS\Security] >[2006/05/09 08:51:57, 10] registry/reg_cachehook.c:(95) > reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/WINS/Security] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(341) > pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/WINS/Security] >[2006/05/09 08:51:57, 10] lib/adt_tree.c:(413) > pathtree_find: Exit >[2006/05/09 08:51:57, 5] registry/reg_frontend.c:(59) > registry_access_check: using root's token >[2006/05/09 08:51:57, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x000f003f, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1000. >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:51:57, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1000 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1003 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-32-544 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = f003f > se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-32-544 mask = f003f, current desired = d0026 >[2006/05/09 08:51:57, 5] lib/util_seaccess.c:(308) > se_access_check: access (f003f) granted. >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(84) > 000000 sec_io_desc sec_desc >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0000 revision : 0001 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0002 type : 8004 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0004 off_owner_sid: 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0008 off_grp_sid : 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 000c off_sacl : 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0010 off_dacl : 00000014 >[2006/05/09 08:51:57, 6] rpc_parse/parse_prs.c:(84) > 000014 sec_io_acl dacl >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0014 revision: 0002 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0018 num_aces : 00000004 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 00001c sec_io_ace ace_list[00]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 001c type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 001d flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000020 sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0020 mask: 0002018d >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000024 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0024 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0025 num_auths : 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0026 id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0027 id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0028 id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0029 id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 002a id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 002b id_auth[5] : 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 002c sub_auths : 00000000 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 001e size : 0014 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 000030 sec_io_ace ace_list[01]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0030 type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0031 flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000034 sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0034 mask: 000201fd >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000038 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0038 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0039 num_auths : 02 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003a id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003b id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003c id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003d id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003e id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 003f id_auth[5] : 05 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 0040 sub_auths : 00000020 00000223 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0032 size : 0018 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 000048 sec_io_ace ace_list[02]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0048 type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0049 flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 00004c sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 004c mask: 000f01ff >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000050 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0050 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0051 num_auths : 02 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0052 id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0053 id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0054 id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0055 id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0056 id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0057 id_auth[5] : 05 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 0058 sub_auths : 00000020 00000225 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 004a size : 0018 >[2006/05/09 08:51:57, 7] rpc_parse/parse_prs.c:(84) > 000060 sec_io_ace ace_list[03]: >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0060 type : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0061 flags: 00 >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000064 sec_io_access info >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(703) > 0064 mask: 000f01ff >[2006/05/09 08:51:57, 8] rpc_parse/parse_prs.c:(84) > 000068 smb_io_dom_sid trustee >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0068 sid_rev_num: 01 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 0069 num_auths : 02 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006a id_auth[0] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006b id_auth[1] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006c id_auth[2] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006d id_auth[3] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006e id_auth[4] : 00 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(614) > 006f id_auth[5] : 05 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(959) > 0070 sub_auths : 00000020 00000220 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0062 size : 0018 >[2006/05/09 08:51:57, 5] rpc_parse/parse_prs.c:(674) > 0016 size : 0064 >[2006/05/09 08:51:57, 10] registry/reg_db.c:(592) > regdb_store_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\WINS\Security] >[2006/05/09 08:51:57, 10] registry/reg_db.c:(279) > regdb_close: decrementing refcount (2) >[2006/05/09 08:51:57, 10] registry/reg_db.c:(279) > regdb_close: decrementing refcount (1) >[2006/05/09 08:51:57, 10] registry/reg_db.c:(279) > regdb_close: decrementing refcount (0) >[2006/05/09 08:51:57, 10] printing/nt_printing.c:(689) > update_c_setprinter: c_setprinter = 0 >[2006/05/09 08:51:57, 5] smbd/connection.c:(170) > claiming 0 >[2006/05/09 08:51:57, 3] printing/printing.c:(1379) > start_background_queue: Starting background LPQ thread >[2006/05/09 08:51:57, 10] lib/util_sock.c:(835) > bind succeeded on port 445 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_KEEPALIVE = 8 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_REUSEADDR = 4 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_BROADCAST = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_NODELAY = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_KEEPCNT = 8 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_KEEPIDLE = 7200 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_KEEPINTVL = 75 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option IPTOS_LOWDELAY = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option IPTOS_THROUGHPUT = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_REUSEPORT = 512 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_SNDBUF = 61440 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_RCVBUF = 61440 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_SNDLOWAT = 8192 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_RCVLOWAT = 1 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_SNDTIMEO = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_RCVTIMEO = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_KEEPALIVE = 8 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_REUSEADDR = 4 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_BROADCAST = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_NODELAY = 4 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_KEEPCNT = 8 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_KEEPIDLE = 7200 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_KEEPINTVL = 75 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option IPTOS_LOWDELAY = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option IPTOS_THROUGHPUT = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_REUSEPORT = 512 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_SNDBUF = 61440 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_RCVBUF = 61440 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_SNDLOWAT = 8192 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_RCVLOWAT = 1 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_SNDTIMEO = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_RCVTIMEO = 0 >[2006/05/09 08:51:57, 10] lib/util_sock.c:(835) > bind succeeded on port 139 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_KEEPALIVE = 8 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_REUSEADDR = 4 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_BROADCAST = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_NODELAY = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_KEEPCNT = 8 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_KEEPIDLE = 7200 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_KEEPINTVL = 75 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option IPTOS_LOWDELAY = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option IPTOS_THROUGHPUT = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_REUSEPORT = 512 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_SNDBUF = 61440 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_RCVBUF = 61440 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_SNDLOWAT = 8192 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_RCVLOWAT = 1 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_SNDTIMEO = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_RCVTIMEO = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_KEEPALIVE = 8 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_REUSEADDR = 4 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_BROADCAST = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_NODELAY = 4 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_KEEPCNT = 8 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_KEEPIDLE = 7200 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option TCP_KEEPINTVL = 75 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option IPTOS_LOWDELAY = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option IPTOS_THROUGHPUT = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_REUSEPORT = 512 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_SNDBUF = 61440 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_RCVBUF = 61440 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_SNDLOWAT = 8192 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_RCVLOWAT = 1 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_SNDTIMEO = 0 >[2006/05/09 08:51:57, 5] lib/util_sock.c:(206) > socket option SO_RCVTIMEO = 0 >[2006/05/09 08:51:57, 2] smbd/server.c:(336) > waiting for a connection >[2006/05/09 08:51:57, 5] printing/printing.c:(1389) > start_background_queue: background LPQ thread started >[2006/05/09 08:51:57, 5] smbd/connection.c:(170) > claiming smbd lpq backend 0 >[2006/05/09 08:51:57, 5] printing/printing.c:(1400) > start_background_queue: background LPQ thread waiting for messages >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_KEEPALIVE = 8 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_REUSEADDR = 4 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_BROADCAST = 0 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option TCP_NODELAY = 0 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option TCP_KEEPCNT = 8 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option TCP_KEEPIDLE = 7200 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option TCP_KEEPINTVL = 75 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option IPTOS_LOWDELAY = 0 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option IPTOS_THROUGHPUT = 0 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_REUSEPORT = 512 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_SNDBUF = 61440 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_RCVBUF = 61440 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_SNDLOWAT = 536 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_RCVLOWAT = 1 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_SNDTIMEO = 0 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_RCVTIMEO = 0 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_KEEPALIVE = 8 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_REUSEADDR = 4 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_BROADCAST = 0 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option TCP_NODELAY = 4 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option TCP_KEEPCNT = 8 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option TCP_KEEPIDLE = 7200 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option TCP_KEEPINTVL = 75 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option IPTOS_LOWDELAY = 0 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option IPTOS_THROUGHPUT = 0 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_REUSEPORT = 512 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_SNDBUF = 61440 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_RCVBUF = 61440 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_SNDLOWAT = 536 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_RCVLOWAT = 1 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_SNDTIMEO = 0 >[2006/05/09 08:52:19, 5] lib/util_sock.c:(206) > socket option SO_RCVTIMEO = 0 >[2006/05/09 08:52:19, 6] param/loadparm.c:(2947) > lp_file_list_changed() > file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 > >[2006/05/09 08:52:19, 3] smbd/oplock.c:(871) > open_oplock_ipc: initializing messages. >[2006/05/09 08:52:19, 4] lib/time.c:(142) > TimeInit: Serverzone is -19800 >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 133 >[2006/05/09 08:52:19, 3] lib/access.c:(291) > only_ipaddrs_in_list: list has non-ip address (.india.hp.com) >[2006/05/09 08:52:19, 3] lib/access.c:(316) > check_access: hostnames in host allow/deny list. >[2006/05/09 08:52:19, 2] lib/access.c:(322) > Allowed connection from nt218201.india.hp.com (15.76.218.201) >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x85 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 0 of length 137 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=133 > smb_com=0x72 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51283 > smb_tid=0 > smb_pid=65279 > smb_uid=0 > smb_mid=0 > smt_wct=0 > smb_bcc=98 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 02 50 43 20 4E 45 54 57 4F 52 4B 20 50 52 4F 47 .PC NETW ORK PROG > [010] 52 41 4D 20 31 2E 30 00 02 4C 41 4E 4D 41 4E 31 RAM 1.0. .LANMAN1 > [020] 2E 30 00 02 57 69 6E 64 6F 77 73 20 66 6F 72 20 .0..Wind ows for > [030] 57 6F 72 6B 67 72 6F 75 70 73 20 33 2E 31 61 00 Workgrou ps 3.1a. > [040] 02 4C 4D 31 2E 32 58 30 30 32 00 02 4C 41 4E 4D .LM1.2X0 02..LANM > [050] 41 4E 32 2E 31 00 02 4E 54 20 4C 4D 20 30 2E 31 AN2.1..N T LM 0.1 > [060] 32 00 2. >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBnegprot (pid 404565) conn 0x0 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:19, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:19, 3] smbd/negprot.c:(486) > Requested protocol [PC NETWORK PROGRAM 1.0] >[2006/05/09 08:52:19, 3] smbd/negprot.c:(486) > Requested protocol [LANMAN1.0] >[2006/05/09 08:52:19, 3] smbd/negprot.c:(486) > Requested protocol [Windows for Workgroups 3.1a] >[2006/05/09 08:52:19, 3] smbd/negprot.c:(486) > Requested protocol [LM1.2X002] >[2006/05/09 08:52:19, 3] smbd/negprot.c:(486) > Requested protocol [LANMAN2.1] >[2006/05/09 08:52:19, 3] smbd/negprot.c:(486) > Requested protocol [NT LM 0.12] >[2006/05/09 08:52:19, 10] lib/util.c:(2033) > set_remote_arch: Client arch is 'Win2K' >[2006/05/09 08:52:19, 6] param/loadparm.c:(2947) > lp_file_list_changed() > file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 > >[2006/05/09 08:52:19, 5] smbd/connection.c:(170) > claiming 0 >[2006/05/09 08:52:19, 6] param/loadparm.c:(2947) > lp_file_list_changed() > file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 > >[2006/05/09 08:52:19, 3] smbd/negprot.c:(357) > using SPNEGO >[2006/05/09 08:52:19, 3] smbd/negprot.c:(579) > Selected protocol NT LM 0.12 >[2006/05/09 08:52:19, 5] smbd/negprot.c:(585) > negprot index=5 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=127 > smb_com=0x72 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=65279 > smb_uid=0 > smb_mid=0 > smt_wct=17 > smb_vwv[ 0]= 5 (0x5) > smb_vwv[ 1]=12803 (0x3203) > smb_vwv[ 2]= 256 (0x100) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 65 (0x41) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 256 (0x100) > smb_vwv[ 7]=21760 (0x5500) > smb_vwv[ 8]= 1580 (0x62C) > smb_vwv[ 9]=64768 (0xFD00) > smb_vwv[10]=32995 (0x80E3) > smb_vwv[11]=32896 (0x8080) > smb_vwv[12]=12711 (0x31A7) > smb_vwv[13]= 6087 (0x17C7) > smb_vwv[14]=50803 (0xC673) > smb_vwv[15]=46593 (0xB601) > smb_vwv[16]= 254 (0xFE) > smb_bcc=58 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 63 68 65 76 79 00 00 00 00 00 00 00 00 00 00 00 chevy... ........ > [010] 60 28 06 06 2B 06 01 05 05 02 A0 1E 30 1C A0 0E `(..+... ....0... > [020] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A3 0A 0...+... ..7..... > [030] 30 08 A0 06 1B 04 4E 4F 4E 45 0.....NO NE >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 236 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0xec >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 1 of length 240 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=236 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=0 > smb_mid=48000 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 236 (0xEC) > smb_vwv[ 2]=16644 (0x4104) > smb_vwv[ 3]= 50 (0x32) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 74 (0x4A) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 212 (0xD4) > smb_vwv[11]=40960 (0xA000) > smb_bcc=177 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 60 48 06 06 2B 06 01 05 05 02 A0 3E 30 3C A0 0E `H..+... ...>0<.. > [010] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A2 2A 0...+... ..7....* > [020] 04 28 4E 54 4C 4D 53 53 50 00 01 00 00 00 97 82 .(NTLMSS P....... > [030] 08 E2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [040] 00 00 05 01 28 0A 00 00 00 0F 00 57 00 69 00 6E ....(... ...W.i.n > [050] 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 00 30 .d.o.w.s . .2.0.0 > [060] 00 32 00 20 00 53 00 65 00 72 00 76 00 69 00 63 .2. .S.e .r.v.i.c > [070] 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 32 .e. .P.a .c.k. .2 > [080] 00 20 00 32 00 36 00 30 00 30 00 00 00 57 00 69 . .2.6.0 .0...W.i > [090] 00 6E 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 .n.d.o.w .s. .2.0 > [0A0] 00 30 00 32 00 20 00 35 00 2E 00 31 00 00 00 00 .0.2. .5 ...1.... > [0B0] 00 . >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBsesssetupX (pid 404565) conn 0x0 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:19, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(822) > wct=12 flg2=0xc807 >[2006/05/09 08:52:19, 2] smbd/sesssetup.c:(772) > setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. >[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(633) > Doing spnego session setup >[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(663) > NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] >[2006/05/09 08:52:19, 10] lib/util.c:(2033) > set_remote_arch: Client arch is 'WinXP' >[2006/05/09 08:52:19, 10] smbd/password.c:(182) > register_vuid: allocated vuid = 100 >[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(525) > Got OID 1 3 6 1 4 1 311 2 2 10 >[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(528) > Got secblob of size 40 >[2006/05/09 08:52:19, 5] auth/auth.c:(485) > Making default auth method list for standalone security=user, encrypt passwords = yes >[2006/05/09 08:52:19, 5] auth/auth.c:(45) > Attempting to register auth backend rhosts >[2006/05/09 08:52:19, 5] auth/auth.c:(57) > Successfully added auth method 'rhosts' >[2006/05/09 08:52:19, 5] auth/auth.c:(45) > Attempting to register auth backend hostsequiv >[2006/05/09 08:52:19, 5] auth/auth.c:(57) > Successfully added auth method 'hostsequiv' >[2006/05/09 08:52:19, 5] auth/auth.c:(45) > Attempting to register auth backend sam >[2006/05/09 08:52:19, 5] auth/auth.c:(57) > Successfully added auth method 'sam' >[2006/05/09 08:52:19, 5] auth/auth.c:(45) > Attempting to register auth backend sam_ignoredomain >[2006/05/09 08:52:19, 5] auth/auth.c:(57) > Successfully added auth method 'sam_ignoredomain' >[2006/05/09 08:52:19, 5] auth/auth.c:(45) > Attempting to register auth backend unix >[2006/05/09 08:52:19, 5] auth/auth.c:(57) > Successfully added auth method 'unix' >[2006/05/09 08:52:19, 5] auth/auth.c:(45) > Attempting to register auth backend winbind >[2006/05/09 08:52:19, 5] auth/auth.c:(57) > Successfully added auth method 'winbind' >[2006/05/09 08:52:19, 5] auth/auth.c:(45) > Attempting to register auth backend smbserver >[2006/05/09 08:52:19, 5] auth/auth.c:(57) > Successfully added auth method 'smbserver' >[2006/05/09 08:52:19, 5] auth/auth.c:(45) > Attempting to register auth backend trustdomain >[2006/05/09 08:52:19, 5] auth/auth.c:(57) > Successfully added auth method 'trustdomain' >[2006/05/09 08:52:19, 5] auth/auth.c:(45) > Attempting to register auth backend ntdomain >[2006/05/09 08:52:19, 5] auth/auth.c:(57) > Successfully added auth method 'ntdomain' >[2006/05/09 08:52:19, 5] auth/auth.c:(45) > Attempting to register auth backend guest >[2006/05/09 08:52:19, 5] auth/auth.c:(57) > Successfully added auth method 'guest' >[2006/05/09 08:52:19, 5] auth/auth.c:(388) > load_auth_module: Attempting to find an auth method to match guest >[2006/05/09 08:52:19, 5] auth/auth.c:(413) > load_auth_module: auth method guest has a valid init >[2006/05/09 08:52:19, 5] auth/auth.c:(388) > load_auth_module: Attempting to find an auth method to match sam >[2006/05/09 08:52:19, 5] auth/auth.c:(413) > load_auth_module: auth method sam has a valid init >[2006/05/09 08:52:19, 3] libsmb/ntlmssp.c:(63) > Got NTLMSSP neg_flags=0xe2088297 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_NEGOTIATE_OEM > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_LM_KEY > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH > NTLMSSP_NEGOTIATE_56 >[2006/05/09 08:52:19, 5] auth/auth.c:(95) > auth_get_challenge: module guest did not want to specify a challenge >[2006/05/09 08:52:19, 5] auth/auth.c:(95) > auth_get_challenge: module sam did not want to specify a challenge >[2006/05/09 08:52:19, 5] auth/auth.c:(135) > auth_context challenge created by random >[2006/05/09 08:52:19, 5] auth/auth.c:(136) > challenge is: >[2006/05/09 08:52:19, 5] lib/util.c:(2058) > [000] BD E8 AC 7D BD 2D 5F F8 ...}.-_. >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=290 > smb_com=0x73 > smb_rcls=22 > smb_reh=0 > smb_err=49152 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=65279 > smb_uid=100 > smb_mid=48000 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 189 (0xBD) > smb_bcc=247 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] A1 81 BA 30 81 B7 A0 03 0A 01 01 A1 0C 06 0A 2B ...0.... .......+ > [010] 06 01 04 01 82 37 02 02 0A A2 81 A1 04 81 9E 4E .....7.. .......N > [020] 54 4C 4D 53 53 50 00 02 00 00 00 0A 00 0A 00 30 TLMSSP.. .......0 > [030] 00 00 00 B5 82 8A 60 BD E8 AC 7D BD 2D 5F F8 00 ......`. ..}.-_.. > [040] 00 00 00 00 00 00 00 64 00 64 00 3A 00 00 00 43 .......d .d.:...C > [050] 00 48 00 45 00 56 00 59 00 02 00 0A 00 43 00 48 .H.E.V.Y .....C.H > [060] 00 45 00 56 00 59 00 01 00 0A 00 43 00 48 00 45 .E.V.Y.. ...C.H.E > [070] 00 56 00 59 00 04 00 18 00 69 00 6E 00 64 00 69 .V.Y.... .i.n.d.i > [080] 00 61 00 2E 00 68 00 70 00 2E 00 63 00 6F 00 6D .a...h.p ...c.o.m > [090] 00 03 00 24 00 63 00 68 00 65 00 76 00 79 00 2E ...$.c.h .e.v.y.. > [0A0] 00 69 00 6E 00 64 00 69 00 61 00 2E 00 68 00 70 .i.n.d.i .a...h.p > [0B0] 00 2E 00 63 00 6F 00 6D 00 00 00 00 00 55 00 6E ...c.o.m .....U.n > [0C0] 00 69 00 78 00 00 00 53 00 61 00 6D 00 62 00 61 .i.x...S .a.m.b.a > [0D0] 00 20 00 33 00 2E 00 30 00 2E 00 32 00 31 00 63 . .3...0 ...2.1.c > [0E0] 00 00 00 57 00 4F 00 52 00 4B 00 47 00 52 00 4F ...W.O.R .K.G.R.O > [0F0] 00 55 00 50 00 00 00 .U.P... >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 358 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x166 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 2 of length 362 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=358 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=100 > smb_mid=48064 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 358 (0x166) > smb_vwv[ 2]=16644 (0x4104) > smb_vwv[ 3]= 50 (0x32) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 196 (0xC4) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 212 (0xD4) > smb_vwv[11]=40960 (0xA000) > smb_bcc=299 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] A1 81 C1 30 81 BE A2 81 BB 04 81 B8 4E 54 4C 4D ...0.... ....NTLM > [010] 53 53 50 00 03 00 00 00 18 00 18 00 78 00 00 00 SSP..... ....x... > [020] 18 00 18 00 90 00 00 00 16 00 16 00 48 00 00 00 ........ ....H... > [030] 0A 00 0A 00 5E 00 00 00 10 00 10 00 68 00 00 00 ....^... ....h... > [040] 10 00 10 00 A8 00 00 00 15 82 88 62 05 01 28 0A ........ ...b..(. > [050] 00 00 00 0F 41 00 53 00 49 00 41 00 50 00 41 00 ....A.S. I.A.P.A. > [060] 43 00 49 00 46 00 49 00 43 00 70 00 61 00 76 00 C.I.F.I. C.p.a.v. > [070] 61 00 6E 00 4E 00 54 00 32 00 31 00 38 00 32 00 a.n.N.T. 2.1.8.2. > [080] 30 00 31 00 DC 61 60 1C 65 FB 38 FC 00 00 00 00 0.1..a`. e.8..... > [090] 00 00 00 00 00 00 00 00 00 00 00 00 3E 8F 59 A6 ........ ....>.Y. > [0A0] FE C9 4E E3 3E BE A4 13 9D 32 AB 5D 77 AB 70 C5 ..N.>... .2.]w.p. > [0B0] 04 E4 13 E5 FD 9E 8B D6 01 08 CD B9 5A 7C 56 EE ........ ....Z|V. > [0C0] 4A 67 BB 91 00 57 00 69 00 6E 00 64 00 6F 00 77 Jg...W.i .n.d.o.w > [0D0] 00 73 00 20 00 32 00 30 00 30 00 32 00 20 00 53 .s. .2.0 .0.2. .S > [0E0] 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 50 .e.r.v.i .c.e. .P > [0F0] 00 61 00 63 00 6B 00 20 00 32 00 20 00 32 00 36 .a.c.k. .2. .2.6 > [100] 00 30 00 30 00 00 00 57 00 69 00 6E 00 64 00 6F .0.0...W .i.n.d.o > [110] 00 77 00 73 00 20 00 32 00 30 00 30 00 32 00 20 .w.s. .2 .0.0.2. > [120] 00 35 00 2E 00 31 00 00 00 00 00 .5...1.. ... >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBsesssetupX (pid 404565) conn 0x0 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:19, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(822) > wct=12 flg2=0xc807 >[2006/05/09 08:52:19, 2] smbd/sesssetup.c:(772) > setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. >[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(633) > Doing spnego session setup >[2006/05/09 08:52:19, 3] smbd/sesssetup.c:(663) > NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] >[2006/05/09 08:52:19, 3] libsmb/ntlmssp.c:(661) > Got user=[pavan] domain=[ASIAPACIFIC] workstation=[NT218201] len1=24 len2=24 >[2006/05/09 08:52:19, 5] auth/auth_ntlmssp.c:(66) > auth_context challenge set by NTLMSSP callback (NTLM2) >[2006/05/09 08:52:19, 5] auth/auth_ntlmssp.c:(67) > challenge is: >[2006/05/09 08:52:19, 5] lib/util.c:(2058) > [000] 30 67 A2 E8 9F 98 02 95 0g...... >[2006/05/09 08:52:19, 6] param/loadparm.c:(2947) > lp_file_list_changed() > file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 > >[2006/05/09 08:52:19, 5] auth/auth_util.c:(162) > make_user_info_map: Mapping user [ASIAPACIFIC]\[pavan] from workstation [NT218201] >[2006/05/09 08:52:19, 5] auth/auth_util.c:(69) > attempting to make a user_info for pavan (pavan) >[2006/05/09 08:52:19, 5] auth/auth_util.c:(79) > making strings for pavan's user_info struct >[2006/05/09 08:52:19, 5] auth/auth_util.c:(121) > making blobs for pavan's user_info struct >[2006/05/09 08:52:19, 10] auth/auth_util.c:(139) > made an encrypted user_info for pavan (pavan) >[2006/05/09 08:52:19, 3] auth/auth.c:(218) > check_ntlm_password: Checking password for unmapped user [ASIAPACIFIC]\[pavan]@[NT218201] with the new password interface >[2006/05/09 08:52:19, 3] auth/auth.c:(221) > check_ntlm_password: mapped user is: [CHEVY]\[pavan]@[NT218201] >[2006/05/09 08:52:19, 10] auth/auth.c:(230) > check_ntlm_password: auth_context challenge created by NTLMSSP callback (NTLM2) >[2006/05/09 08:52:19, 10] auth/auth.c:(233) > challenge is: >[2006/05/09 08:52:19, 5] lib/util.c:(2058) > [000] 30 67 A2 E8 9F 98 02 95 0g...... >[2006/05/09 08:52:19, 10] auth/auth.c:(259) > check_ntlm_password: guest had nothing to say >[2006/05/09 08:52:19, 8] lib/util.c:(1879) > is_myname("CHEVY") returns 1 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:19, 3] smbd/uid.c:(392) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:19, 10] passdb/pdb_smbpasswd.c:(1322) > getsampwnam (smbpasswd): search by name: pavan >[2006/05/09 08:52:19, 10] passdb/pdb_smbpasswd.c:(184) > startsmbfilepwent_internal: opening file /usr/local/samba/private/smbpasswd >[2006/05/09 08:52:19, 5] passdb/pdb_smbpasswd.c:(487) > getsmbfilepwent: returning passwd entry for user pavan, uid 205 >[2006/05/09 08:52:19, 7] passdb/pdb_smbpasswd.c:(301) > endsmbfilepwent_internal: closed password file. >[2006/05/09 08:52:19, 10] passdb/pdb_smbpasswd.c:(1344) > getsampwnam (smbpasswd): found by name: pavan >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(616) > pdb_set_username: setting username pavan, was >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(697) > pdb_set_full_name: setting full name pavan, was >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(832) > pdb_set_unix_homedir: setting home dir /usr/users/pavan, was NULL >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(643) > pdb_set_domain: setting domain CHEVY, was >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(543) > pdb_set_user_sid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-1410 >[2006/05/09 08:52:19, 10] passdb/pdb_compat.c:(72) > pdb_set_user_sid_from_rid: > setting user sid S-1-5-21-4112424572-1378032116-4237619202-1410 from rid 1410 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2006/05/09 08:52:19, 3] smbd/uid.c:(392) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(579) > pdb_set_group_sid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-1031 >[2006/05/09 08:52:19, 10] passdb/pdb_compat.c:(99) > pdb_set_group_sid_from_rid: > setting group sid S-1-5-21-4112424572-1378032116-4237619202-1031 from rid 1031 >[2006/05/09 08:52:19, 4] lib/substitute.c:(359) > Home server: chevy >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(751) > pdb_set_profile_path: setting profile path \\chevy\pavan\profile, was >[2006/05/09 08:52:19, 4] lib/substitute.c:(359) > Home server: chevy >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(805) > pdb_set_homedir: setting home dir \\chevy\pavan, was >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(778) > pdb_set_dir_drive: setting dir drive , was NULL >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(724) > pdb_set_logon_script: setting logon script , was >[2006/05/09 08:52:19, 10] lib/account_pol.c:(332) > account_policy_get: name: password history, val: 0 >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(616) > pdb_set_username: setting username pavan, was >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(643) > pdb_set_domain: setting domain CHEVY, was >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(670) > pdb_set_nt_username: setting nt username , was >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(697) > pdb_set_full_name: setting full name pavan, was >[2006/05/09 08:52:19, 4] lib/substitute.c:(359) > Home server: chevy >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(805) > pdb_set_homedir: setting home dir \\chevy\pavan, was >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(778) > pdb_set_dir_drive: setting dir drive , was NULL >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(724) > pdb_set_logon_script: setting logon script , was >[2006/05/09 08:52:19, 4] lib/substitute.c:(359) > Home server: chevy >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(751) > pdb_set_profile_path: setting profile path \\chevy\pavan\profile, was >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(884) > pdb_set_workstations: setting workstations , was >[2006/05/09 08:52:19, 10] lib/account_pol.c:(332) > account_policy_get: name: password history, val: 0 >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(543) > pdb_set_user_sid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-1410 >[2006/05/09 08:52:19, 10] passdb/pdb_compat.c:(72) > pdb_set_user_sid_from_rid: > setting user sid S-1-5-21-4112424572-1378032116-4237619202-1410 from rid 1410 >[2006/05/09 08:52:19, 10] passdb/pdb_get_set.c:(579) > pdb_set_group_sid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-1031 >[2006/05/09 08:52:19, 10] passdb/pdb_compat.c:(99) > pdb_set_group_sid_from_rid: > setting group sid S-1-5-21-4112424572-1378032116-4237619202-1031 from rid 1031 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 9] passdb/passdb.c:(2337) > pdb_update_autolock_flag: Account pavan not autolocked, no check needed >[2006/05/09 08:52:19, 4] libsmb/ntlm_check.c:(326) > ntlm_password_check: Checking NT MD4 password >[2006/05/09 08:52:19, 4] auth/auth_sam.c:(123) > sam_account_ok: Checking SMB password for user pavan >[2006/05/09 08:52:19, 5] auth/auth_sam.c:(104) > logon_hours_ok: user pavan allowed to logon at this time (Tue May 9 08:52:19 2006 > ) >[2006/05/09 08:52:19, 10] lib/util_pw.c:(98) > Got pavan from pwnam_cache >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:19, 3] smbd/uid.c:(392) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:19, 10] lib/system_smbd.c:(167) > sys_getgrouplist: user [pavan] >[2006/05/09 08:52:19, 10] lib/system_smbd.c:(175) > sys_getgrouplist(): disabled winbindd for group lookup [user == pavan] >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2006/05/09 08:52:19, 3] smbd/uid.c:(392) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:19, 8] lib/system_smbd.c:(49) > remove_duplicate_gids: Enter 2 gids >[2006/05/09 08:52:19, 8] lib/system_smbd.c:(67) > remove_duplicate_gids: Exit 1 gids >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2006/05/09 08:52:19, 3] smbd/uid.c:(392) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:19, 10] passdb/passdb.c:(1244) > local_gid_to_sid: Fall back to algorithmic mapping: 15 -> S-1-5-21-4112424572-1378032116-4237619202-1031 >[2006/05/09 08:52:19, 10] passdb/lookup_sid.c:(406) > gid_to_sid: local 15 -> S-1-5-21-4112424572-1378032116-4237619202-1031 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 10] auth/auth_util.c:(437) > NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 > contains 5 SIDs > SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 > SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(896) > make_server_info_sam: made server info for user pavan -> pavan >[2006/05/09 08:52:19, 3] auth/auth.c:(267) > check_ntlm_password: sam authentication for user [pavan] succeeded >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:19, 3] smbd/uid.c:(392) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 5] auth/auth.c:(293) > check_ntlm_password: PAM Account for user [pavan] succeeded >[2006/05/09 08:52:19, 2] auth/auth.c:(302) > check_ntlm_password: authentication for user [pavan] -> [pavan] -> [pavan] succeeded >[2006/05/09 08:52:19, 5] auth/auth_util.c:(1485) > attempting to free (and zero) a user_info structure >[2006/05/09 08:52:19, 10] auth/auth_util.c:(1488) > structure was created for pavan >[2006/05/09 08:52:19, 10] auth/auth_ntlmssp.c:(119) > Got NT session key of length 16 >[2006/05/09 08:52:19, 10] auth/auth_ntlmssp.c:(126) > Got LM session key of length 16 >[2006/05/09 08:52:19, 10] libsmb/ntlmssp.c:(728) > ntlmssp_server_auth: Created NTLM2 session key. >[2006/05/09 08:52:19, 3] libsmb/ntlmssp_sign.c:(338) > NTLMSSP Sign/Seal - Initialising with flags: >[2006/05/09 08:52:19, 3] libsmb/ntlmssp.c:(63) > Got NTLMSSP neg_flags=0x60088235 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_SEAL > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH >[2006/05/09 08:52:19, 10] smbd/password.c:(182) > register_vuid: allocated vuid = 101 >[2006/05/09 08:52:19, 10] smbd/password.c:(252) > register_vuid: (205,15) pavan pavan CHEVY guest=0 >[2006/05/09 08:52:19, 3] smbd/password.c:(257) > User name: pavan Real name: pavan >[2006/05/09 08:52:19, 3] smbd/password.c:(276) > UNIX uid 205 is UNIX user pavan, and will be vuid 101 >[2006/05/09 08:52:19, 7] param/loadparm.c:(4343) > lp_servicenumber: couldn't find pavan >[2006/05/09 08:52:19, 3] smbd/password.c:(304) > Adding homes service for user 'pavan' using home directory: '/usr/users/pavan' >[2006/05/09 08:52:19, 8] param/loadparm.c:(2445) > add_a_service: Creating snum = 5 for pavan >[2006/05/09 08:52:19, 10] param/loadparm.c:(2492) > hash_a_service: hashing index 5 for service name pavan >[2006/05/09 08:52:19, 3] param/loadparm.c:(2538) > adding home's share [pavan] for user 'pavan' at '/usr/users/pavan' >[2006/05/09 08:52:19, 6] param/loadparm.c:(2947) > lp_file_list_changed() > file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 > >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=110 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=65279 > smb_uid=101 > smb_mid=48064 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 9 (0x9) > smb_bcc=67 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] A1 07 30 05 A0 03 0A 01 00 55 00 6E 00 69 00 78 ..0..... .U.n.i.x > [010] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3 > [020] 00 2E 00 30 00 2E 00 32 00 31 00 63 00 00 00 57 ...0...2 .1.c...W > [030] 00 4F 00 52 00 4B 00 47 00 52 00 4F 00 55 00 50 .O.R.K.G .R.O.U.P > [040] 00 00 00 ... >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 76 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x4c >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 3 of length 80 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=76 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=101 > smb_mid=48128 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 76 (0x4C) > smb_vwv[ 2]= 8 (0x8) > smb_vwv[ 3]= 1 (0x1) > smb_bcc=33 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 00 5C 00 5C 00 43 00 48 00 45 00 56 00 59 00 5C .\.\.C.H .E.V.Y.\ > [010] 00 49 00 50 00 43 00 24 00 00 00 3F 3F 3F 3F 3F .I.P.C.$ ...????? > [020] 00 . >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBtconX (pid 404565) conn 0x0 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:19, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:19, 4] smbd/reply.c:(660) > Client requested device type [?????] for share [IPC$] >[2006/05/09 08:52:19, 5] smbd/service.c:(860) > making a connection to 'normal' service ipc$ >[2006/05/09 08:52:19, 3] lib/access.c:(291) > only_ipaddrs_in_list: list has non-ip address (.india.hp.com) >[2006/05/09 08:52:19, 3] lib/access.c:(316) > check_access: hostnames in host allow/deny list. >[2006/05/09 08:52:19, 2] lib/access.c:(322) > Allowed connection from nt218201.india.hp.com (15.76.218.201) >[2006/05/09 08:52:19, 5] lib/username.c:(290) > Finding user pavan >[2006/05/09 08:52:19, 5] lib/username.c:(234) > Trying _Get_Pwnam(), username as lowercase is pavan >[2006/05/09 08:52:19, 10] lib/util_pw.c:(98) > Got pavan from pwnam_cache >[2006/05/09 08:52:19, 5] lib/username.c:(266) > Get_Pwnam_internals did find user [pavan]! >[2006/05/09 08:52:19, 3] smbd/service.c:(488) > Connect path is '/tmp' for service [IPC$] >[2006/05/09 08:52:19, 4] rpc_server/srv_srvsvc_nt.c:(240) > get_share_security: using default secdesc for IPC$ >[2006/05/09 08:52:19, 10] lib/util_seaccess.c:(175) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2006/05/09 08:52:19, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x00000002, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410. >[2006/05/09 08:52:19, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:52:19, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 >[2006/05/09 08:52:19, 5] lib/util_seaccess.c:(308) > se_access_check: access (2) granted. >[2006/05/09 08:52:19, 3] smbd/vfs.c:(216) > Initialising default vfs hooks >[2006/05/09 08:52:19, 5] smbd/connection.c:(170) > claiming IPC$ 0 >[2006/05/09 08:52:19, 10] smbd/uid.c:(124) > is_share_read_only_for_user: share IPC$ is read-only for unix user pavan >[2006/05/09 08:52:19, 4] rpc_server/srv_srvsvc_nt.c:(240) > get_share_security: using default secdesc for IPC$ >[2006/05/09 08:52:19, 10] lib/util_seaccess.c:(175) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2006/05/09 08:52:19, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x00000001, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410. >[2006/05/09 08:52:19, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:52:19, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1 >[2006/05/09 08:52:19, 5] lib/util_seaccess.c:(308) > se_access_check: access (1) granted. >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(437) > NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 > contains 5 SIDs > SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 > SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 205 > Primary group is 15 and contains 1 supplementary groups > Group[ 0]: 15 >[2006/05/09 08:52:19, 5] smbd/uid.c:(308) > change_to_user uid=(0,205) gid=(0,15) >[2006/05/09 08:52:19, 3] smbd/service.c:(693) > nt218201 (15.76.218.201) connect to service IPC$ initially as user pavan (uid=205, gid=15) (pid 404565) >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:19, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:19, 3] smbd/reply.c:(707) > tconX service=IPC$ >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=48 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48128 > smt_wct=3 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 1 (0x1) > smb_bcc=7 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 49 50 43 00 00 00 00 IPC.... >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 100 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x64 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 4 of length 104 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=48192 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 3] smbd/sec_ctx.c:(287) > setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(437) > NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 > contains 5 SIDs > SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 > SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:52:19, 5] auth/auth_util.c:(454) > UNIX token of user 205 > Primary group is 15 and contains 1 supplementary groups > Group[ 0]: 15 >[2006/05/09 08:52:19, 5] smbd/uid.c:(308) > change_to_user uid=(0,205) gid=(0,15) >[2006/05/09 08:52:19, 4] smbd/vfs.c:(738) > vfs_ChDir to /tmp >[2006/05/09 08:52:19, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/05/09 08:52:19, 4] smbd/nttrans.c:(330) > nt_open_pipe: Opening pipe \wkssvc. >[2006/05/09 08:52:19, 3] smbd/nttrans.c:(351) > nt_open_pipe: Known pipe wkssvc opening. >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(179) > Open pipe requested wkssvc (pipes_open=0) >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(285) > Create pipe requested wkssvc >[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(77) > init_pipe_handles: created handle list for pipe wkssvc >[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(92) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(362) > Created internal pipe wkssvc (pipes_open=0) >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(262) > Opened pipe wkssvc with handle 76be (pipes_open=1) >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name wkssvc pnum=76be >[2006/05/09 08:52:19, 5] smbd/nttrans.c:(400) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=48192 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=48640 (0xBE00) > smb_vwv[ 3]= 374 (0x176) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 136 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x88 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 5 of length 140 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48256 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30398 (0x76BE) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [030] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBwriteX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76be >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76be (pipes_open=1) >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76be name: wkssvc open: Yes len: 72 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 72 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0b >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0048 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 11 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1495) > api_pipe_bind_req: decode request. 1495 >[2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(1505) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_rb >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 00000000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0008 num_contexts: 01 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000c context_id : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 000e num_transfer_syntaxes: 01 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 00000f smb_io_rpc_iface >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 000010 smb_io_uuid uuid >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0010 data : 6bffd098 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0014 data : a112 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0016 data : 3610 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 0018 data : 98 33 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 001a data : 46 c3 f8 7e 34 5a >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0020 version: 00000001 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000024 smb_io_rpc_iface >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 000024 smb_io_uuid uuid >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0024 data : 8a885d04 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0028 data : 1ceb >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 002a data : 11c9 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 002c data : 9f e8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 002e data : 08 00 2b 10 48 60 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0034 version: 00000002 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1548) > api_pipe_bind_req: make response. 1548 >[2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(959) > check_bind_req for \PIPE\wkssvc >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\samr >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\NETLOGON >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\srvsvc >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\wkssvc >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_ba >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 000053f0 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000008 smb_io_rpc_addr_str >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 len: 000d >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 000a str: \PIPE\ntsvcs. >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000017 smb_io_rpc_results >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0018 num_results: 01 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 001c result : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 001e reason : 0000 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000020 smb_io_rpc_iface >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 000020 smb_io_uuid uuid >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0020 data : 8a885d04 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0024 data : 1ceb >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0026 data : 11c9 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 0028 data : 9f e8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 002a data : 08 00 2b 10 48 60 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0030 version: 00000002 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0c >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0044 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 56 >[2006/05/09 08:52:19, 3] smbd/pipes.c:(207) > writeX-IPC pnum=76be nwritten=72 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48256 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 59 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x3b >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 6 of length 63 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48320 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30398 (0x76BE) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBreadX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76be >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76be (pipes_open=1) >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76be name: wkssvc len: 1024 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1049) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/05/09 08:52:19, 3] smbd/pipes.c:(251) > readX-IPC pnum=76be min=1024 max=1024 nread=68 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48320 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 144 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x90 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 7 of length 148 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=48384 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30398 (0x76BE) > smb_bcc=77 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 10 E5 34 02 08 00 00 .$...... ...4.... > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h > [040] 00 65 00 76 00 79 00 00 00 64 00 00 00 .e.v.y.. .d... >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/05/09 08:52:19, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:19, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:19, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76be >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76be (pipes_open=1) >[2006/05/09 08:52:19, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "wkssvc" (pnum 76be) >[2006/05/09 08:52:19, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d480 max_trans_reply: 1024 >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76be name: wkssvc open: Yes len: 60 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 60 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 003c >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 00000024 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 0000 >[2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 74 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\wkssvc >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[0].fn == 12016d7f0 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 wks_io_q_query_info >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0000 ptr_srv_name: 0234e510 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000004 smb_io_unistr2 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0004 uni_max_len: 00000008 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0008 offset : 00000000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c uni_str_len: 00000008 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) > 0010 buffer : \.\.c.h.e.v.y... >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0020 switch_value: 0064 >[2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(66) > _wks_query_info: 66 >[2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(40) > create_wks_info_100: 40 >[2006/05/09 08:52:19, 5] rpc_parse/parse_wks.c:(79) > Init WKS_INFO_100: 79 >[2006/05/09 08:52:19, 5] rpc_parse/parse_wks.c:(139) > init_wks_r_unknown_0: 139 >[2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(76) > _wks_query_info: 76 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 wks_io_r_query_info >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0000 switch_value: 0064 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0004 ptr_1 : 00000001 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000008 wks_io_wks_info_100 inf >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0008 platform_id : 000001f4 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c ptr_compname: 00000001 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0010 ptr_lan_grp : 00000001 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0014 ver_major : 00000004 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0018 ver_minor : 00000009 >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 00001c smb_io_unistr2 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 001c uni_max_len: 00000006 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0020 offset : 00000000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0024 uni_str_len: 00000006 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) > 0028 buffer : C.H.E.V.Y... >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 000034 smb_io_unistr2 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0034 uni_max_len: 0000000a >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0038 offset : 00000000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 003c uni_str_len: 0000000a >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) > 0040 buffer : W.O.R.K.G.R.O.U.P... >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(761) > 0054 status : NT_STATUS_OK >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called wkssvc successfully >[2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 120 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 44 >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76be name: wkssvc len: 1024 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 88. >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0070 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 00000058 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:19, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..112] >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=168 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=48384 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 112 (0x70) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 112 (0x70) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=113 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 70 00 00 00 01 00 00 ........ .p...... > [010] 00 58 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .X...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 06 00 00 00 00 00 00 00 06 00 00 ........ ........ > [040] 00 43 00 48 00 45 00 56 00 59 00 00 00 0A 00 00 .C.H.E.V .Y...... > [050] 00 00 00 00 00 0A 00 00 00 57 00 4F 00 52 00 4B ........ .W.O.R.K > [060] 00 47 00 52 00 4F 00 55 00 50 00 00 00 00 00 00 .G.R.O.U .P...... > [070] 00 . >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 8 of length 45 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48448 > smt_wct=3 > smb_vwv[ 0]=30398 (0x76BE) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76be >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76be (pipes_open=1) >[2006/05/09 08:52:19, 5] smbd/pipes.c:(272) > reply_pipe_close: pnum:76be >[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1165) > closed pipe name wkssvc pnum=76be (pipes_open=0) >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48448 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 100 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x64 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 9 of length 104 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=48512 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/05/09 08:52:19, 4] smbd/nttrans.c:(330) > nt_open_pipe: Opening pipe \srvsvc. >[2006/05/09 08:52:19, 3] smbd/nttrans.c:(351) > nt_open_pipe: Known pipe srvsvc opening. >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(179) > Open pipe requested srvsvc (pipes_open=0) >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(285) > Create pipe requested srvsvc >[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(77) > init_pipe_handles: created handle list for pipe srvsvc >[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(92) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(362) > Created internal pipe srvsvc (pipes_open=0) >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(262) > Opened pipe srvsvc with handle 76bf (pipes_open=1) >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name srvsvc pnum=76bf >[2006/05/09 08:52:19, 5] smbd/nttrans.c:(400) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=48512 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=48896 (0xBF00) > smb_vwv[ 3]= 374 (0x176) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 136 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x88 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 10 of length 140 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48576 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30399 (0x76BF) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [030] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBwriteX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76bf >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76bf (pipes_open=1) >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76bf name: srvsvc open: Yes len: 72 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 72 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0b >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0048 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 11 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1495) > api_pipe_bind_req: decode request. 1495 >[2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(1505) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_rb >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 00000000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0008 num_contexts: 01 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000c context_id : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 000e num_transfer_syntaxes: 01 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 00000f smb_io_rpc_iface >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 000010 smb_io_uuid uuid >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0010 data : 4b324fc8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0014 data : 1670 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0016 data : 01d3 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 0018 data : 12 78 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 001a data : 5a 47 bf 6e e1 88 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0020 version: 00000003 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000024 smb_io_rpc_iface >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 000024 smb_io_uuid uuid >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0024 data : 8a885d04 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0028 data : 1ceb >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 002a data : 11c9 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 002c data : 9f e8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 002e data : 08 00 2b 10 48 60 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0034 version: 00000002 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1548) > api_pipe_bind_req: make response. 1548 >[2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(959) > check_bind_req for \PIPE\srvsvc >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\samr >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\NETLOGON >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\srvsvc >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_ba >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 000053f0 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000008 smb_io_rpc_addr_str >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 len: 000d >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 000a str: \PIPE\ntsvcs. >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000017 smb_io_rpc_results >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0018 num_results: 01 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 001c result : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 001e reason : 0000 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000020 smb_io_rpc_iface >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 000020 smb_io_uuid uuid >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0020 data : 8a885d04 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0024 data : 1ceb >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0026 data : 11c9 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 0028 data : 9f e8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 002a data : 08 00 2b 10 48 60 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0030 version: 00000002 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0c >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0044 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 56 >[2006/05/09 08:52:19, 3] smbd/pipes.c:(207) > writeX-IPC pnum=76bf nwritten=72 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48576 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 59 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x3b >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 11 of length 63 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48640 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30399 (0x76BF) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBreadX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76bf >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76bf (pipes_open=1) >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76bf name: srvsvc len: 1024 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1049) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/05/09 08:52:19, 3] smbd/pipes.c:(251) > readX-IPC pnum=76bf min=1024 max=1024 nread=68 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48640 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 144 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x90 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 12 of length 148 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=48704 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30399 (0x76BF) > smb_bcc=77 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 10 E5 34 02 08 00 00 .$...... ...4.... > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h > [040] 00 65 00 76 00 79 00 00 00 65 00 00 00 .e.v.y.. .e... >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/05/09 08:52:19, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:19, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:19, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76bf >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76bf (pipes_open=1) >[2006/05/09 08:52:19, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "srvsvc" (pnum 76bf) >[2006/05/09 08:52:19, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d480 max_trans_reply: 1024 >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76bf name: srvsvc open: Yes len: 60 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 60 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 003c >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 00000024 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 0015 >[2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 74 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\srvsvc >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[11].fn == 12017a0c0 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 srv_io_q_net_srv_get_info >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0000 ptr_srv_name : 0234e510 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000004 smb_io_unistr2 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0004 uni_max_len: 00000008 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0008 offset : 00000000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c uni_str_len: 00000008 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) > 0010 buffer : \.\.c.h.e.v.y... >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0020 switch_value : 00000065 >[2006/05/09 08:52:19, 5] rpc_server/srv_srvsvc_nt.c:(1235) > srv_net_srv_get_info: 1235 >[2006/05/09 08:52:19, 5] rpc_parse/parse_srv.c:(2809) > init_srv_info_101 >[2006/05/09 08:52:19, 5] rpc_parse/parse_srv.c:(3044) > init_srv_r_net_srv_get_info >[2006/05/09 08:52:19, 5] rpc_server/srv_srvsvc_nt.c:(1280) > srv_net_srv_get_info: 1280 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 srv_io_r_net_srv_get_info >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000000 srv_io_info_ctr ctr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0000 switch_value: 00000065 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0004 ptr_srv_ctr : 00000001 >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 000008 srv_io_info_101 sv101 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0008 platform_id : 000001f4 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c ptr_name : 00000001 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0010 ver_major : 00000004 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0014 ver_minor : 00000009 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0018 srv_type : 00009a03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 001c ptr_comment : 00000001 >[2006/05/09 08:52:19, 8] rpc_parse/parse_prs.c:(84) > 000020 smb_io_unistr2 uni_name >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0020 uni_max_len: 00000006 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0024 offset : 00000000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0028 uni_str_len: 00000006 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) > 002c buffer : C.H.E.V.Y... >[2006/05/09 08:52:19, 8] rpc_parse/parse_prs.c:(84) > 000038 smb_io_unistr2 uni_comment >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0038 uni_max_len: 0000000e >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 003c offset : 00000000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0040 uni_str_len: 0000000e >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) > 0044 buffer : S.a.m.b.a. .3...0...2.1.c... >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(791) > 0060 status: WERR_OK >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called srvsvc successfully >[2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 192 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 44 >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76bf name: srvsvc len: 1024 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 100. >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 007c >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 00000064 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:19, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..124] >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=180 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=48704 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 124 (0x7C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 124 (0x7C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=125 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 7C 00 00 00 01 00 00 ........ .|...... > [010] 00 64 00 00 00 00 00 00 00 65 00 00 00 01 00 00 .d...... .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 03 9A 00 00 01 00 00 00 06 00 00 00 00 00 00 ........ ........ > [040] 00 06 00 00 00 43 00 48 00 45 00 56 00 59 00 00 .....C.H .E.V.Y.. > [050] 00 0E 00 00 00 00 00 00 00 0E 00 00 00 53 00 61 ........ .....S.a > [060] 00 6D 00 62 00 61 00 20 00 33 00 2E 00 30 00 2E .m.b.a. .3...0.. > [070] 00 32 00 31 00 63 00 00 00 00 00 00 00 .2.1.c.. ..... >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 13 of length 45 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48768 > smt_wct=3 > smb_vwv[ 0]=30399 (0x76BF) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76bf >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76bf (pipes_open=1) >[2006/05/09 08:52:19, 5] smbd/pipes.c:(272) > reply_pipe_close: pnum:76bf >[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1165) > closed pipe name srvsvc pnum=76bf (pipes_open=0) >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48768 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 100 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x64 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 14 of length 104 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=48832 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/05/09 08:52:19, 4] smbd/nttrans.c:(330) > nt_open_pipe: Opening pipe \wkssvc. >[2006/05/09 08:52:19, 3] smbd/nttrans.c:(351) > nt_open_pipe: Known pipe wkssvc opening. >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(179) > Open pipe requested wkssvc (pipes_open=0) >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(285) > Create pipe requested wkssvc >[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(77) > init_pipe_handles: created handle list for pipe wkssvc >[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(92) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(362) > Created internal pipe wkssvc (pipes_open=0) >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(262) > Opened pipe wkssvc with handle 76c0 (pipes_open=1) >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name wkssvc pnum=76c0 >[2006/05/09 08:52:19, 5] smbd/nttrans.c:(400) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=48832 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=49152 (0xC000) > smb_vwv[ 3]= 374 (0x176) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 136 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x88 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 15 of length 140 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48896 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30400 (0x76C0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [030] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBwriteX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c0 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76c0 (pipes_open=1) >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c0 name: wkssvc open: Yes len: 72 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 72 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0b >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0048 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 11 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1495) > api_pipe_bind_req: decode request. 1495 >[2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(1505) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_rb >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 00000000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0008 num_contexts: 01 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000c context_id : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 000e num_transfer_syntaxes: 01 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 00000f smb_io_rpc_iface >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 000010 smb_io_uuid uuid >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0010 data : 6bffd098 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0014 data : a112 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0016 data : 3610 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 0018 data : 98 33 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 001a data : 46 c3 f8 7e 34 5a >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0020 version: 00000001 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000024 smb_io_rpc_iface >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 000024 smb_io_uuid uuid >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0024 data : 8a885d04 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0028 data : 1ceb >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 002a data : 11c9 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 002c data : 9f e8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 002e data : 08 00 2b 10 48 60 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0034 version: 00000002 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(1548) > api_pipe_bind_req: make response. 1548 >[2006/05/09 08:52:19, 3] rpc_server/srv_pipe.c:(959) > check_bind_req for \PIPE\wkssvc >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\samr >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\NETLOGON >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\srvsvc >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\wkssvc >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_ba >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 000053f0 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000008 smb_io_rpc_addr_str >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 len: 000d >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 000a str: \PIPE\ntsvcs. >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000017 smb_io_rpc_results >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0018 num_results: 01 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 001c result : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 001e reason : 0000 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000020 smb_io_rpc_iface >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 000020 smb_io_uuid uuid >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0020 data : 8a885d04 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0024 data : 1ceb >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0026 data : 11c9 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 0028 data : 9f e8 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(819) > 002a data : 08 00 2b 10 48 60 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0030 version: 00000002 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0c >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0044 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 56 >[2006/05/09 08:52:19, 3] smbd/pipes.c:(207) > writeX-IPC pnum=76c0 nwritten=72 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48896 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 59 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x3b >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 16 of length 63 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48960 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30400 (0x76C0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBreadX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c0 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76c0 (pipes_open=1) >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c0 name: wkssvc len: 1024 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1049) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/05/09 08:52:19, 3] smbd/pipes.c:(251) > readX-IPC pnum=76c0 min=1024 max=1024 nread=68 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=48960 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 144 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x90 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 17 of length 148 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=49024 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30400 (0x76C0) > smb_bcc=77 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 F0 E4 34 02 08 00 00 .$...... ...4.... > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h > [040] 00 65 00 76 00 79 00 00 00 64 00 00 00 .e.v.y.. .d... >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/05/09 08:52:19, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:19, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:19, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c0 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76c0 (pipes_open=1) >[2006/05/09 08:52:19, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "wkssvc" (pnum 76c0) >[2006/05/09 08:52:19, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d480 max_trans_reply: 1024 >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c0 name: wkssvc open: Yes len: 60 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 60 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 003c >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 00000024 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 0000 >[2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 74 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\wkssvc >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[0].fn == 12016d7f0 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 wks_io_q_query_info >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0000 ptr_srv_name: 0234e4f0 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000004 smb_io_unistr2 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0004 uni_max_len: 00000008 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0008 offset : 00000000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c uni_str_len: 00000008 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) > 0010 buffer : \.\.c.h.e.v.y... >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0020 switch_value: 0064 >[2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(66) > _wks_query_info: 66 >[2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(40) > create_wks_info_100: 40 >[2006/05/09 08:52:19, 5] rpc_parse/parse_wks.c:(79) > Init WKS_INFO_100: 79 >[2006/05/09 08:52:19, 5] rpc_parse/parse_wks.c:(139) > init_wks_r_unknown_0: 139 >[2006/05/09 08:52:19, 5] rpc_server/srv_wkssvc_nt.c:(76) > _wks_query_info: 76 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 wks_io_r_query_info >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0000 switch_value: 0064 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0004 ptr_1 : 00000001 >[2006/05/09 08:52:19, 6] rpc_parse/parse_prs.c:(84) > 000008 wks_io_wks_info_100 inf >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0008 platform_id : 000001f4 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c ptr_compname: 00000001 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0010 ptr_lan_grp : 00000001 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0014 ver_major : 00000004 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0018 ver_minor : 00000009 >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 00001c smb_io_unistr2 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 001c uni_max_len: 00000006 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0020 offset : 00000000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0024 uni_str_len: 00000006 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) > 0028 buffer : C.H.E.V.Y... >[2006/05/09 08:52:19, 7] rpc_parse/parse_prs.c:(84) > 000034 smb_io_unistr2 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0034 uni_max_len: 0000000a >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0038 offset : 00000000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 003c uni_str_len: 0000000a >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(904) > 0040 buffer : W.O.R.K.G.R.O.U.P... >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(761) > 0054 status : NT_STATUS_OK >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called wkssvc successfully >[2006/05/09 08:52:19, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 120 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 44 >[2006/05/09 08:52:19, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c0 name: wkssvc len: 1024 >[2006/05/09 08:52:19, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 88. >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0070 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 00000058 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:19, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:19, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..112] >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=168 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=49024 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 112 (0x70) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 112 (0x70) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=113 >[2006/05/09 08:52:19, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 70 00 00 00 01 00 00 ........ .p...... > [010] 00 58 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .X...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 06 00 00 00 00 00 00 00 06 00 00 ........ ........ > [040] 00 43 00 48 00 45 00 56 00 59 00 00 00 0A 00 00 .C.H.E.V .Y...... > [050] 00 00 00 00 00 0A 00 00 00 57 00 4F 00 52 00 4B ........ .W.O.R.K > [060] 00 47 00 52 00 4F 00 55 00 50 00 00 00 00 00 00 .G.R.O.U .P...... > [070] 00 . >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:19, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:19, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:19, 3] smbd/process.c:(1194) > Transaction 18 of length 45 >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49088 > smt_wct=3 > smb_vwv[ 0]=30400 (0x76C0) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:19, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:19, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c0 >[2006/05/09 08:52:19, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76c0 (pipes_open=1) >[2006/05/09 08:52:19, 5] smbd/pipes.c:(272) > reply_pipe_close: pnum:76c0 >[2006/05/09 08:52:19, 10] rpc_server/srv_lsa_hnd.c:(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2006/05/09 08:52:19, 4] rpc_server/srv_pipe_hnd.c:(1165) > closed pipe name wkssvc pnum=76c0 (pipes_open=0) >[2006/05/09 08:52:19, 5] lib/util.c:(454) >[2006/05/09 08:52:19, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49088 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:19, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:19, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 100 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x64 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 19 of length 104 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=49152 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) > nt_open_pipe: Opening pipe \srvsvc. >[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) > nt_open_pipe: Known pipe srvsvc opening. >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) > Open pipe requested srvsvc (pipes_open=0) >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) > Create pipe requested srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) > init_pipe_handles: created handle list for pipe srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) > Created internal pipe srvsvc (pipes_open=0) >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) > Opened pipe srvsvc with handle 76c1 (pipes_open=1) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name srvsvc pnum=76c1 >[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=49152 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=49408 (0xC100) > smb_vwv[ 3]= 374 (0x176) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 136 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x88 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 20 of length 140 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49216 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30401 (0x76C1) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [030] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBwriteX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c1 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76c1 (pipes_open=1) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c1 name: srvsvc open: Yes len: 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0b >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0048 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 11 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) > api_pipe_bind_req: decode request. 1495 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_rb >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0008 num_contexts: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000c context_id : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 000e num_transfer_syntaxes: 01 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 00000f smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000010 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 data : 4b324fc8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 data : 1670 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0016 data : 01d3 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0018 data : 12 78 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 001a data : 5a 47 bf 6e e1 88 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 version: 00000003 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000024 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000024 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0028 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 002a data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002c data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002e data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0034 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) > api_pipe_bind_req: make response. 1548 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) > check_bind_req for \PIPE\srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\samr >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\NETLOGON >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\srvsvc >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_ba >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 000053f0 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000008 smb_io_rpc_addr_str >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 len: 000d >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000a str: \PIPE\ntsvcs. >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000017 smb_io_rpc_results >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0018 num_results: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001c result : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001e reason : 0000 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000020 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000020 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0024 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0026 data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0028 data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002a data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0030 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0044 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 56 >[2006/05/09 08:52:20, 3] smbd/pipes.c:(207) > writeX-IPC pnum=76c1 nwritten=72 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49216 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 59 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x3b >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 21 of length 63 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49280 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30401 (0x76C1) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBreadX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c1 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76c1 (pipes_open=1) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c1 name: srvsvc len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/05/09 08:52:20, 3] smbd/pipes.c:(251) > readX-IPC pnum=76c1 min=1024 max=1024 nread=68 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49280 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 168 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0xa8 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 22 of length 172 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=168 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=49344 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 84 (0x54) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 84 (0x54) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30401 (0x76C1) > smb_bcc=101 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 54 00 00 00 01 00 00 ........ .T...... > [020] 00 3C 00 00 00 00 00 0F 00 44 98 03 00 08 00 00 .<...... .D...... > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h > [040] 00 65 00 76 00 79 00 00 00 01 00 00 00 01 00 00 .e.v.y.. ........ > [050] 00 6C E1 7E 01 00 00 00 00 00 00 00 00 FF FF FF .l.~.... ........ > [060] FF 00 00 00 00 ..... >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=84 params=0 setup=2 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:20, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:20, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c1 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76c1 (pipes_open=1) >[2006/05/09 08:52:20, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "srvsvc" (pnum 76c1) >[2006/05/09 08:52:20, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d480 max_trans_reply: 1024 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c1 name: srvsvc open: Yes len: 84 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 84 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 84 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 84, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 68 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 68 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0054 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 68 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 68, incoming data = 68 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 0000003c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 000f >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 74 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\srvsvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: srvsvc op 0xf - api_rpcTNP: rpc command: SRV_NET_SHARE_ENUM_ALL >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[3].fn == 12017a720 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 srv_io_q_net_share_enum >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 ptr_srv_name: 00039844 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000004 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 uni_max_len: 00000008 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0008 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c uni_str_len: 00000008 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0010 buffer : \.\.c.h.e.v.y... >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000020 srv_io_srv_share_ctr share_ctr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 info_level: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 switch_value: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0028 ptr_share_info: 017ee16c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 002c num_entries: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0030 ptr_entries: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0034 preferred_len: ffffffff >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000038 smb_io_enum_hnd enum_hnd >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0038 ptr_hnd: 00000000 >[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1443) > _srv_net_share_enum: 1443 >[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(752) > init_srv_r_net_share_enum: 752 >[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(524) > init_srv_share_info_ctr >[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(142) > init_srv_share_info1: audit 0 Audited /bin directory >[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(101) > init_srv_share_info1_str >[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(142) > init_srv_share_info1: IPC$ 3 IPC Service (Samba 3.0.21c) >[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(101) > init_srv_share_info1_str >[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(142) > init_srv_share_info1: ADMIN$ 3 IPC Service (Samba 3.0.21c) >[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(101) > init_srv_share_info1_str >[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(142) > init_srv_share_info1: pavan 0 Home Directories >[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(101) > init_srv_share_info1_str >[2006/05/09 08:52:20, 5] rpc_parse/parse_misc.c:(159) > smb_io_enum_hnd >[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1455) > _srv_net_share_enum: 1455 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 srv_io_r_net_share_enum >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 srv_io_srv_share_ctr share_ctr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 info_level: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 switch_value: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0008 ptr_share_info: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c num_entries: 00000004 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 ptr_entries: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0014 num_entries2: 00000004 >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000018 srv_io_share_info1 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0018 ptr_netname: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 001c type : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 ptr_remark : 00000001 >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000024 srv_io_share_info1 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 ptr_netname: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0028 type : 00000003 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 002c ptr_remark : 00000001 >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000030 srv_io_share_info1 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0030 ptr_netname: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0034 type : 00000003 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0038 ptr_remark : 00000001 >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 00003c srv_io_share_info1 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 003c ptr_netname: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0040 type : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0044 ptr_remark : 00000001 >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000048 srv_io_share_info1_str >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 000048 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0048 uni_max_len: 00000006 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 004c offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0050 uni_str_len: 00000006 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0054 buffer : a.u.d.i.t... >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 000060 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0060 uni_max_len: 00000017 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0064 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0068 uni_str_len: 00000017 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 006c buffer : A.u.d.i.t.e.d. ./.b.i.n. .d.i.r.e.c.t.o.r.y... >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 00009a srv_io_share_info1_str >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 00009c smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 009c uni_max_len: 00000005 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 00a0 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 00a4 uni_str_len: 00000005 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 00a8 buffer : I.P.C.$... >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 0000b4 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 00b4 uni_max_len: 0000001c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 00b8 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 00bc uni_str_len: 0000001c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 00c0 buffer : I.P.C. .S.e.r.v.i.c.e. .(.S.a.m.b.a. .3...0...2.1.c.)... >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 0000f8 srv_io_share_info1_str >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 0000f8 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 00f8 uni_max_len: 00000007 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 00fc offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0100 uni_str_len: 00000007 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0104 buffer : A.D.M.I.N.$... >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 000114 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0114 uni_max_len: 0000001c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0118 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 011c uni_str_len: 0000001c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0120 buffer : I.P.C. .S.e.r.v.i.c.e. .(.S.a.m.b.a. .3...0...2.1.c.)... >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000158 srv_io_share_info1_str >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 000158 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0158 uni_max_len: 00000006 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 015c offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0160 uni_str_len: 00000006 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0164 buffer : p.a.v.a.n... >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 000170 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0170 uni_max_len: 00000011 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0174 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0178 uni_str_len: 00000011 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 017c buffer : H.o.m.e. .D.i.r.e.c.t.o.r.i.e.s... >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 01a0 total_entries: 00000004 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 0001a4 smb_io_enum_hnd enum_hnd >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 01a4 ptr_hnd: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) > 01a8 status: WERR_OK >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called srvsvc successfully >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 544 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 68 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c1 name: srvsvc len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 428. >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 01c4 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 000001ac >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..452] >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=508 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=49344 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 452 (0x1C4) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 452 (0x1C4) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=453 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 C4 01 00 00 01 00 00 ........ ........ > [010] 00 AC 01 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ > [020] 00 01 00 00 00 04 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 01 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ > [040] 00 03 00 00 00 01 00 00 00 01 00 00 00 03 00 00 ........ ........ > [050] 00 01 00 00 00 01 00 00 00 00 00 00 00 01 00 00 ........ ........ > [060] 00 06 00 00 00 00 00 00 00 06 00 00 00 61 00 75 ........ .....a.u > [070] 00 64 00 69 00 74 00 00 00 17 00 00 00 00 00 00 .d.i.t.. ........ > [080] 00 17 00 00 00 41 00 75 00 64 00 69 00 74 00 65 .....A.u .d.i.t.e > [090] 00 64 00 20 00 2F 00 62 00 69 00 6E 00 20 00 64 .d. ./.b .i.n. .d > [0A0] 00 69 00 72 00 65 00 63 00 74 00 6F 00 72 00 79 .i.r.e.c .t.o.r.y > [0B0] 00 00 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [0C0] 00 49 00 50 00 43 00 24 00 00 00 00 00 1C 00 00 .I.P.C.$ ........ > [0D0] 00 00 00 00 00 1C 00 00 00 49 00 50 00 43 00 20 ........ .I.P.C. > [0E0] 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 .S.e.r.v .i.c.e. > [0F0] 00 28 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 .(.S.a.m .b.a. .3 > [100] 00 2E 00 30 00 2E 00 32 00 31 00 63 00 29 00 00 ...0...2 .1.c.).. > [110] 00 07 00 00 00 00 00 00 00 07 00 00 00 41 00 44 ........ .....A.D > [120] 00 4D 00 49 00 4E 00 24 00 00 00 00 00 1C 00 00 .M.I.N.$ ........ > [130] 00 00 00 00 00 1C 00 00 00 49 00 50 00 43 00 20 ........ .I.P.C. > [140] 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 .S.e.r.v .i.c.e. > [150] 00 28 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 .(.S.a.m .b.a. .3 > [160] 00 2E 00 30 00 2E 00 32 00 31 00 63 00 29 00 00 ...0...2 .1.c.).. > [170] 00 06 00 00 00 00 00 00 00 06 00 00 00 70 00 61 ........ .....p.a > [180] 00 76 00 61 00 6E 00 00 00 11 00 00 00 00 00 00 .v.a.n.. ........ > [190] 00 11 00 00 00 48 00 6F 00 6D 00 65 00 20 00 44 .....H.o .m.e. .D > [1A0] 00 69 00 72 00 65 00 63 00 74 00 6F 00 72 00 69 .i.r.e.c .t.o.r.i > [1B0] 00 65 00 73 00 00 00 00 00 04 00 00 00 00 00 00 .e.s.... ........ > [1C0] 00 00 00 00 00 ..... >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 23 of length 45 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49408 > smt_wct=3 > smb_vwv[ 0]=30401 (0x76C1) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c1 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76c1 (pipes_open=1) >[2006/05/09 08:52:20, 5] smbd/pipes.c:(272) > reply_pipe_close: pnum:76c1 >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165) > closed pipe name srvsvc pnum=76c1 (pipes_open=0) >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49408 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 102 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x66 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 24 of length 106 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=102 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=220 > smb_uid=101 > smb_mid=49472 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 4096 (0x1000) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 768 (0x300) > smb_bcc=19 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 73 00 70 00 6F 00 6F 00 6C 00 73 00 73 .\.s.p.o .o.l.s.s > [010] 00 00 00 ... >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) > nt_open_pipe: Opening pipe \spoolss. >[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) > nt_open_pipe: Known pipe spoolss opening. >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) > Open pipe requested spoolss (pipes_open=0) >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) > Create pipe requested spoolss >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) > init_pipe_handles: created handle list for pipe spoolss >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) > init_pipe_handles: pipe_handles ref count = 1 for pipe spoolss >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) > Created internal pipe spoolss (pipes_open=0) >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) > Opened pipe spoolss with handle 76c2 (pipes_open=1) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name spoolss pnum=76c2 >[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) > do_ntcreate_pipe_open: open pipe = \spoolss >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=220 > smb_uid=101 > smb_mid=49472 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=49664 (0xC200) > smb_vwv[ 3]= 374 (0x176) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 136 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x88 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 25 of length 140 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49536 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30402 (0x76C2) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 17 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 89 .xV4.4.. ....#Eg. > [030] AB 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBwriteX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c2 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=1) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c2 name: spoolss open: Yes len: 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0b >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0048 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000017 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 11 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) > api_pipe_bind_req: decode request. 1495 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) > api_pipe_bind_req: \PIPE\spoolss -> \PIPE\spoolss >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_rb >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0008 num_contexts: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000c context_id : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 000e num_transfer_syntaxes: 01 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 00000f smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000010 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 data : 12345678 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 data : 1234 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0016 data : abcd >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0018 data : ef 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 001a data : 01 23 45 67 89 ab >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 version: 00000001 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000024 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000024 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0028 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 002a data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002c data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002e data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0034 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) > api_pipe_bind_req: make response. 1548 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) > check_bind_req for \PIPE\spoolss >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\samr >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\NETLOGON >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\wkssvc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\winreg >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\spoolss >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_ba >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 000053f0 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000008 smb_io_rpc_addr_str >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 len: 000e >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000a str: \PIPE\spoolss. >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000018 smb_io_rpc_results >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0018 num_results: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001c result : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001e reason : 0000 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000020 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000020 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0024 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0026 data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0028 data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002a data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0030 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0044 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000017 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 56 >[2006/05/09 08:52:20, 3] smbd/pipes.c:(207) > writeX-IPC pnum=76c2 nwritten=72 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49536 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 59 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x3b >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 26 of length 63 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49600 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30402 (0x76C2) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBreadX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c2 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=1) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c2 name: spoolss len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) > read_from_pipe: spoolss: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/05/09 08:52:20, 3] smbd/pipes.c:(251) > readX-IPC pnum=76c2 min=1024 max=1024 nread=68 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49600 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 17 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0E 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 73 70 6F 6F 6C 73 73 00 01 00 00 00 00 00 00 00 spoolss. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 262 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x106 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 27 of length 266 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=262 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=220 > smb_uid=101 > smb_mid=49664 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 178 (0xB2) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 178 (0xB2) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30402 (0x76C2) > smb_bcc=195 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 B2 00 00 00 17 00 00 ........ ........ > [020] 00 9A 00 00 00 00 00 45 00 B8 FF 39 00 08 00 00 .......E ...9.... > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h > [040] 00 65 00 76 00 79 00 00 00 00 00 00 00 00 00 00 .e.v.y.. ........ > [050] 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ > [060] 00 1C F5 95 00 1C 00 00 00 C8 93 39 00 78 F5 95 ........ ...9.x.. > [070] 00 28 0A 00 00 03 00 00 00 00 00 00 00 00 00 39 .(...... .......9 > [080] 00 0B 00 00 00 00 00 00 00 0B 00 00 00 5C 00 5C ........ .....\.\ > [090] 00 4E 00 54 00 32 00 31 00 38 00 32 00 30 00 31 .N.T.2.1 .8.2.0.1 > [0A0] 00 00 00 5C 00 09 00 00 00 00 00 00 00 09 00 00 ...\.... ........ > [0B0] 00 6B 00 61 00 6D 00 61 00 6E 00 68 00 61 00 6C .k.a.m.a .n.h.a.l > [0C0] 00 00 00 ... >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=178 params=0 setup=2 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:20, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:20, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c2 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=1) >[2006/05/09 08:52:20, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "spoolss" (pnum 76c2) >[2006/05/09 08:52:20, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d480 max_trans_reply: 1024 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c2 name: spoolss open: Yes len: 178 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 178 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 178 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 178, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 162 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 162 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 00b2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000017 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 162 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 162, incoming data = 162 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 0000009a >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 0045 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 75 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\spoolss >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[1].fn == 120184250 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 spoolss_io_q_open_printer_ex >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 ptr: 0039ffb8 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000004 smb_io_unistr2 printername >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 uni_max_len: 00000008 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0008 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c uni_str_len: 00000008 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0010 buffer : \.\.c.h.e.v.y... >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000020 spoolss_io_printer_default >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 datatype_ptr: 00000000 >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000024 smb_io_unistr2 - NULL datatype >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000024 spoolss_io_devmode_cont >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 size: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0028 devmode_ptr: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 002c access_required: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0030 user_switch: 00000001 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000034 spool_io_user_level >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0034 level: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0038 ptr: 0095f51c >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 00003c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 003c size: 0000001c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0040 ptr: 003993c8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0044 ptr: 0095f578 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0048 build: 00000a28 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 004c major: 00000003 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0050 minor: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0054 processor: 00390000 >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 000058 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0058 uni_max_len: 0000000b >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 005c offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0060 uni_str_len: 0000000b >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0064 buffer : \.\.N.T.2.1.8.2.0.1... >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 00007c smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 007c uni_max_len: 00000009 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0080 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0084 uni_str_len: 00000009 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0088 buffer : k.a.m.a.n.h.a.l... > checking name: \\chevy >[2006/05/09 08:52:20, 10] rpc_server/srv_spoolss_nt.c:(556) > open_printer_hnd: name [\\chevy] >[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(142) > Opened policy hnd[1] [000] 00 00 00 00 01 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D > [010] 55 2C 06 00 U,.. >[2006/05/09 08:52:20, 3] rpc_server/srv_spoolss_nt.c:(416) > Setting printer type=\\chevy > Printer is a print server >[2006/05/09 08:52:20, 4] rpc_server/srv_spoolss_nt.c:(452) > Setting printer name=\\chevy (len=7) >[2006/05/09 08:52:20, 5] rpc_server/srv_spoolss_nt.c:(591) > 1 printer handles active >[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D > [010] 55 2C 06 00 U,.. >[2006/05/09 08:52:20, 4] rpc_server/srv_spoolss_nt.c:(1638) > Setting print server access = SERVER_ACCESS_ENUMERATE >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 spoolss_io_r_open_printer_ex >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_pol_hnd printer handle >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 data1: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 data2: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 data3: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a data4: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000c data5: ec 0a 60 44 55 2c 06 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) > 0014 status code: WERR_OK >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called spoolss successfully >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 168 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 162 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c2 name: spoolss len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: spoolss: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0030 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000017 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 00000018 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..48] >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=220 > smb_uid=101 > smb_mid=49664 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 17 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ ........ > [020] 00 00 00 00 00 EC 0A 60 44 55 2C 06 00 00 00 00 .......` DU,..... > [030] 00 . >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 128 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x80 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 28 of length 132 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=128 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=220 > smb_uid=101 > smb_mid=49728 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 44 (0x2C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 44 (0x2C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30402 (0x76C2) > smb_bcc=61 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 18 00 00 ........ .,...... > [020] 00 14 00 00 00 00 00 1D 00 00 00 00 00 01 00 00 ........ ........ > [030] 00 00 00 00 00 EC 0A 60 44 55 2C 06 00 .......` DU,.. >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=44 params=0 setup=2 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:20, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:20, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c2 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=1) >[2006/05/09 08:52:20, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "spoolss" (pnum 76c2) >[2006/05/09 08:52:20, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d480 max_trans_reply: 1024 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c2 name: spoolss open: Yes len: 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 28 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 002c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000018 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 28 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 00000014 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 001d >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 0 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\spoolss >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[3].fn == 120184930 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 spoolss_io_q_closeprinter >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_pol_hnd printer handle >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 data1: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 data2: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 data3: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a data4: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000c data5: ec 0a 60 44 55 2c 06 00 >[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D > [010] 55 2C 06 00 U,.. >[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D > [010] 55 2C 06 00 U,.. >[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D > [010] 55 2C 06 00 U,.. >[2006/05/09 08:52:20, 3] rpc_server/srv_lsa_hnd.c:(200) > Closed policy >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 spoolss_io_r_closeprinter >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_pol_hnd printer handle >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 data1: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 data2: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 data3: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a data4: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000c data5: 00 00 00 00 00 00 00 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) > 0014 status: WERR_OK >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called spoolss successfully >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 28 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c2 name: spoolss len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: spoolss: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0030 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000018 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 00000018 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..48] >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=220 > smb_uid=101 > smb_mid=49728 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 18 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [030] 00 . >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 100 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x64 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 29 of length 104 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=49792 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) > nt_open_pipe: Opening pipe \wkssvc. >[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) > nt_open_pipe: Known pipe wkssvc opening. >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) > Open pipe requested wkssvc (pipes_open=1) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210) > open_rpc_pipe_p: name spoolss pnum=76c2 >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) > Create pipe requested wkssvc >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) > init_pipe_handles: created handle list for pipe wkssvc >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) > Created internal pipe wkssvc (pipes_open=1) >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) > Opened pipe wkssvc with handle 76c3 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name wkssvc pnum=76c3 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name spoolss pnum=76c2 >[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=49792 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=49920 (0xC300) > smb_vwv[ 3]= 374 (0x176) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 136 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x88 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 30 of length 140 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49856 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30403 (0x76C3) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [030] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBwriteX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c3 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76c3 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c3 name: wkssvc open: Yes len: 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0b >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0048 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 11 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) > api_pipe_bind_req: decode request. 1495 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_rb >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0008 num_contexts: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000c context_id : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 000e num_transfer_syntaxes: 01 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 00000f smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000010 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 data : 6bffd098 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 data : a112 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0016 data : 3610 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0018 data : 98 33 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 001a data : 46 c3 f8 7e 34 5a >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 version: 00000001 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000024 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000024 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0028 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 002a data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002c data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002e data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0034 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) > api_pipe_bind_req: make response. 1548 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) > check_bind_req for \PIPE\wkssvc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\samr >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\NETLOGON >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\wkssvc >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_ba >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 000053f0 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000008 smb_io_rpc_addr_str >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 len: 000d >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000a str: \PIPE\ntsvcs. >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000017 smb_io_rpc_results >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0018 num_results: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001c result : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001e reason : 0000 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000020 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000020 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0024 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0026 data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0028 data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002a data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0030 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0044 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 56 >[2006/05/09 08:52:20, 3] smbd/pipes.c:(207) > writeX-IPC pnum=76c3 nwritten=72 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49856 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 59 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x3b >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 31 of length 63 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49920 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30403 (0x76C3) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBreadX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c3 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76c3 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c3 name: wkssvc len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/05/09 08:52:20, 3] smbd/pipes.c:(251) > readX-IPC pnum=76c3 min=1024 max=1024 nread=68 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=49920 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 144 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x90 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 32 of length 148 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=49984 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30403 (0x76C3) > smb_bcc=77 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 F0 DF 7E 01 08 00 00 .$...... ...~.... > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h > [040] 00 65 00 76 00 79 00 00 00 64 00 00 00 .e.v.y.. .d... >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:20, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:20, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c3 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76c3 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "wkssvc" (pnum 76c3) >[2006/05/09 08:52:20, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d900 max_trans_reply: 1024 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c3 name: wkssvc open: Yes len: 60 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 60 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 003c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 00000024 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 0000 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 74 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\wkssvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[0].fn == 12016d7f0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 wks_io_q_query_info >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 ptr_srv_name: 017edff0 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000004 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 uni_max_len: 00000008 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0008 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c uni_str_len: 00000008 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0010 buffer : \.\.c.h.e.v.y... >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0020 switch_value: 0064 >[2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(66) > _wks_query_info: 66 >[2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(40) > create_wks_info_100: 40 >[2006/05/09 08:52:20, 5] rpc_parse/parse_wks.c:(79) > Init WKS_INFO_100: 79 >[2006/05/09 08:52:20, 5] rpc_parse/parse_wks.c:(139) > init_wks_r_unknown_0: 139 >[2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(76) > _wks_query_info: 76 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 wks_io_r_query_info >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 switch_value: 0064 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 ptr_1 : 00000001 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000008 wks_io_wks_info_100 inf >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0008 platform_id : 000001f4 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c ptr_compname: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 ptr_lan_grp : 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0014 ver_major : 00000004 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0018 ver_minor : 00000009 >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 00001c smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 001c uni_max_len: 00000006 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 uni_str_len: 00000006 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0028 buffer : C.H.E.V.Y... >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000034 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0034 uni_max_len: 0000000a >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0038 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 003c uni_str_len: 0000000a >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0040 buffer : W.O.R.K.G.R.O.U.P... >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(761) > 0054 status : NT_STATUS_OK >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called wkssvc successfully >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 120 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 44 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c3 name: wkssvc len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 88. >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0070 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 00000058 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..112] >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=168 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=49984 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 112 (0x70) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 112 (0x70) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=113 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 70 00 00 00 01 00 00 ........ .p...... > [010] 00 58 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .X...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 06 00 00 00 00 00 00 00 06 00 00 ........ ........ > [040] 00 43 00 48 00 45 00 56 00 59 00 00 00 0A 00 00 .C.H.E.V .Y...... > [050] 00 00 00 00 00 0A 00 00 00 57 00 4F 00 52 00 4B ........ .W.O.R.K > [060] 00 47 00 52 00 4F 00 55 00 50 00 00 00 00 00 00 .G.R.O.U .P...... > [070] 00 . >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 33 of length 45 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50048 > smt_wct=3 > smb_vwv[ 0]=30403 (0x76C3) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c3 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76c3 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 5] smbd/pipes.c:(272) > reply_pipe_close: pnum:76c3 >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165) > closed pipe name wkssvc pnum=76c3 (pipes_open=1) >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50048 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 100 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x64 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 34 of length 104 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=50112 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) > nt_open_pipe: Opening pipe \srvsvc. >[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) > nt_open_pipe: Known pipe srvsvc opening. >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) > Open pipe requested srvsvc (pipes_open=1) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210) > open_rpc_pipe_p: name spoolss pnum=76c2 >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) > Create pipe requested srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) > init_pipe_handles: created handle list for pipe srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) > Created internal pipe srvsvc (pipes_open=1) >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) > Opened pipe srvsvc with handle 76c4 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name srvsvc pnum=76c4 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name spoolss pnum=76c2 >[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=50112 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=50176 (0xC400) > smb_vwv[ 3]= 374 (0x176) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 136 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x88 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 35 of length 140 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50176 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30404 (0x76C4) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [030] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBwriteX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c4 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76c4 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c4 name: srvsvc open: Yes len: 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0b >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0048 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 11 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) > api_pipe_bind_req: decode request. 1495 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_rb >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0008 num_contexts: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000c context_id : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 000e num_transfer_syntaxes: 01 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 00000f smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000010 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 data : 4b324fc8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 data : 1670 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0016 data : 01d3 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0018 data : 12 78 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 001a data : 5a 47 bf 6e e1 88 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 version: 00000003 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000024 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000024 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0028 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 002a data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002c data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002e data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0034 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) > api_pipe_bind_req: make response. 1548 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) > check_bind_req for \PIPE\srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\samr >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\NETLOGON >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\srvsvc >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_ba >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 000053f0 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000008 smb_io_rpc_addr_str >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 len: 000d >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000a str: \PIPE\ntsvcs. >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000017 smb_io_rpc_results >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0018 num_results: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001c result : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001e reason : 0000 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000020 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000020 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0024 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0026 data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0028 data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002a data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0030 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0044 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 56 >[2006/05/09 08:52:20, 3] smbd/pipes.c:(207) > writeX-IPC pnum=76c4 nwritten=72 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50176 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 59 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x3b >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 36 of length 63 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50240 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30404 (0x76C4) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBreadX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c4 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76c4 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c4 name: srvsvc len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/05/09 08:52:20, 3] smbd/pipes.c:(251) > readX-IPC pnum=76c4 min=1024 max=1024 nread=68 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50240 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 144 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x90 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 37 of length 148 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=50304 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30404 (0x76C4) > smb_bcc=77 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 F0 DF 7E 01 08 00 00 .$...... ...~.... > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h > [040] 00 65 00 76 00 79 00 00 00 65 00 00 00 .e.v.y.. .e... >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:20, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:20, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c4 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76c4 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "srvsvc" (pnum 76c4) >[2006/05/09 08:52:20, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d900 max_trans_reply: 1024 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c4 name: srvsvc open: Yes len: 60 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 60 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 003c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 00000024 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 0015 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 74 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\srvsvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[11].fn == 12017a0c0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 srv_io_q_net_srv_get_info >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 ptr_srv_name : 017edff0 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000004 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 uni_max_len: 00000008 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0008 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c uni_str_len: 00000008 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0010 buffer : \.\.c.h.e.v.y... >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 switch_value : 00000065 >[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1235) > srv_net_srv_get_info: 1235 >[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(2809) > init_srv_info_101 >[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(3044) > init_srv_r_net_srv_get_info >[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1280) > srv_net_srv_get_info: 1280 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 srv_io_r_net_srv_get_info >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 srv_io_info_ctr ctr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 switch_value: 00000065 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 ptr_srv_ctr : 00000001 >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000008 srv_io_info_101 sv101 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0008 platform_id : 000001f4 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c ptr_name : 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 ver_major : 00000004 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0014 ver_minor : 00000009 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0018 srv_type : 00009a03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 001c ptr_comment : 00000001 >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 000020 smb_io_unistr2 uni_name >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 uni_max_len: 00000006 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0028 uni_str_len: 00000006 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 002c buffer : C.H.E.V.Y... >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 000038 smb_io_unistr2 uni_comment >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0038 uni_max_len: 0000000e >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 003c offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0040 uni_str_len: 0000000e >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0044 buffer : S.a.m.b.a. .3...0...2.1.c... >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) > 0060 status: WERR_OK >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called srvsvc successfully >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 192 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 44 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c4 name: srvsvc len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 100. >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 007c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 00000064 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..124] >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=180 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=50304 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 124 (0x7C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 124 (0x7C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=125 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 7C 00 00 00 01 00 00 ........ .|...... > [010] 00 64 00 00 00 00 00 00 00 65 00 00 00 01 00 00 .d...... .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 03 9A 00 00 01 00 00 00 06 00 00 00 00 00 00 ........ ........ > [040] 00 06 00 00 00 43 00 48 00 45 00 56 00 59 00 00 .....C.H .E.V.Y.. > [050] 00 0E 00 00 00 00 00 00 00 0E 00 00 00 53 00 61 ........ .....S.a > [060] 00 6D 00 62 00 61 00 20 00 33 00 2E 00 30 00 2E .m.b.a. .3...0.. > [070] 00 32 00 31 00 63 00 00 00 00 00 00 00 .2.1.c.. ..... >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 38 of length 45 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50368 > smt_wct=3 > smb_vwv[ 0]=30404 (0x76C4) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c4 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76c4 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 5] smbd/pipes.c:(272) > reply_pipe_close: pnum:76c4 >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165) > closed pipe name srvsvc pnum=76c4 (pipes_open=1) >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50368 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 100 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x64 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 39 of length 104 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=50432 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) > nt_open_pipe: Opening pipe \wkssvc. >[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) > nt_open_pipe: Known pipe wkssvc opening. >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) > Open pipe requested wkssvc (pipes_open=1) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210) > open_rpc_pipe_p: name spoolss pnum=76c2 >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) > Create pipe requested wkssvc >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) > init_pipe_handles: created handle list for pipe wkssvc >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) > Created internal pipe wkssvc (pipes_open=1) >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) > Opened pipe wkssvc with handle 76c5 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name wkssvc pnum=76c5 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name spoolss pnum=76c2 >[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=50432 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=50432 (0xC500) > smb_vwv[ 3]= 374 (0x176) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 136 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x88 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 40 of length 140 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50496 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30405 (0x76C5) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [030] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBwriteX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c5 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76c5 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c5 name: wkssvc open: Yes len: 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0b >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0048 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 11 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) > api_pipe_bind_req: decode request. 1495 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_rb >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0008 num_contexts: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000c context_id : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 000e num_transfer_syntaxes: 01 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 00000f smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000010 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 data : 6bffd098 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 data : a112 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0016 data : 3610 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0018 data : 98 33 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 001a data : 46 c3 f8 7e 34 5a >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 version: 00000001 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000024 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000024 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0028 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 002a data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002c data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002e data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0034 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) > api_pipe_bind_req: make response. 1548 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) > check_bind_req for \PIPE\wkssvc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\samr >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\NETLOGON >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\wkssvc >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_ba >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 000053f0 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000008 smb_io_rpc_addr_str >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 len: 000d >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000a str: \PIPE\ntsvcs. >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000017 smb_io_rpc_results >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0018 num_results: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001c result : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001e reason : 0000 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000020 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000020 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0024 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0026 data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0028 data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002a data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0030 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0044 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 56 >[2006/05/09 08:52:20, 3] smbd/pipes.c:(207) > writeX-IPC pnum=76c5 nwritten=72 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50496 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 59 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x3b >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 41 of length 63 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50560 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30405 (0x76C5) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBreadX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c5 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76c5 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c5 name: wkssvc len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/05/09 08:52:20, 3] smbd/pipes.c:(251) > readX-IPC pnum=76c5 min=1024 max=1024 nread=68 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50560 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 144 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x90 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 42 of length 148 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=50624 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30405 (0x76C5) > smb_bcc=77 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 F0 DF 7E 01 08 00 00 .$...... ...~.... > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h > [040] 00 65 00 76 00 79 00 00 00 64 00 00 00 .e.v.y.. .d... >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:20, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:20, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c5 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76c5 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "wkssvc" (pnum 76c5) >[2006/05/09 08:52:20, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d900 max_trans_reply: 1024 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c5 name: wkssvc open: Yes len: 60 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 60 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 003c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 00000024 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 0000 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 74 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\wkssvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[0].fn == 12016d7f0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 wks_io_q_query_info >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 ptr_srv_name: 017edff0 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000004 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 uni_max_len: 00000008 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0008 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c uni_str_len: 00000008 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0010 buffer : \.\.c.h.e.v.y... >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0020 switch_value: 0064 >[2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(66) > _wks_query_info: 66 >[2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(40) > create_wks_info_100: 40 >[2006/05/09 08:52:20, 5] rpc_parse/parse_wks.c:(79) > Init WKS_INFO_100: 79 >[2006/05/09 08:52:20, 5] rpc_parse/parse_wks.c:(139) > init_wks_r_unknown_0: 139 >[2006/05/09 08:52:20, 5] rpc_server/srv_wkssvc_nt.c:(76) > _wks_query_info: 76 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 wks_io_r_query_info >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 switch_value: 0064 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 ptr_1 : 00000001 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000008 wks_io_wks_info_100 inf >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0008 platform_id : 000001f4 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c ptr_compname: 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 ptr_lan_grp : 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0014 ver_major : 00000004 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0018 ver_minor : 00000009 >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 00001c smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 001c uni_max_len: 00000006 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 uni_str_len: 00000006 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0028 buffer : C.H.E.V.Y... >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000034 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0034 uni_max_len: 0000000a >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0038 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 003c uni_str_len: 0000000a >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0040 buffer : W.O.R.K.G.R.O.U.P... >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(761) > 0054 status : NT_STATUS_OK >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called wkssvc successfully >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 120 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 44 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c5 name: wkssvc len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 88. >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0070 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 00000058 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..112] >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=168 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=50624 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 112 (0x70) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 112 (0x70) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=113 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 70 00 00 00 01 00 00 ........ .p...... > [010] 00 58 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .X...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 06 00 00 00 00 00 00 00 06 00 00 ........ ........ > [040] 00 43 00 48 00 45 00 56 00 59 00 00 00 0A 00 00 .C.H.E.V .Y...... > [050] 00 00 00 00 00 0A 00 00 00 57 00 4F 00 52 00 4B ........ .W.O.R.K > [060] 00 47 00 52 00 4F 00 55 00 50 00 00 00 00 00 00 .G.R.O.U .P...... > [070] 00 . >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 43 of length 45 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50688 > smt_wct=3 > smb_vwv[ 0]=30405 (0x76C5) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c5 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name wkssvc pnum=76c5 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 5] smbd/pipes.c:(272) > reply_pipe_close: pnum:76c5 >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165) > closed pipe name wkssvc pnum=76c5 (pipes_open=1) >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50688 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 100 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x64 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 44 of length 104 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=50752 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) > nt_open_pipe: Opening pipe \srvsvc. >[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) > nt_open_pipe: Known pipe srvsvc opening. >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) > Open pipe requested srvsvc (pipes_open=1) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210) > open_rpc_pipe_p: name spoolss pnum=76c2 >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) > Create pipe requested srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) > init_pipe_handles: created handle list for pipe srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) > Created internal pipe srvsvc (pipes_open=1) >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) > Opened pipe srvsvc with handle 76c6 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name srvsvc pnum=76c6 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name spoolss pnum=76c2 >[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=50752 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=50688 (0xC600) > smb_vwv[ 3]= 374 (0x176) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 136 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x88 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 45 of length 140 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50816 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30406 (0x76C6) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [030] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBwriteX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c6 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76c6 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c6 name: srvsvc open: Yes len: 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0b >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0048 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 11 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) > api_pipe_bind_req: decode request. 1495 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_rb >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0008 num_contexts: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000c context_id : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 000e num_transfer_syntaxes: 01 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 00000f smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000010 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 data : 4b324fc8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 data : 1670 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0016 data : 01d3 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0018 data : 12 78 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 001a data : 5a 47 bf 6e e1 88 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 version: 00000003 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000024 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000024 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0028 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 002a data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002c data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002e data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0034 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) > api_pipe_bind_req: make response. 1548 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) > check_bind_req for \PIPE\srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\samr >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\NETLOGON >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\srvsvc >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_ba >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 000053f0 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000008 smb_io_rpc_addr_str >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 len: 000d >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000a str: \PIPE\ntsvcs. >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000017 smb_io_rpc_results >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0018 num_results: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001c result : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001e reason : 0000 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000020 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000020 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0024 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0026 data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0028 data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002a data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0030 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0044 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 56 >[2006/05/09 08:52:20, 3] smbd/pipes.c:(207) > writeX-IPC pnum=76c6 nwritten=72 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50816 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 59 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x3b >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 46 of length 63 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50880 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30406 (0x76C6) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBreadX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c6 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76c6 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c6 name: srvsvc len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/05/09 08:52:20, 3] smbd/pipes.c:(251) > readX-IPC pnum=76c6 min=1024 max=1024 nread=68 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=50880 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 144 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x90 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 47 of length 148 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=50944 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30406 (0x76C6) > smb_bcc=77 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 F0 DF 7E 01 08 00 00 .$...... ...~.... > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 68 ........ .\.\.c.h > [040] 00 65 00 76 00 79 00 00 00 65 00 00 00 .e.v.y.. .e... >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:20, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:20, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c6 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76c6 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "srvsvc" (pnum 76c6) >[2006/05/09 08:52:20, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d900 max_trans_reply: 1024 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c6 name: srvsvc open: Yes len: 60 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 60 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 003c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 00000024 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 0015 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 74 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\srvsvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[11].fn == 12017a0c0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 srv_io_q_net_srv_get_info >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 ptr_srv_name : 017edff0 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000004 smb_io_unistr2 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 uni_max_len: 00000008 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0008 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c uni_str_len: 00000008 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0010 buffer : \.\.c.h.e.v.y... >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 switch_value : 00000065 >[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1235) > srv_net_srv_get_info: 1235 >[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(2809) > init_srv_info_101 >[2006/05/09 08:52:20, 5] rpc_parse/parse_srv.c:(3044) > init_srv_r_net_srv_get_info >[2006/05/09 08:52:20, 5] rpc_server/srv_srvsvc_nt.c:(1280) > srv_net_srv_get_info: 1280 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 srv_io_r_net_srv_get_info >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 srv_io_info_ctr ctr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 switch_value: 00000065 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 ptr_srv_ctr : 00000001 >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000008 srv_io_info_101 sv101 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0008 platform_id : 000001f4 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c ptr_name : 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 ver_major : 00000004 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0014 ver_minor : 00000009 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0018 srv_type : 00009a03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 001c ptr_comment : 00000001 >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 000020 smb_io_unistr2 uni_name >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 uni_max_len: 00000006 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0028 uni_str_len: 00000006 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 002c buffer : C.H.E.V.Y... >[2006/05/09 08:52:20, 8] rpc_parse/parse_prs.c:(84) > 000038 smb_io_unistr2 uni_comment >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0038 uni_max_len: 0000000e >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 003c offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0040 uni_str_len: 0000000e >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0044 buffer : S.a.m.b.a. .3...0...2.1.c... >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) > 0060 status: WERR_OK >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called srvsvc successfully >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 192 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 44 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c6 name: srvsvc len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 100. >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 007c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 00000064 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..124] >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=180 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=50944 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 124 (0x7C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 124 (0x7C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=125 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 7C 00 00 00 01 00 00 ........ .|...... > [010] 00 64 00 00 00 00 00 00 00 65 00 00 00 01 00 00 .d...... .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 03 9A 00 00 01 00 00 00 06 00 00 00 00 00 00 ........ ........ > [040] 00 06 00 00 00 43 00 48 00 45 00 56 00 59 00 00 .....C.H .E.V.Y.. > [050] 00 0E 00 00 00 00 00 00 00 0E 00 00 00 53 00 61 ........ .....S.a > [060] 00 6D 00 62 00 61 00 20 00 33 00 2E 00 30 00 2E .m.b.a. .3...0.. > [070] 00 32 00 31 00 63 00 00 00 00 00 00 00 .2.1.c.. ..... >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 48 of length 45 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=51008 > smt_wct=3 > smb_vwv[ 0]=30406 (0x76C6) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c6 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name srvsvc pnum=76c6 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 5] smbd/pipes.c:(272) > reply_pipe_close: pnum:76c6 >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165) > closed pipe name srvsvc pnum=76c6 (pipes_open=1) >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=51008 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 100 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x64 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 49 of length 104 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=51072 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 768 (0x300) > smb_bcc=17 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 77 00 69 00 6E 00 72 00 65 00 67 00 00 .\.w.i.n .r.e.g.. > [010] 00 . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0 >[2006/05/09 08:52:20, 4] smbd/nttrans.c:(330) > nt_open_pipe: Opening pipe \winreg. >[2006/05/09 08:52:20, 3] smbd/nttrans.c:(351) > nt_open_pipe: Known pipe winreg opening. >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(179) > Open pipe requested winreg (pipes_open=1) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(210) > open_rpc_pipe_p: name spoolss pnum=76c2 >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(285) > Create pipe requested winreg >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(77) > init_pipe_handles: created handle list for pipe winreg >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(92) > init_pipe_handles: pipe_handles ref count = 1 for pipe winreg >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(362) > Created internal pipe winreg (pipes_open=1) >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(262) > Opened pipe winreg with handle 76c7 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name winreg pnum=76c7 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(269) > open pipes: name spoolss pnum=76c2 >[2006/05/09 08:52:20, 5] smbd/nttrans.c:(400) > do_ntcreate_pipe_open: open pipe = \winreg >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=51072 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=50944 (0xC700) > smb_vwv[ 3]= 374 (0x176) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:20, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:20, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:20, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 136 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x88 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 50 of length 140 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=51136 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30407 (0x76C7) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 01 D0 8C 33 44 22 F1 31 AA AA 90 00 38 00 10 ....3D". 1....8.. > [030] 03 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBwriteX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(287) > setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:20, 5] auth/auth_util.c:(437) > NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 > contains 5 SIDs > SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 > SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:52:20, 5] auth/auth_util.c:(454) > UNIX token of user 205 > Primary group is 15 and contains 1 supplementary groups > Group[ 0]: 15 >[2006/05/09 08:52:20, 5] smbd/uid.c:(308) > change_to_user uid=(0,205) gid=(0,15) >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c7 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name winreg pnum=76c7 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c7 name: winreg open: Yes len: 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0b >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0048 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 11 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1495) > api_pipe_bind_req: decode request. 1495 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(1505) > api_pipe_bind_req: \PIPE\winreg -> \PIPE\winreg >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_rb >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0008 num_contexts: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000c context_id : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 000e num_transfer_syntaxes: 01 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 00000f smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000010 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 data : 338cd001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 data : 2244 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0016 data : 31f1 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0018 data : aa aa >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 001a data : 90 00 38 00 10 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 version: 00000001 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000024 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000024 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0028 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 002a data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002c data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002e data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0034 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(1548) > api_pipe_bind_req: make response. 1548 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe.c:(959) > check_bind_req for \PIPE\winreg >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\lsarpc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\samr >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\NETLOGON >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\srvsvc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\wkssvc >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe.c:(964) > checking \PIPE\winreg >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_ba >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_bba >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0000 max_tsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0002 max_rsize: 10b8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 assoc_gid: 000053f0 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000008 smb_io_rpc_addr_str >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 len: 000d >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000a str: \PIPE\winreg. >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000017 smb_io_rpc_results >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0018 num_results: 01 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001c result : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 001e reason : 0000 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000020 smb_io_rpc_iface >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 000020 smb_io_uuid uuid >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 data : 8a885d04 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0024 data : 1ceb >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0026 data : 11c9 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 0028 data : 9f e8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 002a data : 08 00 2b 10 48 60 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0030 version: 00000002 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 0c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0044 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 56 >[2006/05/09 08:52:20, 3] smbd/pipes.c:(207) > writeX-IPC pnum=76c7 nwritten=72 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=51136 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 59 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x3b >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 51 of length 63 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=51200 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=30407 (0x76C7) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBreadX (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c7 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name winreg pnum=76c7 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c7 name: winreg len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1049) > read_from_pipe: winreg: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/05/09 08:52:20, 3] smbd/pipes.c:(251) > readX-IPC pnum=76c7 min=1024 max=1024 nread=68 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=51200 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 77 69 6E 72 65 67 00 00 01 00 00 00 00 00 00 00 winreg.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 52 of length 124 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=120 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=51264 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 36 (0x24) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 36 (0x24) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30407 (0x76C7) > smb_bcc=53 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 24 00 00 00 01 00 00 ........ .$...... > [020] 00 0C 00 00 00 00 00 02 00 28 E3 7E 01 F8 B1 01 ........ .(.~.... > [030] 00 00 00 00 02 ..... >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=36 params=0 setup=2 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:20, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:20, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c7 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name winreg pnum=76c7 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "winreg" (pnum 76c7) >[2006/05/09 08:52:20, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d900 max_trans_reply: 1024 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c7 name: winreg open: Yes len: 36 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 36 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 36 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 36, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 20 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 20 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0024 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 20 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 20, incoming data = 20 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 0000000c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 0002 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 74 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\winreg >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: winreg op 0x2 - api_rpcTNP: rpc command: REG_OPEN_HKLM >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[3].fn == 120162b10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 reg_io_q_open_hive >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 ptr: 017ee328 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0004 server: b1f8 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0008 access: 02000000 >[2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(205, 15) : sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:20, 3] smbd/uid.c:(392) > push_conn_ctx(101) : conn_ctx_stack_ndx = 0 >[2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:20, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:20, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:20, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (205, 15) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:20, 10] registry/reg_db.c:(265) > regdb_open: refcount reset (1) >[2006/05/09 08:52:20, 7] registry/reg_frontend.c:(359) > regkey_open_internal: name = [HKLM] >[2006/05/09 08:52:20, 10] registry/reg_cachehook.c:(95) > reghook_cache_find: Searching for keyname [/HKLM] >[2006/05/09 08:52:20, 10] lib/adt_tree.c:(341) > pathtree_find: Enter [/HKLM] >[2006/05/09 08:52:20, 10] lib/adt_tree.c:(413) > pathtree_find: Exit >[2006/05/09 08:52:20, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x02000000, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410. >[2006/05/09 08:52:20, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:52:20, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 >[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(142) > Opened policy hnd[1] [000] 00 00 00 00 02 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D > [010] 55 2C 06 00 U,.. >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 reg_io_r_open_hive >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_pol_hnd >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 data1: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 data2: 00000002 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 data3: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a data4: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000c data5: ec 0a 60 44 55 2c 06 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) > 0014 status: WERR_OK >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called winreg successfully >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 538 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 20 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c7 name: winreg len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0030 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000001 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 00000018 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..48] >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=51264 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ > [020] 00 00 00 00 00 EC 0A 60 44 55 2C 06 00 00 00 00 .......` DU,..... > [030] 00 . >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 228 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0xe4 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 53 of length 232 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=228 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=51328 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 144 (0x90) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 144 (0x90) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30407 (0x76C7) > smb_bcc=161 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 90 00 00 00 02 00 00 ........ ........ > [020] 00 78 00 00 00 00 00 0F 00 00 00 00 00 02 00 00 .x...... ........ > [030] 00 00 00 00 00 EC 0A 60 44 55 2C 06 00 46 00 46 .......` DU,..F.F > [040] 00 10 15 83 75 23 00 00 00 00 00 00 00 23 00 00 ....u#.. .....#.. > [050] 00 53 00 4F 00 46 00 54 00 57 00 41 00 52 00 45 .S.O.F.T .W.A.R.E > [060] 00 5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F .\.M.i.c .r.o.s.o > [070] 00 66 00 74 00 5C 00 53 00 63 00 68 00 65 00 64 .f.t.\.S .c.h.e.d > [080] 00 75 00 6C 00 69 00 6E 00 67 00 41 00 67 00 65 .u.l.i.n .g.A.g.e > [090] 00 6E 00 74 00 00 00 00 00 00 00 00 00 19 00 02 .n.t.... ........ > [0A0] 00 . >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=144 params=0 setup=2 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:20, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:20, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c7 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name winreg pnum=76c7 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "winreg" (pnum 76c7) >[2006/05/09 08:52:20, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d900 max_trans_reply: 1024 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c7 name: winreg open: Yes len: 144 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 144 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 144 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 144, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 128 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 128 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0090 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000002 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 128 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 128, incoming data = 128 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 00000078 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 000f >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 0 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\winreg >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: winreg op 0xf - api_rpcTNP: rpc command: REG_OPEN_ENTRY >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[1].fn == 120162de0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 reg_io_q_open_entry >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_pol_hnd >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 data1: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 data2: 00000002 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 data3: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a data4: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000c data5: ec 0a 60 44 55 2c 06 00 >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000014 prs_unistr4 name >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 length: 0046 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0016 size: 0046 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0018 ptr: 75831510 >[2006/05/09 08:52:20, 7] rpc_parse/parse_prs.c:(84) > 00001c smb_io_unistr2 name >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 001c uni_max_len: 00000023 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0020 offset : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0024 uni_str_len: 00000023 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(904) > 0028 buffer : S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.S.c.h.e.d.u.l.i.n.g.A.g.e.n.t... >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0070 unknown_0 : 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0074 access: 00020019 >[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) > Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D > [010] 55 2C 06 00 U,.. >[2006/05/09 08:52:20, 10] registry/reg_db.c:(248) > regdb_open: incrementing refcount (1) >[2006/05/09 08:52:20, 7] registry/reg_frontend.c:(359) > regkey_open_internal: name = [HKLM\SOFTWARE\Microsoft\SchedulingAgent] >[2006/05/09 08:52:20, 10] registry/reg_cachehook.c:(95) > reghook_cache_find: Searching for keyname [/HKLM/SOFTWARE/Microsoft/SchedulingAgent] >[2006/05/09 08:52:20, 10] lib/adt_tree.c:(341) > pathtree_find: Enter [/HKLM/SOFTWARE/Microsoft/SchedulingAgent] >[2006/05/09 08:52:20, 10] lib/adt_tree.c:(413) > pathtree_find: Exit >[2006/05/09 08:52:20, 5] registry/reg_db.c:(457) > regdb_fetch_keys: tdb lookup failed to locate key [HKLM\SOFTWARE\Microsoft\SchedulingAgent] >[2006/05/09 08:52:20, 10] registry/reg_db.c:(279) > regdb_close: decrementing refcount (1) >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 reg_io_r_open_entry >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_pol_hnd handle >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 data1: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 data2: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 data3: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a data4: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000c data5: 00 00 00 00 00 00 00 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) > 0014 status: WERR_BADFILE >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called winreg successfully >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 94 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 128 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c7 name: winreg len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0030 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000002 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 00000018 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..48] >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=51328 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 02 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ > [030] 00 . >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 128 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x80 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 54 of length 132 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=128 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=51392 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 44 (0x2C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 44 (0x2C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30407 (0x76C7) > smb_bcc=61 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 ........ .,...... > [020] 00 14 00 00 00 00 00 05 00 00 00 00 00 02 00 00 ........ ........ > [030] 00 00 00 00 00 EC 0A 60 44 55 2C 06 00 .......` DU,.. >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBtrans (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 3] smbd/ipc.c:(538) > trans <\PIPE\> data=44 params=0 setup=2 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(560) > calling named_pipe >[2006/05/09 08:52:20, 3] smbd/ipc.c:(334) > named pipe command on <> name >[2006/05/09 08:52:20, 5] smbd/ipc.c:(265) > api_fd_reply >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c7 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name winreg pnum=76c7 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 3] smbd/ipc.c:(294) > Got API command 0x26 on pipe "winreg" (pnum 76c7) >[2006/05/09 08:52:20, 10] smbd/ipc.c:(299) > api_fd_reply: p:14010d900 max_trans_reply: 1024 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(934) > write_to_pipe: 76c7 name: winreg open: Yes len: 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(390) > fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 16 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 28 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 002c >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000003 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(478) > unmarshall_rpc_header: using little-endian RPC >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(507) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(956) > write_to_pipe: data_left = 28 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(847) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(715) > process_complete_pdu: processing packet type 0 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr_req req >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 alloc_hint: 00000014 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0004 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0006 opnum : 0005 >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 0 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2195) > Requested \PIPE\winreg >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe.c:(2230) > api_rpcTNP: winreg op 0x5 - api_rpcTNP: rpc command: REG_CLOSE >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe.c:(2255) > api_rpc_cmds[0].fn == 120162a20 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 reg_io_q_close >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_pol_hnd >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 data1: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 data2: 00000002 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 data3: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a data4: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000c data5: ec 0a 60 44 55 2c 06 00 >[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) > Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D > [010] 55 2C 06 00 U,.. >[2006/05/09 08:52:20, 4] rpc_server/srv_lsa_hnd.c:(162) > Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 EC 0A 60 44 ........ ......`D > [010] 55 2C 06 00 U,.. >[2006/05/09 08:52:20, 3] rpc_server/srv_lsa_hnd.c:(200) > Closed policy >[2006/05/09 08:52:20, 10] registry/reg_db.c:(279) > regdb_close: decrementing refcount (0) >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 reg_io_r_close >[2006/05/09 08:52:20, 6] rpc_parse/parse_prs.c:(84) > 000000 smb_io_pol_hnd >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0000 data1: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0004 data2: 00000000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 data3: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a data4: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(819) > 000c data5: 00 00 00 00 00 00 00 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(791) > 0014 status: WERR_OK >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe.c:(2277) > api_rpcTNP: called winreg successfully >[2006/05/09 08:52:20, 3] rpc_server/srv_pipe_hnd.c:(525) > free_pipe_context: destroying talloc pool of size 0 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(960) > write_to_pipe: data_used = 28 >[2006/05/09 08:52:20, 6] rpc_server/srv_pipe_hnd.c:(992) > read_from_pipe: 76c7 name: winreg len: 1024 >[2006/05/09 08:52:20, 10] rpc_server/srv_pipe_hnd.c:(1063) > read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000000 smb_io_rpc_hdr hdr >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0000 major : 05 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0001 minor : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0002 pkt_type : 02 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0003 flags : 03 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0004 pack_type0: 10 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0005 pack_type1: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0006 pack_type2: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0007 pack_type3: 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0008 frag_len : 0030 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 000a auth_len : 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 000c call_id : 00000003 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(703) > 0010 alloc_hint: 00000018 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(674) > 0014 context_id: 0000 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0016 cancel_ct : 00 >[2006/05/09 08:52:20, 5] rpc_parse/parse_prs.c:(614) > 0017 reserved : 00 >[2006/05/09 08:52:20, 5] smbd/ipc.c:(58) > copy_trans_params_and_data: params[0..0] data[0..48] >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=2236 > smb_uid=101 > smb_mid=51392 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2006/05/09 08:52:20, 10] lib/util.c:(2058) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [030] 00 . >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:20, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:20, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:20, 3] smbd/process.c:(1194) > Transaction 55 of length 45 >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=51456 > smt_wct=3 > smb_vwv[ 0]=30407 (0x76C7) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:20, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x14011b050 >[2006/05/09 08:52:20, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1261) > search for pipe pnum=76c7 >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name winreg pnum=76c7 (pipes_open=2) >[2006/05/09 08:52:20, 5] rpc_server/srv_pipe_hnd.c:(1264) > pipe name spoolss pnum=76c2 (pipes_open=2) >[2006/05/09 08:52:20, 5] smbd/pipes.c:(272) > reply_pipe_close: pnum:76c7 >[2006/05/09 08:52:20, 10] rpc_server/srv_lsa_hnd.c:(235) > close_policy_by_pipe: deleted handle list for pipe winreg >[2006/05/09 08:52:20, 4] rpc_server/srv_pipe_hnd.c:(1165) > closed pipe name winreg pnum=76c7 (pipes_open=1) >[2006/05/09 08:52:20, 5] lib/util.c:(454) >[2006/05/09 08:52:20, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=51456 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:20, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:20, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:22, 10] lib/util_sock.c:(618) > got smb length of 78 >[2006/05/09 08:52:22, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x4e >[2006/05/09 08:52:22, 3] smbd/process.c:(1194) > Transaction 56 of length 82 >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=78 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=101 > smb_mid=51520 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 78 (0x4E) > smb_vwv[ 2]= 8 (0x8) > smb_vwv[ 3]= 1 (0x1) > smb_bcc=35 >[2006/05/09 08:52:22, 10] lib/util.c:(2058) > [000] 00 5C 00 5C 00 43 00 48 00 45 00 56 00 59 00 5C .\.\.C.H .E.V.Y.\ > [010] 00 50 00 41 00 56 00 41 00 4E 00 00 00 3F 3F 3F .P.A.V.A .N...??? > [020] 3F 3F 00 ??. >[2006/05/09 08:52:22, 3] smbd/process.c:(993) > switch message SMBtconX (pid 404565) conn 0x0 >[2006/05/09 08:52:22, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:22, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:22, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:22, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:22, 4] smbd/reply.c:(660) > Client requested device type [?????] for share [PAVAN] >[2006/05/09 08:52:22, 5] smbd/service.c:(824) > making a connection to 'homes' service [PAVAN] created at session setup time >[2006/05/09 08:52:22, 3] lib/access.c:(291) > only_ipaddrs_in_list: list has non-ip address (.india.hp.com) >[2006/05/09 08:52:22, 3] lib/access.c:(316) > check_access: hostnames in host allow/deny list. >[2006/05/09 08:52:22, 2] lib/access.c:(322) > Allowed connection from nt218201.india.hp.com (15.76.218.201) >[2006/05/09 08:52:22, 5] lib/username.c:(290) > Finding user pavan >[2006/05/09 08:52:22, 5] lib/username.c:(234) > Trying _Get_Pwnam(), username as lowercase is pavan >[2006/05/09 08:52:22, 10] lib/util_pw.c:(98) > Got pavan from pwnam_cache >[2006/05/09 08:52:22, 5] lib/username.c:(266) > Get_Pwnam_internals did find user [pavan]! >[2006/05/09 08:52:22, 3] smbd/service.c:(488) > Connect path is '/usr/users/pavan' for service [pavan] >[2006/05/09 08:52:22, 4] rpc_server/srv_srvsvc_nt.c:(240) > get_share_security: using default secdesc for pavan >[2006/05/09 08:52:22, 10] lib/util_seaccess.c:(175) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2006/05/09 08:52:22, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x00000002, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410. >[2006/05/09 08:52:22, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:52:22, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 >[2006/05/09 08:52:22, 5] lib/util_seaccess.c:(308) > se_access_check: access (2) granted. >[2006/05/09 08:52:22, 3] smbd/vfs.c:(216) > Initialising default vfs hooks >[2006/05/09 08:52:22, 5] smbd/connection.c:(170) > claiming pavan 0 >[2006/05/09 08:52:22, 10] smbd/uid.c:(124) > is_share_read_only_for_user: share pavan is read-write for unix user pavan >[2006/05/09 08:52:22, 4] rpc_server/srv_srvsvc_nt.c:(240) > get_share_security: using default secdesc for pavan >[2006/05/09 08:52:22, 10] lib/util_seaccess.c:(175) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2006/05/09 08:52:22, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x00000002, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410. >[2006/05/09 08:52:22, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:52:22, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 >[2006/05/09 08:52:22, 5] lib/util_seaccess.c:(308) > se_access_check: access (2) granted. >[2006/05/09 08:52:22, 4] rpc_server/srv_srvsvc_nt.c:(240) > get_share_security: using default secdesc for pavan >[2006/05/09 08:52:22, 10] lib/util_seaccess.c:(175) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2006/05/09 08:52:22, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x00000002, for NT token with 5 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-1410. >[2006/05/09 08:52:22, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:52:22, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-1410 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-1031 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 >[2006/05/09 08:52:22, 5] lib/util_seaccess.c:(308) > se_access_check: access (2) granted. >[2006/05/09 08:52:22, 3] smbd/sec_ctx.c:(287) > setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:22, 5] auth/auth_util.c:(437) > NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 > contains 5 SIDs > SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 > SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:52:22, 5] auth/auth_util.c:(454) > UNIX token of user 205 > Primary group is 15 and contains 1 supplementary groups > Group[ 0]: 15 >[2006/05/09 08:52:22, 5] smbd/uid.c:(308) > change_to_user uid=(0,205) gid=(0,15) >[2006/05/09 08:52:22, 1] smbd/service.c:(693) > nt218201 (15.76.218.201) connect to service pavan initially as user pavan (uid=205, gid=15) (pid 404565) >[2006/05/09 08:52:22, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:22, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:22, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:22, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:22, 3] smbd/reply.c:(707) > tconX service=PAVAN >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=54 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=51520 > smt_wct=3 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 1 (0x1) > smb_bcc=13 >[2006/05/09 08:52:22, 10] lib/util.c:(2058) > [000] 41 3A 00 4E 00 54 00 46 00 53 00 00 00 A:.N.T.F .S... >[2006/05/09 08:52:22, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:22, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:22, 10] lib/util_sock.c:(618) > got smb length of 76 >[2006/05/09 08:52:22, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x4c >[2006/05/09 08:52:22, 3] smbd/process.c:(1194) > Transaction 57 of length 80 >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=76 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51584 > smt_wct=15 > smb_vwv[ 0]= 8 (0x8) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 8 (0x8) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=11 >[2006/05/09 08:52:22, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 00 00 ........ ... >[2006/05/09 08:52:22, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:22, 3] smbd/sec_ctx.c:(287) > setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:22, 5] auth/auth_util.c:(437) > NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 > contains 5 SIDs > SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 > SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:52:22, 5] auth/auth_util.c:(454) > UNIX token of user 205 > Primary group is 15 and contains 1 supplementary groups > Group[ 0]: 15 >[2006/05/09 08:52:22, 5] smbd/uid.c:(308) > change_to_user uid=(0,205) gid=(0,15) >[2006/05/09 08:52:22, 4] smbd/vfs.c:(738) > vfs_ChDir to /usr/users/pavan >[2006/05/09 08:52:22, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:22, 5] smbd/filename.c:(108) > unix_convert called on file "" >[2006/05/09 08:52:22, 5] smbd/filename.c:(137) > conversion finished "" -> . >[2006/05/09 08:52:22, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo . (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) > dos_mode: . >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning d >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) > dos_mode returning d >[2006/05/09 08:52:22, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:22, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:24 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 10 >[2006/05/09 08:52:22, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:22, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51584 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:22, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 C6 E2 ........ Z.s..... > [010] 5E 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E ^.s..... Z.s..... > [020] 5A 17 73 C6 01 10 00 00 00 00 00 00 00 Z.s..... ..... >[2006/05/09 08:52:22, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:22, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:22, 10] lib/util_sock.c:(618) > got smb length of 86 >[2006/05/09 08:52:22, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x56 >[2006/05/09 08:52:22, 3] smbd/process.c:(1194) > Transaction 58 of length 90 >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=86 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51648 > smt_wct=15 > smb_vwv[ 0]= 18 (0x12) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 10 (0xA) > smb_vwv[ 3]=16384 (0x4000) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 18 (0x12) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 1 (0x1) > smb_bcc=21 >[2006/05/09 08:52:22, 10] lib/util.c:(2058) > [000] 00 00 00 16 00 56 05 06 00 04 01 00 00 00 00 5C .....V.. .......\ > [010] 00 2A 00 00 00 .*... >[2006/05/09 08:52:22, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:22, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:22, 3] smbd/trans2.c:(1629) > call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=0, close_if_end = 2 requires_resume_key = 4 level = 0x104, max_data_bytes = 16384 >[2006/05/09 08:52:22, 5] smbd/filename.c:(108) > unix_convert called on file "*" >[2006/05/09 08:52:22, 10] smbd/statcache.c:(215) > stat_cache_lookup: lookup failed for name [*] >[2006/05/09 08:52:22, 5] smbd/filename.c:(185) > unix_convert begin: name = *, dirpath = , start = * >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276) > is_mangled * ? >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215) > is_mangled_component * (len 1) ? >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276) > is_mangled * ? >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215) > is_mangled_component * (len 1) ? >[2006/05/09 08:52:22, 5] smbd/filename.c:(335) > New file * >[2006/05/09 08:52:22, 5] smbd/trans2.c:(1688) > dir=./, mask = * >[2006/05/09 08:52:22, 5] smbd/dir.c:(391) > dptr_create dir=./ >[2006/05/09 08:52:22, 3] smbd/dir.c:(510) > creating new dirptr 256 for path ./, expect_close = 1 >[2006/05/09 08:52:22, 4] smbd/trans2.c:(1745) > dptr_num is 256, wcard = *, attr = 22 >[2006/05/09 08:52:22, 8] smbd/trans2.c:(1750) > dirpath=<./> dontdescend=<> >[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) > get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 0 >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) > dos_mode: ./. >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning d >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) > dos_mode returning d >[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) > get_lanman2_dir_entry found ./. fname=. >[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) > get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO >[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) > get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 2147483648 >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) > dos_mode: ./.. >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning d >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) > dos_mode returning d >[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) > get_lanman2_dir_entry found ./.. fname=.. >[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) > get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO >[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) > get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 64 >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) > dos_mode: ./.cshrc >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) > dos_mode returning ha >[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) > get_lanman2_dir_entry found ./.cshrc fname=.cshrc >[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) > get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616) > name_map: .cshrc -> 46EB5320 -> _JOE4O~0 (cache=1) >[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) > get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 84 >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) > dos_mode: ./bin >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning d >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) > dos_mode returning d >[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) > get_lanman2_dir_entry found ./bin fname=bin >[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) > get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO >[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) > get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 108 >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) > dos_mode: ./.login >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) > dos_mode returning ha >[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) > get_lanman2_dir_entry found ./.login fname=.login >[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) > get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616) > name_map: .login -> 6257D060 -> _RABK2~O (cache=1) >[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) > get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 136 >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) > dos_mode: ./.profile >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) > dos_mode returning ha >[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) > get_lanman2_dir_entry found ./.profile fname=.profile >[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) > get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616) > name_map: .profile -> 5B1248D4 -> _P9OQF~O (cache=1) >[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) > get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 176 >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) > dos_mode: ./autobook_12.html >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) > get_lanman2_dir_entry found ./autobook_12.html fname=autobook_12.html >[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) > get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616) > name_map: autobook_12.html -> 61CF5FF0 -> AR4ZWM~O (cache=1) >[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) > get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset 216 >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) > dos_mode: ./New Text Document.txt >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:22, 5] smbd/trans2.c:(1169) > get_lanman2_dir_entry found ./New Text Document.txt fname=New Text Document.txt >[2006/05/09 08:52:22, 10] smbd/trans2.c:(1310) > get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(616) > name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1) >[2006/05/09 08:52:22, 8] smbd/trans2.c:(1078) > get_lanman2_dir_entry:readdir on dirptr 0x1400ed380 now at offset -1 >[2006/05/09 08:52:22, 5] smbd/trans2.c:(1798) > call_trans2findfirst - (2) closing dptr_num 256 >[2006/05/09 08:52:22, 4] smbd/dir.c:(238) > closing dptr key 256 >[2006/05/09 08:52:22, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 10, data_sent_thistime = 888, useable_space = 131010 >[2006/05/09 08:52:22, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 10, data_to_send = 888, paramsize = 10, datasize = 888 >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=956 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51648 > smt_wct=10 > smb_vwv[ 0]= 10 (0xA) > smb_vwv[ 1]= 888 (0x378) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 10 (0xA) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 888 (0x378) > smb_vwv[ 7]= 68 (0x44) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=901 >[2006/05/09 08:52:22, 10] lib/util.c:(2058) > [000] 00 FD FF 08 00 01 00 00 00 F0 02 00 00 60 00 00 ........ .....`.. > [010] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 C6 E2 ........ Z.s..... > [020] 5E 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E ^.s..... Z.s..... > [030] 5A 17 73 C6 01 00 00 00 00 00 00 00 00 00 00 00 Z.s..... ........ > [040] 00 00 00 00 00 10 00 00 00 02 00 00 00 00 00 00 ........ ........ > [050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [060] 00 00 00 00 00 00 00 00 00 00 00 2E 00 64 00 00 ........ .....d.. > [070] 00 00 00 00 00 00 22 06 B2 60 5C C6 01 00 BD C0 ......". .`\..... > [080] E7 4F 64 C6 01 00 22 06 B2 60 5C C6 01 00 22 06 .Od...". .`\...". > [090] B2 60 5C C6 01 00 00 00 00 00 00 00 00 00 00 00 .`\..... ........ > [0A0] 00 00 00 00 00 10 00 00 00 04 00 00 00 00 00 00 ........ ........ > [0B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [0C0] 00 00 00 00 00 00 00 00 00 00 00 2E 00 2E 00 00 ........ ........ > [0D0] 00 6C 00 00 00 00 00 00 00 80 57 20 ED 6D 75 C2 .l...... ..W .mu. > [0E0] 01 80 FE 37 6F 72 63 C6 01 80 57 20 ED 6D 75 C2 ...7orc. ..W .mu. > [0F0] 01 80 57 20 ED 6D 75 C2 01 0F 05 00 00 00 00 00 ..W .mu. ........ > [100] 00 00 00 10 00 00 00 00 00 22 00 00 00 0C 00 00 ........ ."...... > [110] 00 00 00 00 00 10 00 5F 00 4A 00 4F 00 45 00 34 ......._ .J.O.E.4 > [120] 00 4F 00 7E 00 30 00 00 00 00 00 00 00 00 00 2E .O.~.0.. ........ > [130] 00 63 00 73 00 68 00 72 00 63 00 00 00 64 00 00 .c.s.h.r .c...d.. > [140] 00 00 00 00 00 80 35 22 2F FB 6C C6 01 00 98 E3 ......5" /.l..... > [150] 4A 08 73 C6 01 80 35 22 2F FB 6C C6 01 80 35 22 J.s...5" /.l...5" > [160] 2F FB 6C C6 01 00 00 00 00 00 00 00 00 00 00 00 /.l..... ........ > [170] 00 00 00 00 00 10 00 00 00 06 00 00 00 00 00 00 ........ ........ > [180] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [190] 00 00 00 00 00 00 00 00 00 00 00 62 00 69 00 6E ........ ...b.i.n > [1A0] 00 6C 00 00 00 00 00 00 00 00 B9 F4 EA 46 4A C5 .l...... .....FJ. > [1B0] 01 00 22 06 B2 60 5C C6 01 00 B9 F4 EA 46 4A C5 .."..`\. .....FJ. > [1C0] 01 00 B9 F4 EA 46 4A C5 01 B8 05 00 00 00 00 00 .....FJ. ........ > [1D0] 00 00 00 10 00 00 00 00 00 22 00 00 00 0C 00 00 ........ ."...... > [1E0] 00 00 00 00 00 10 00 5F 00 52 00 41 00 42 00 4B ......._ .R.A.B.K > [1F0] 00 32 00 7E 00 4F 00 00 00 00 00 00 00 00 00 2E .2.~.O.. ........ >[2006/05/09 08:52:22, 4] smbd/trans2.c:(1832) > SMBtrans2 mask=* directory=./ dirtype=22 numentries=8 >[2006/05/09 08:52:22, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:22, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:22, 10] lib/util_sock.c:(618) > got smb length of 100 >[2006/05/09 08:52:22, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x64 >[2006/05/09 08:52:22, 3] smbd/process.c:(1194) > Transaction 59 of length 104 >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51712 > smt_wct=15 > smb_vwv[ 0]= 32 (0x20) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 32 (0x20) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=35 >[2006/05/09 08:52:22, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 64 00 65 00 73 ........ .\.d.e.s > [010] 00 6B 00 74 00 6F 00 70 00 2E 00 69 00 6E 00 69 .k.t.o.p ...i.n.i > [020] 00 00 00 ... >[2006/05/09 08:52:22, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:22, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:22, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:22, 5] smbd/filename.c:(108) > unix_convert called on file "desktop.ini" >[2006/05/09 08:52:22, 10] smbd/statcache.c:(215) > stat_cache_lookup: lookup failed for name [DESKTOP.INI] >[2006/05/09 08:52:22, 5] smbd/filename.c:(185) > unix_convert begin: name = desktop.ini, dirpath = , start = desktop.ini >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276) > is_mangled desktop.ini ? >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215) > is_mangled_component desktop.ini (len 11) ? >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276) > is_mangled desktop.ini ? >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215) > is_mangled_component desktop.ini (len 11) ? >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(276) > is_mangled desktop.ini ? >[2006/05/09 08:52:22, 10] smbd/mangle_hash2.c:(215) > is_mangled_component desktop.ini (len 11) ? >[2006/05/09 08:52:22, 5] smbd/filename.c:(335) > New file desktop.ini >[2006/05/09 08:52:22, 3] smbd/trans2.c:(2886) > call_trans2qfilepathinfo: SMB_VFS_STAT of desktop.ini failed (No such file or directory) >[2006/05/09 08:52:22, 10] smbd/trans2.c:(2622) > set_bad_path_error: err = 2 bad_path = 0 >[2006/05/09 08:52:22, 3] smbd/error.c:(142) > error packet at smbd/trans2.c(2629) cmd=50 (SMBtrans2) NT_STATUS_OBJECT_NAME_NOT_FOUND >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=35 > smb_com=0x32 > smb_rcls=52 > smb_reh=0 > smb_err=49152 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51712 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:22, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:22, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:22, 10] lib/util_sock.c:(618) > got smb length of 86 >[2006/05/09 08:52:22, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x56 >[2006/05/09 08:52:22, 3] smbd/process.c:(1194) > Transaction 60 of length 90 >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=86 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51776 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4096 (0x1000) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 256 (0x100) > smb_vwv[ 8]= 4096 (0x1000) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 1792 (0x700) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 256 (0x100) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_bcc=3 >[2006/05/09 08:52:22, 10] lib/util.c:(2058) > [000] 00 00 00 ... >[2006/05/09 08:52:22, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x140168050 >[2006/05/09 08:52:22, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:22, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x10, access_mask = 0x100001 file_attributes = 0x0, share_access = 0x7, create_disposition = 0x1 create_options = 0x1 root_dir_fid = 0x0 >[2006/05/09 08:52:22, 5] smbd/filename.c:(108) > unix_convert called on file "" >[2006/05/09 08:52:22, 5] smbd/filename.c:(137) > conversion finished "" -> . >[2006/05/09 08:52:22, 5] smbd/open.c:(1801) > open_directory: opening directory ., access_mask = 0x100001, share_access = 0x7 create_options = 0x1, create_disposition = 0x1 >[2006/05/09 08:52:22, 5] smbd/files.c:(127) > allocated file structure 463, fnum = 4559 (1 used) >[2006/05/09 08:52:22, 10] locking/locking.c:(538) > unparse_share_modes: del: 0, num: 1 >[2006/05/09 08:52:22, 10] locking/locking.c:(416) > print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) > dos_mode: . >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning d >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) > dos_mode returning d >[2006/05/09 08:52:22, 5] smbd/nttrans.c:(910) > reply_ntcreate_and_X: fnum = 4559, open name = . >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51776 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=52992 (0xCF00) > smb_vwv[ 3]= 273 (0x111) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 7698 (0x1E12) > smb_vwv[ 7]= 5978 (0x175A) > smb_vwv[ 8]=50803 (0xC673) > smb_vwv[ 9]= 1 (0x1) > smb_vwv[10]=64363 (0xFB6B) > smb_vwv[11]= 6088 (0x17C8) > smb_vwv[12]=50803 (0xC673) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 7698 (0x1E12) > smb_vwv[15]= 5978 (0x175A) > smb_vwv[16]=50803 (0xC673) > smb_vwv[17]= 1 (0x1) > smb_vwv[18]= 7698 (0x1E12) > smb_vwv[19]= 5978 (0x175A) > smb_vwv[20]=50803 (0xC673) > smb_vwv[21]= 4097 (0x1001) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 0 (0x0) > smb_vwv[32]= 1792 (0x700) > smb_vwv[33]= 256 (0x100) > smb_bcc=0 >[2006/05/09 08:52:22, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:22, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:22, 10] lib/util_sock.c:(618) > got smb length of 76 >[2006/05/09 08:52:22, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x4c >[2006/05/09 08:52:22, 3] smbd/process.c:(1194) > Transaction 61 of length 80 >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=76 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51840 > smt_wct=15 > smb_vwv[ 0]= 8 (0x8) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 8 (0x8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 8 (0x8) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=11 >[2006/05/09 08:52:22, 10] lib/util.c:(2058) > [000] 00 00 00 EE 03 00 00 00 00 00 00 ........ ... >[2006/05/09 08:52:22, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:22, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:22, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1006 >[2006/05/09 08:52:22, 5] smbd/filename.c:(108) > unix_convert called on file "" >[2006/05/09 08:52:22, 5] smbd/filename.c:(137) > conversion finished "" -> . >[2006/05/09 08:52:22, 10] locking/locking.c:(440) > parse_share_modes: delete_on_close: 0, num_share_modes: 1 >[2006/05/09 08:52:22, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:22, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo . (fnum = -1) level=1006 call=5 total_data=0 >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(300) > dos_mode: . >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning d >[2006/05/09 08:52:22, 8] smbd/dosmode.c:(334) > dos_mode returning d >[2006/05/09 08:52:22, 10] smbd/trans2.c:(3228) > call_trans2qfilepathinfo: SMB_FILE_INTERNAL_INFORMATION >[2006/05/09 08:52:22, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 8, useable_space = 131010 >[2006/05/09 08:52:22, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 8, paramsize = 2, datasize = 8 >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=68 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51840 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 8 (0x8) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 8 (0x8) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=13 >[2006/05/09 08:52:22, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 29 BC 00 00 8D 80 FE B9 .....).. ..... >[2006/05/09 08:52:22, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:22, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:22, 10] lib/util_sock.c:(618) > got smb length of 84 >[2006/05/09 08:52:22, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x54 >[2006/05/09 08:52:22, 3] smbd/process.c:(1194) > Transaction 62 of length 88 >[2006/05/09 08:52:22, 5] lib/util.c:(454) >[2006/05/09 08:52:22, 5] lib/util.c:(457) > size=84 > smb_com=0xa0 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51904 > smt_wct=23 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 8192 (0x2000) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]=21504 (0x5400) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 1024 (0x400) > smb_vwv[18]= 4 (0x4) > smb_vwv[19]= 23 (0x17) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]= 4559 (0x11CF) > smb_vwv[22]= 0 (0x0) > smb_bcc=3 >[2006/05/09 08:52:22, 10] lib/util.c:(2058) > [000] 00 00 00 ... >[2006/05/09 08:52:22, 3] smbd/process.c:(993) > switch message SMBnttrans (pid 404565) conn 0x140168050 >[2006/05/09 08:52:22, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:22, 10] smbd/nttrans.c:(2806) > reply_nttrans: setup_count = 8 >[2006/05/09 08:52:22, 10] lib/util.c:(2058) > [000] 17 00 00 00 CF 11 00 00 ........ >[2006/05/09 08:52:22, 3] smbd/nttrans.c:(1853) > call_nt_transact_notify_change >[2006/05/09 08:52:22, 3] smbd/nttrans.c:(1867) > call_nt_transact_notify_change: notify change called on directory name = . >[2006/05/09 08:52:22, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:22, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 86 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x56 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 63 of length 90 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=86 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51969 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=33024 (0x8100) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 768 (0x300) > smb_bcc=3 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 ... >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:23, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x16, access_mask = 0x81 file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x0 root_dir_fid = 0x0 >[2006/05/09 08:52:23, 5] smbd/filename.c:(108) > unix_convert called on file "" >[2006/05/09 08:52:23, 5] smbd/filename.c:(137) > conversion finished "" -> . >[2006/05/09 08:52:23, 3] smbd/dosmode.c:(121) > unix_mode(.) returning 0740 >[2006/05/09 08:52:23, 10] smbd/open.c:(1085) > open_file_ntcreate: fname=., dos_attrs=0x0 access_mask=0x81 share_access=0x3 create_disposition = 0x1 create_options=0x0 unix mode=0740 oplock_request=3 >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) > dos_mode: . >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning d >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) > dos_mode returning d >[2006/05/09 08:52:23, 10] smbd/open.c:(1258) > open_file_ntcreate: fname=., after mapping access_mask=0x81 >[2006/05/09 08:52:23, 5] smbd/files.c:(127) > allocated file structure 464, fnum = 4560 (2 used) >[2006/05/09 08:52:23, 10] locking/locking.c:(440) > parse_share_modes: delete_on_close: 0, num_share_modes: 1 >[2006/05/09 08:52:23, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] smbd/open.c:(382) > share_conflict: entry->access_mask = 0x100001, entry->share_access = 0x7, entry->private_options = 0x1 >[2006/05/09 08:52:23, 10] smbd/open.c:(389) > share_conflict: access_mask = 0x81, share_access = 0x3 >[2006/05/09 08:52:23, 10] smbd/open.c:(438) > share_conflict: [1] am (0x100001) & right (0x6) = 0x0 >[2006/05/09 08:52:23, 10] smbd/open.c:(438) > share_conflict: [1] sa (0x3) & share (0x2) = 0x2 >[2006/05/09 08:52:23, 10] smbd/open.c:(440) > share_conflict: [2] am (0x81) & right (0x6) = 0x0 >[2006/05/09 08:52:23, 10] smbd/open.c:(440) > share_conflict: [2] sa (0x7) & share (0x2) = 0x2 >[2006/05/09 08:52:23, 10] smbd/open.c:(443) > share_conflict: [3] am (0x100001) & right (0x21) = 0x1 >[2006/05/09 08:52:23, 10] smbd/open.c:(443) > share_conflict: [3] sa (0x3) & share (0x1) = 0x1 >[2006/05/09 08:52:23, 10] smbd/open.c:(445) > share_conflict: [4] am (0x81) & right (0x21) = 0x1 >[2006/05/09 08:52:23, 10] smbd/open.c:(445) > share_conflict: [4] sa (0x7) & share (0x1) = 0x1 >[2006/05/09 08:52:23, 10] smbd/open.c:(448) > share_conflict: [5] am (0x100001) & right (0x10000) = 0x0 >[2006/05/09 08:52:23, 10] smbd/open.c:(448) > share_conflict: [5] sa (0x3) & share (0x4) = 0x0 >[2006/05/09 08:52:23, 10] smbd/open.c:(450) > share_conflict: [6] am (0x81) & right (0x10000) = 0x0 >[2006/05/09 08:52:23, 10] smbd/open.c:(450) > share_conflict: [6] sa (0x7) & share (0x4) = 0x4 >[2006/05/09 08:52:23, 10] smbd/open.c:(453) > share_conflict: No conflict. >[2006/05/09 08:52:23, 4] smbd/open.c:(1488) > calling open_file with flags=0x0 flags2=0x0 mode=0740 >[2006/05/09 08:52:23, 10] smbd/open.c:(54) > fd_open: name ., flags = 00 mode = 0740, fd = 25. >[2006/05/09 08:52:23, 5] smbd/files.c:(449) > freed files structure 4560 (1 used) >[2006/05/09 08:52:23, 5] smbd/open.c:(1801) > open_directory: opening directory ., access_mask = 0x81, share_access = 0x3 create_options = 0x0, create_disposition = 0x1 >[2006/05/09 08:52:23, 5] smbd/files.c:(127) > allocated file structure 465, fnum = 4561 (2 used) >[2006/05/09 08:52:23, 10] locking/locking.c:(440) > parse_share_modes: delete_on_close: 0, num_share_modes: 1 >[2006/05/09 08:52:23, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] smbd/open.c:(382) > share_conflict: entry->access_mask = 0x100001, entry->share_access = 0x7, entry->private_options = 0x1 >[2006/05/09 08:52:23, 10] smbd/open.c:(389) > share_conflict: access_mask = 0x81, share_access = 0x3 >[2006/05/09 08:52:23, 10] smbd/open.c:(438) > share_conflict: [1] am (0x100001) & right (0x6) = 0x0 >[2006/05/09 08:52:23, 10] smbd/open.c:(438) > share_conflict: [1] sa (0x3) & share (0x2) = 0x2 >[2006/05/09 08:52:23, 10] smbd/open.c:(440) > share_conflict: [2] am (0x81) & right (0x6) = 0x0 >[2006/05/09 08:52:23, 10] smbd/open.c:(440) > share_conflict: [2] sa (0x7) & share (0x2) = 0x2 >[2006/05/09 08:52:23, 10] smbd/open.c:(443) > share_conflict: [3] am (0x100001) & right (0x21) = 0x1 >[2006/05/09 08:52:23, 10] smbd/open.c:(443) > share_conflict: [3] sa (0x3) & share (0x1) = 0x1 >[2006/05/09 08:52:23, 10] smbd/open.c:(445) > share_conflict: [4] am (0x81) & right (0x21) = 0x1 >[2006/05/09 08:52:23, 10] smbd/open.c:(445) > share_conflict: [4] sa (0x7) & share (0x1) = 0x1 >[2006/05/09 08:52:23, 10] smbd/open.c:(448) > share_conflict: [5] am (0x100001) & right (0x10000) = 0x0 >[2006/05/09 08:52:23, 10] smbd/open.c:(448) > share_conflict: [5] sa (0x3) & share (0x4) = 0x0 >[2006/05/09 08:52:23, 10] smbd/open.c:(450) > share_conflict: [6] am (0x81) & right (0x10000) = 0x0 >[2006/05/09 08:52:23, 10] smbd/open.c:(450) > share_conflict: [6] sa (0x7) & share (0x4) = 0x4 >[2006/05/09 08:52:23, 10] smbd/open.c:(453) > share_conflict: No conflict. >[2006/05/09 08:52:23, 10] locking/locking.c:(538) > unparse_share_modes: del: 0, num: 2 >[2006/05/09 08:52:23, 10] locking/locking.c:(416) > print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] locking/locking.c:(416) > print_share_mode_table: share_mode_entry[1]: pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x0, file_id = 3, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) > dos_mode: . >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning d >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) > dos_mode returning d >[2006/05/09 08:52:23, 5] smbd/nttrans.c:(910) > reply_ntcreate_and_X: fnum = 4561, open name = . >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51969 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=53504 (0xD100) > smb_vwv[ 3]= 273 (0x111) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 7698 (0x1E12) > smb_vwv[ 7]= 5978 (0x175A) > smb_vwv[ 8]=50803 (0xC673) > smb_vwv[ 9]= 1 (0x1) > smb_vwv[10]=64363 (0xFB6B) > smb_vwv[11]= 6088 (0x17C8) > smb_vwv[12]=50803 (0xC673) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 7698 (0x1E12) > smb_vwv[15]= 5978 (0x175A) > smb_vwv[16]=50803 (0xC673) > smb_vwv[17]= 1 (0x1) > smb_vwv[18]= 7698 (0x1E12) > smb_vwv[19]= 5978 (0x175A) > smb_vwv[20]=50803 (0xC673) > smb_vwv[21]= 4097 (0x1001) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 0 (0x0) > smb_vwv[32]= 1792 (0x700) > smb_vwv[33]= 256 (0x100) > smb_bcc=0 >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 84 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x54 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 64 of length 88 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=84 > smb_com=0xa0 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52033 > smt_wct=23 > smb_vwv[ 0]= 4 (0x4) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 4096 (0x1000) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]=21504 (0x5400) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 1024 (0x400) > smb_vwv[18]= 2 (0x2) > smb_vwv[19]=16484 (0x4064) > smb_vwv[20]= 20 (0x14) > smb_vwv[21]= 4561 (0x11D1) > smb_vwv[22]= 1 (0x1) > smb_bcc=3 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 ... >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBnttrans (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:23, 10] smbd/nttrans.c:(2806) > reply_nttrans: setup_count = 8 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 64 40 14 00 D1 11 01 00 d@...... >[2006/05/09 08:52:23, 10] smbd/nttrans.c:(2130) > call_nt_transact_ioctl: function[0x00144064] FID[0x11D1] isFSctl[0x01] compfilter[0x00] >[2006/05/09 08:52:23, 5] smbd/nttrans.c:(2227) > FSCTL_GET_SHADOW_COPY_DATA: connectpath /usr/users/pavan, not supported. >[2006/05/09 08:52:23, 3] smbd/error.c:(142) > error packet at smbd/nttrans.c(2229) cmd=160 (SMBnttrans) NT_STATUS_NOT_SUPPORTED >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=35 > smb_com=0xa0 > smb_rcls=187 > smb_reh=0 > smb_err=49152 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52033 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 65 of length 45 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=52097 > smt_wct=3 > smb_vwv[ 0]= 4561 (0x11D1) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:23, 3] smbd/reply.c:(3257) > close directory fnum=4561 >[2006/05/09 08:52:23, 10] locking/locking.c:(440) > parse_share_modes: delete_on_close: 0, num_share_modes: 2 >[2006/05/09 08:52:23, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[1]: pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x0, file_id = 3, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] locking/locking.c:(538) > unparse_share_modes: del: 0, num: 2 >[2006/05/09 08:52:23, 10] locking/locking.c:(416) > print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] locking/locking.c:(416) > print_share_mode_table: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x40, file_id = 3, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 5] smbd/files.c:(449) > freed files structure 4561 (1 used) >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=52097 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 88 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x58 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 66 of length 92 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=88 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52161 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 512 (0x200) > smb_vwv[ 3]= 4096 (0x1000) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=32768 (0x8000) > smb_vwv[ 8]= 4096 (0x1000) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]=32768 (0x8000) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 8192 (0x2000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 768 (0x300) > smb_bcc=5 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 5C 00 00 00 .\... >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:23, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x10, access_mask = 0x100080 file_attributes = 0x80, share_access = 0x3, create_disposition = 0x1 create_options = 0x200000 root_dir_fid = 0x0 >[2006/05/09 08:52:23, 5] smbd/filename.c:(108) > unix_convert called on file "" >[2006/05/09 08:52:23, 5] smbd/filename.c:(137) > conversion finished "" -> . >[2006/05/09 08:52:23, 3] smbd/dosmode.c:(121) > unix_mode(.) returning 0740 >[2006/05/09 08:52:23, 10] smbd/open.c:(1085) > open_file_ntcreate: fname=., dos_attrs=0x80 access_mask=0x100080 share_access=0x3 create_disposition = 0x1 create_options=0x200000 unix mode=0740 oplock_request=0 >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) > dos_mode: . >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning d >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) > dos_mode returning d >[2006/05/09 08:52:23, 10] smbd/open.c:(1258) > open_file_ntcreate: fname=., after mapping access_mask=0x100080 >[2006/05/09 08:52:23, 5] smbd/files.c:(127) > allocated file structure 466, fnum = 4562 (2 used) >[2006/05/09 08:52:23, 10] locking/locking.c:(440) > parse_share_modes: delete_on_close: 0, num_share_modes: 2 >[2006/05/09 08:52:23, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x40, file_id = 3, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 4] smbd/open.c:(1488) > calling open_file with flags=0x0 flags2=0x0 mode=0740 >[2006/05/09 08:52:23, 5] smbd/files.c:(449) > freed files structure 4562 (1 used) >[2006/05/09 08:52:23, 5] smbd/open.c:(1801) > open_directory: opening directory ., access_mask = 0x100080, share_access = 0x3 create_options = 0x200000, create_disposition = 0x1 >[2006/05/09 08:52:23, 5] smbd/files.c:(127) > allocated file structure 467, fnum = 4563 (2 used) >[2006/05/09 08:52:23, 10] locking/locking.c:(440) > parse_share_modes: delete_on_close: 0, num_share_modes: 2 >[2006/05/09 08:52:23, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x0, access_mask = 0x81, mid = 0x0, type= 0x40, file_id = 3, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] locking/locking.c:(538) > unparse_share_modes: del: 0, num: 2 >[2006/05/09 08:52:23, 10] locking/locking.c:(416) > print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] locking/locking.c:(416) > print_share_mode_table: share_mode_entry[1]: pid = 404565, share_access = 0x3, private_options = 0x200000, access_mask = 0x100080, mid = 0x0, type= 0x0, file_id = 5, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) > dos_mode: . >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning d >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) > dos_mode returning d >[2006/05/09 08:52:23, 5] smbd/nttrans.c:(910) > reply_ntcreate_and_X: fnum = 4563, open name = . >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52161 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=54016 (0xD300) > smb_vwv[ 3]= 273 (0x111) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 7698 (0x1E12) > smb_vwv[ 7]= 5978 (0x175A) > smb_vwv[ 8]=50803 (0xC673) > smb_vwv[ 9]= 1 (0x1) > smb_vwv[10]=64363 (0xFB6B) > smb_vwv[11]= 6088 (0x17C8) > smb_vwv[12]=50803 (0xC673) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 7698 (0x1E12) > smb_vwv[15]= 5978 (0x175A) > smb_vwv[16]=50803 (0xC673) > smb_vwv[17]= 1 (0x1) > smb_vwv[18]= 7698 (0x1E12) > smb_vwv[19]= 5978 (0x175A) > smb_vwv[20]=50803 (0xC673) > smb_vwv[21]= 4097 (0x1001) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 0 (0x0) > smb_vwv[32]= 1792 (0x700) > smb_vwv[33]= 256 (0x100) > smb_bcc=0 >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 84 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x54 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 67 of length 88 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=84 > smb_com=0xa0 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52225 > smt_wct=23 > smb_vwv[ 0]= 4 (0x4) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 64 (0x40) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]=21504 (0x5400) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 1024 (0x400) > smb_vwv[18]= 2 (0x2) > smb_vwv[19]= 168 (0xA8) > smb_vwv[20]= 9 (0x9) > smb_vwv[21]= 4563 (0x11D3) > smb_vwv[22]= 1 (0x1) > smb_bcc=3 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 ... >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBnttrans (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:23, 10] smbd/nttrans.c:(2806) > reply_nttrans: setup_count = 8 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] A8 00 09 00 D3 11 01 00 ........ >[2006/05/09 08:52:23, 10] smbd/nttrans.c:(2130) > call_nt_transact_ioctl: function[0x000900A8] FID[0x11D3] isFSctl[0x01] compfilter[0x00] >[2006/05/09 08:52:23, 10] smbd/nttrans.c:(2162) > FSCTL_GET_REPARSE_POINT: called on FID[0x11D3](but not implemented) >[2006/05/09 08:52:23, 3] smbd/error.c:(142) > error packet at smbd/nttrans.c(95) cmd=160 (SMBnttrans) NT_STATUS_NOT_A_REPARSE_POINT >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=35 > smb_com=0xa0 > smb_rcls=117 > smb_reh=2 > smb_err=49152 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52225 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 68 of length 45 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=52289 > smt_wct=3 > smb_vwv[ 0]= 4563 (0x11D3) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:23, 3] smbd/reply.c:(3257) > close directory fnum=4563 >[2006/05/09 08:52:23, 10] locking/locking.c:(440) > parse_share_modes: delete_on_close: 0, num_share_modes: 2 >[2006/05/09 08:52:23, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[1]: pid = 404565, share_access = 0x3, private_options = 0x200000, access_mask = 0x100080, mid = 0x0, type= 0x0, file_id = 5, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] locking/locking.c:(538) > unparse_share_modes: del: 0, num: 2 >[2006/05/09 08:52:23, 10] locking/locking.c:(416) > print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 10] locking/locking.c:(416) > print_share_mode_table: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x200000, access_mask = 0x100080, mid = 0x0, type= 0x40, file_id = 5, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:23, 5] smbd/files.c:(449) > freed files structure 4563 (1 used) >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=52289 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 236 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0xec >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 69 of length 240 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=236 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=0 > smb_mid=52353 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 236 (0xEC) > smb_vwv[ 2]=16644 (0x4104) > smb_vwv[ 3]= 50 (0x32) > smb_vwv[ 4]= 1 (0x1) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 74 (0x4A) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 212 (0xD4) > smb_vwv[11]=40960 (0xA000) > smb_bcc=177 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 60 48 06 06 2B 06 01 05 05 02 A0 3E 30 3C A0 0E `H..+... ...>0<.. > [010] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A2 2A 0...+... ..7....* > [020] 04 28 4E 54 4C 4D 53 53 50 00 01 00 00 00 97 82 .(NTLMSS P....... > [030] 08 E2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [040] 00 00 05 01 28 0A 00 00 00 0F 00 57 00 69 00 6E ....(... ...W.i.n > [050] 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 00 30 .d.o.w.s . .2.0.0 > [060] 00 32 00 20 00 53 00 65 00 72 00 76 00 69 00 63 .2. .S.e .r.v.i.c > [070] 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 32 .e. .P.a .c.k. .2 > [080] 00 20 00 32 00 36 00 30 00 30 00 00 00 57 00 69 . .2.6.0 .0...W.i > [090] 00 6E 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 .n.d.o.w .s. .2.0 > [0A0] 00 30 00 32 00 20 00 35 00 2E 00 31 00 00 00 00 .0.2. .5 ...1.... > [0B0] 00 . >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBsesssetupX (pid 404565) conn 0x0 >[2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:23, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:23, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:23, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(822) > wct=12 flg2=0xc807 >[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(633) > Doing spnego session setup >[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(663) > NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] >[2006/05/09 08:52:23, 10] smbd/password.c:(182) > register_vuid: allocated vuid = 102 >[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(525) > Got OID 1 3 6 1 4 1 311 2 2 10 >[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(528) > Got secblob of size 40 >[2006/05/09 08:52:23, 5] auth/auth.c:(485) > Making default auth method list for standalone security=user, encrypt passwords = yes >[2006/05/09 08:52:23, 5] auth/auth.c:(388) > load_auth_module: Attempting to find an auth method to match guest >[2006/05/09 08:52:23, 5] auth/auth.c:(413) > load_auth_module: auth method guest has a valid init >[2006/05/09 08:52:23, 5] auth/auth.c:(388) > load_auth_module: Attempting to find an auth method to match sam >[2006/05/09 08:52:23, 5] auth/auth.c:(413) > load_auth_module: auth method sam has a valid init >[2006/05/09 08:52:23, 3] libsmb/ntlmssp.c:(63) > Got NTLMSSP neg_flags=0xe2088297 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_NEGOTIATE_OEM > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_LM_KEY > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH > NTLMSSP_NEGOTIATE_56 >[2006/05/09 08:52:23, 5] auth/auth.c:(95) > auth_get_challenge: module guest did not want to specify a challenge >[2006/05/09 08:52:23, 5] auth/auth.c:(95) > auth_get_challenge: module sam did not want to specify a challenge >[2006/05/09 08:52:23, 5] auth/auth.c:(135) > auth_context challenge created by random >[2006/05/09 08:52:23, 5] auth/auth.c:(136) > challenge is: >[2006/05/09 08:52:23, 5] lib/util.c:(2058) > [000] C9 FA 9C 98 A8 9E 02 25 .......% >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=290 > smb_com=0x73 > smb_rcls=22 > smb_reh=0 > smb_err=49152 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=65279 > smb_uid=102 > smb_mid=52353 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 189 (0xBD) > smb_bcc=247 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] A1 81 BA 30 81 B7 A0 03 0A 01 01 A1 0C 06 0A 2B ...0.... .......+ > [010] 06 01 04 01 82 37 02 02 0A A2 81 A1 04 81 9E 4E .....7.. .......N > [020] 54 4C 4D 53 53 50 00 02 00 00 00 0A 00 0A 00 30 TLMSSP.. .......0 > [030] 00 00 00 B5 82 8A 60 C9 FA 9C 98 A8 9E 02 25 00 ......`. ......%. > [040] 00 00 00 00 00 00 00 64 00 64 00 3A 00 00 00 43 .......d .d.:...C > [050] 00 48 00 45 00 56 00 59 00 02 00 0A 00 43 00 48 .H.E.V.Y .....C.H > [060] 00 45 00 56 00 59 00 01 00 0A 00 43 00 48 00 45 .E.V.Y.. ...C.H.E > [070] 00 56 00 59 00 04 00 18 00 69 00 6E 00 64 00 69 .V.Y.... .i.n.d.i > [080] 00 61 00 2E 00 68 00 70 00 2E 00 63 00 6F 00 6D .a...h.p ...c.o.m > [090] 00 03 00 24 00 63 00 68 00 65 00 76 00 79 00 2E ...$.c.h .e.v.y.. > [0A0] 00 69 00 6E 00 64 00 69 00 61 00 2E 00 68 00 70 .i.n.d.i .a...h.p > [0B0] 00 2E 00 63 00 6F 00 6D 00 00 00 00 00 55 00 6E ...c.o.m .....U.n > [0C0] 00 69 00 78 00 00 00 53 00 61 00 6D 00 62 00 61 .i.x...S .a.m.b.a > [0D0] 00 20 00 33 00 2E 00 30 00 2E 00 32 00 31 00 63 . .3...0 ...2.1.c > [0E0] 00 00 00 57 00 4F 00 52 00 4B 00 47 00 52 00 4F ...W.O.R .K.G.R.O > [0F0] 00 55 00 50 00 00 00 .U.P... >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 274 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x112 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 70 of length 278 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=274 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=102 > smb_mid=52417 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 274 (0x112) > smb_vwv[ 2]=16644 (0x4104) > smb_vwv[ 3]= 50 (0x32) > smb_vwv[ 4]= 1 (0x1) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 113 (0x71) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 212 (0xD4) > smb_vwv[11]=40960 (0xA000) > smb_bcc=215 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] A1 6F 30 6D A2 6B 04 69 4E 54 4C 4D 53 53 50 00 .o0m.k.i NTLMSSP. > [010] 03 00 00 00 01 00 01 00 58 00 00 00 00 00 00 00 ........ X....... > [020] 59 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 Y....... H....... > [030] 48 00 00 00 10 00 10 00 48 00 00 00 10 00 10 00 H....... H....... > [040] 59 00 00 00 15 8A 88 62 05 01 28 0A 00 00 00 0F Y......b ..(..... > [050] 4E 00 54 00 32 00 31 00 38 00 32 00 30 00 31 00 N.T.2.1. 8.2.0.1. > [060] 00 34 4B E5 5B 01 57 BA DB 53 87 D6 9C 0B CC 3C .4K.[.W. .S.....< > [070] B7 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s. > [080] 00 32 00 30 00 30 00 32 00 20 00 53 00 65 00 72 .2.0.0.2 . .S.e.r > [090] 00 76 00 69 00 63 00 65 00 20 00 50 00 61 00 63 .v.i.c.e . .P.a.c > [0A0] 00 6B 00 20 00 32 00 20 00 32 00 36 00 30 00 30 .k. .2. .2.6.0.0 > [0B0] 00 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 ...W.i.n .d.o.w.s > [0C0] 00 20 00 32 00 30 00 30 00 32 00 20 00 35 00 2E . .2.0.0 .2. .5.. > [0D0] 00 31 00 00 00 00 00 .1..... >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBsesssetupX (pid 404565) conn 0x0 >[2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:23, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:23, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:23, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(822) > wct=12 flg2=0xc807 >[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(633) > Doing spnego session setup >[2006/05/09 08:52:23, 3] smbd/sesssetup.c:(663) > NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] >[2006/05/09 08:52:23, 3] libsmb/ntlmssp.c:(661) > Got user=[] domain=[] workstation=[NT218201] len1=1 len2=0 >[2006/05/09 08:52:23, 6] param/loadparm.c:(2947) > lp_file_list_changed() > file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 > >[2006/05/09 08:52:23, 5] auth/auth_util.c:(162) > make_user_info_map: Mapping user []\[] from workstation [NT218201] >[2006/05/09 08:52:23, 5] auth/auth_util.c:(69) > attempting to make a user_info for () >[2006/05/09 08:52:23, 5] auth/auth_util.c:(79) > making strings for 's user_info struct >[2006/05/09 08:52:23, 5] auth/auth_util.c:(121) > making blobs for 's user_info struct >[2006/05/09 08:52:23, 10] auth/auth_util.c:(139) > made an encrypted user_info for () >[2006/05/09 08:52:23, 3] auth/auth.c:(218) > check_ntlm_password: Checking password for unmapped user []\[]@[NT218201] with the new password interface >[2006/05/09 08:52:23, 3] auth/auth.c:(221) > check_ntlm_password: mapped user is: [CHEVY]\[]@[NT218201] >[2006/05/09 08:52:23, 10] auth/auth.c:(230) > check_ntlm_password: auth_context challenge created by random >[2006/05/09 08:52:23, 10] auth/auth.c:(233) > challenge is: >[2006/05/09 08:52:23, 5] lib/util.c:(2058) > [000] C9 FA 9C 98 A8 9E 02 25 .......% >[2006/05/09 08:52:23, 10] lib/account_pol.c:(332) > account_policy_get: name: password history, val: 0 >[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(616) > pdb_set_username: setting username nobody, was >[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(643) > pdb_set_domain: setting domain CHEVY, was >[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(670) > pdb_set_nt_username: setting nt username , was >[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(697) > pdb_set_full_name: setting full name nobody, was >[2006/05/09 08:52:23, 4] lib/substitute.c:(359) > Home server: chevy >[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(805) > pdb_set_homedir: setting home dir \\chevy\nobody, was >[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(778) > pdb_set_dir_drive: setting dir drive , was NULL >[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(724) > pdb_set_logon_script: setting logon script , was >[2006/05/09 08:52:23, 4] lib/substitute.c:(359) > Home server: chevy >[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(751) > pdb_set_profile_path: setting profile path \\chevy\nobody\profile, was >[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(884) > pdb_set_workstations: setting workstations , was >[2006/05/09 08:52:23, 10] lib/account_pol.c:(332) > account_policy_get: name: password history, val: 0 >[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(543) > pdb_set_user_sid: setting user sid S-1-5-21-4112424572-1378032116-4237619202-501 >[2006/05/09 08:52:23, 10] passdb/pdb_compat.c:(72) > pdb_set_user_sid_from_rid: > setting user sid S-1-5-21-4112424572-1378032116-4237619202-501 from rid 501 >[2006/05/09 08:52:23, 10] passdb/pdb_get_set.c:(579) > pdb_set_group_sid: setting group sid S-1-5-21-4112424572-1378032116-4237619202-514 >[2006/05/09 08:52:23, 10] passdb/pdb_compat.c:(99) > pdb_set_group_sid_from_rid: > setting group sid S-1-5-21-4112424572-1378032116-4237619202-514 from rid 514 >[2006/05/09 08:52:23, 3] auth/auth.c:(267) > check_ntlm_password: guest authentication for user [] succeeded >[2006/05/09 08:52:23, 5] auth/auth.c:(302) > check_ntlm_password: guest authentication for user [] -> [] -> [nobody] succeeded >[2006/05/09 08:52:23, 5] auth/auth_util.c:(1485) > attempting to free (and zero) a user_info structure >[2006/05/09 08:52:23, 10] auth/auth_util.c:(1488) > structure was created for >[2006/05/09 08:52:23, 10] auth/auth_ntlmssp.c:(119) > Got NT session key of length 16 >[2006/05/09 08:52:23, 10] auth/auth_ntlmssp.c:(126) > Got LM session key of length 16 >[2006/05/09 08:52:23, 10] libsmb/ntlmssp.c:(755) > ntlmssp_server_auth: Using unmodified nt session key. >[2006/05/09 08:52:23, 3] libsmb/ntlmssp_sign.c:(338) > NTLMSSP Sign/Seal - Initialising with flags: >[2006/05/09 08:52:23, 3] libsmb/ntlmssp.c:(63) > Got NTLMSSP neg_flags=0x60088235 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_SEAL > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH >[2006/05/09 08:52:23, 10] smbd/password.c:(182) > register_vuid: allocated vuid = 103 >[2006/05/09 08:52:23, 10] lib/util_pw.c:(98) > Got nobody from pwnam_cache >[2006/05/09 08:52:23, 10] smbd/password.c:(252) > register_vuid: (65534,65534) nobody CHEVY guest=1 >[2006/05/09 08:52:23, 3] smbd/password.c:(257) > User name: nobody Real name: nobody >[2006/05/09 08:52:23, 3] smbd/password.c:(276) > UNIX uid 65534 is UNIX user nobody, and will be vuid 103 >[2006/05/09 08:52:23, 6] param/loadparm.c:(2947) > lp_file_list_changed() > file /usr/local/samba/lib/smb.conf -> /usr/local/samba/lib/smb.conf last mod_time: Tue May 9 08:51:35 2006 > >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=110 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=65279 > smb_uid=103 > smb_mid=52417 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 9 (0x9) > smb_bcc=67 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] A1 07 30 05 A0 03 0A 01 00 55 00 6E 00 69 00 78 ..0..... .U.n.i.x > [010] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3 > [020] 00 2E 00 30 00 2E 00 32 00 31 00 63 00 00 00 57 ...0...2 .1.c...W > [030] 00 4F 00 52 00 4B 00 47 00 52 00 4F 00 55 00 50 .O.R.K.G .R.O.U.P > [040] 00 00 00 ... >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 76 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x4c >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 71 of length 80 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=76 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=103 > smb_mid=52481 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 76 (0x4C) > smb_vwv[ 2]= 8 (0x8) > smb_vwv[ 3]= 1 (0x1) > smb_bcc=33 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 5C 00 5C 00 43 00 48 00 45 00 56 00 59 00 5C .\.\.C.H .E.V.Y.\ > [010] 00 49 00 50 00 43 00 24 00 00 00 3F 3F 3F 3F 3F .I.P.C.$ ...????? > [020] 00 . >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBtconX (pid 404565) conn 0x0 >[2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:23, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:23, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:23, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:23, 4] smbd/reply.c:(660) > Client requested device type [?????] for share [IPC$] >[2006/05/09 08:52:23, 5] smbd/service.c:(860) > making a connection to 'normal' service ipc$ >[2006/05/09 08:52:23, 3] lib/access.c:(291) > only_ipaddrs_in_list: list has non-ip address (.india.hp.com) >[2006/05/09 08:52:23, 3] lib/access.c:(316) > check_access: hostnames in host allow/deny list. >[2006/05/09 08:52:23, 2] lib/access.c:(322) > Allowed connection from nt218201.india.hp.com (15.76.218.201) >[2006/05/09 08:52:23, 5] lib/username.c:(290) > Finding user nobody >[2006/05/09 08:52:23, 5] lib/username.c:(234) > Trying _Get_Pwnam(), username as lowercase is nobody >[2006/05/09 08:52:23, 10] lib/util_pw.c:(98) > Got nobody from pwnam_cache >[2006/05/09 08:52:23, 5] lib/username.c:(266) > Get_Pwnam_internals did find user [nobody]! >[2006/05/09 08:52:23, 3] smbd/service.c:(488) > Connect path is '/tmp' for service [IPC$] >[2006/05/09 08:52:23, 4] rpc_server/srv_srvsvc_nt.c:(240) > get_share_security: using default secdesc for IPC$ >[2006/05/09 08:52:23, 10] lib/util_seaccess.c:(175) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2006/05/09 08:52:23, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x00000002, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-501. >[2006/05/09 08:52:23, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:52:23, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-501 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-514 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-32-546 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-132069 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 >[2006/05/09 08:52:23, 5] lib/util_seaccess.c:(308) > se_access_check: access (2) granted. >[2006/05/09 08:52:23, 3] smbd/vfs.c:(216) > Initialising default vfs hooks >[2006/05/09 08:52:23, 5] smbd/connection.c:(170) > claiming IPC$ 0 >[2006/05/09 08:52:23, 10] smbd/uid.c:(124) > is_share_read_only_for_user: share IPC$ is read-only for unix user nobody >[2006/05/09 08:52:23, 4] rpc_server/srv_srvsvc_nt.c:(240) > get_share_security: using default secdesc for IPC$ >[2006/05/09 08:52:23, 10] lib/util_seaccess.c:(175) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2006/05/09 08:52:23, 10] lib/util_seaccess.c:(231) > se_access_check: requested access 0x00000001, for NT token with 6 entries and first sid S-1-5-21-4112424572-1378032116-4237619202-501. >[2006/05/09 08:52:23, 3] lib/util_seaccess.c:(250) >[2006/05/09 08:52:23, 3] lib/util_seaccess.c:(251) > se_access_check: user sid is S-1-5-21-4112424572-1378032116-4237619202-501 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-514 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-32-546 > se_access_check: also S-1-5-21-4112424572-1378032116-4237619202-132069 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1 >[2006/05/09 08:52:23, 5] lib/util_seaccess.c:(308) > se_access_check: access (1) granted. >[2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287) > setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:23, 5] auth/auth_util.c:(437) > NT user token of user S-1-5-21-4112424572-1378032116-4237619202-501 > contains 6 SIDs > SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-501 > SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-514 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-32-546 > SID[ 5]: S-1-5-21-4112424572-1378032116-4237619202-132069 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:52:23, 5] auth/auth_util.c:(454) > UNIX token of user 65534 > Primary group is 65534 and contains 1 supplementary groups > Group[ 0]: 65534 >[2006/05/09 08:52:23, 5] smbd/uid.c:(308) > change_to_user uid=(0,65534) gid=(0,65534) >[2006/05/09 08:52:23, 3] smbd/service.c:(693) > nt218201 (15.76.218.201) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 404565) >[2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:23, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:23, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:23, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:23, 3] smbd/reply.c:(707) > tconX service=IPC$ >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=48 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=3 > smb_pid=65279 > smb_uid=103 > smb_mid=52481 > smt_wct=3 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 1 (0x1) > smb_bcc=7 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 49 50 43 00 00 00 00 IPC.... >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 72 of length 124 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52545 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 3] smbd/sec_ctx.c:(287) > setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:23, 5] auth/auth_util.c:(437) > NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 > contains 5 SIDs > SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 > SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:52:23, 5] auth/auth_util.c:(454) > UNIX token of user 205 > Primary group is 15 and contains 1 supplementary groups > Group[ 0]: 15 >[2006/05/09 08:52:23, 5] smbd/uid.c:(308) > change_to_user uid=(0,205) gid=(0,15) >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:23, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:23, 10] smbd/statcache.c:(215) > stat_cache_lookup: lookup failed for name [NEW TEXT DOCUMENT.TXT] >[2006/05/09 08:52:23, 5] smbd/statcache.c:(139) > stat_cache_add: Added entry (14011a280:size16) NEW TEXT DOCUMENT.TXT -> New Text Document.txt >[2006/05/09 08:52:23, 5] smbd/filename.c:(180) > conversion finished New Text Document.txt -> New Text Document.txt >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52545 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 73 of length 124 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52609 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:23, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:23, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52609 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 74 of length 124 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52673 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:23, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:23, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52673 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 75 of length 124 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52737 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:23, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:23, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52737 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 76 of length 124 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52801 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:23, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:23, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52801 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 77 of length 124 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52865 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:23, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:23, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52865 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:23, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:23, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:23, 3] smbd/process.c:(1194) > Transaction 78 of length 124 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52929 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:23, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:23, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:23, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:23, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:23, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:23, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:23, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:23, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:23, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:23, 5] lib/util.c:(454) >[2006/05/09 08:52:23, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52929 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:23, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:23, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:23, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:24, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:24, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:24, 3] smbd/process.c:(1194) > Transaction 79 of length 124 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52993 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:24, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:24, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:24, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:24, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=52993 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:24, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:24, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:24, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:24, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:24, 3] smbd/process.c:(1194) > Transaction 80 of length 124 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53057 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:24, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:24, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:24, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:24, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53057 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:24, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:24, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:24, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:24, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:24, 3] smbd/process.c:(1194) > Transaction 81 of length 124 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53121 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:24, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:24, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:24, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:24, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53121 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:24, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:24, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:24, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:24, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:24, 3] smbd/process.c:(1194) > Transaction 82 of length 124 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53185 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:24, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:24, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:24, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:24, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53185 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:24, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:24, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:24, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:24, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:24, 3] smbd/process.c:(1194) > Transaction 83 of length 124 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53249 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:24, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:24, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:24, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:24, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53249 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:24, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:24, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:24, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:24, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:24, 3] smbd/process.c:(1194) > Transaction 84 of length 124 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53313 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:24, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:24, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:24, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:24, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53313 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:24, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:24, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:24, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:24, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:24, 3] smbd/process.c:(1194) > Transaction 85 of length 124 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53377 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:24, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:24, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:24, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:24, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53377 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:24, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:24, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:24, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:24, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:24, 3] smbd/process.c:(1194) > Transaction 86 of length 124 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53441 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:24, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:24, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:24, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:24, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53441 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:24, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:24, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:24, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:24, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:24, 3] smbd/process.c:(1194) > Transaction 87 of length 124 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53505 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:24, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:24, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:24, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:24, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53505 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:24, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:24, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:24, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:24, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:24, 3] smbd/process.c:(1194) > Transaction 88 of length 124 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53569 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:24, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:24, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:24, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:24, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53569 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:24, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:24, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:24, 10] lib/util_sock.c:(618) > got smb length of 120 >[2006/05/09 08:52:24, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x78 >[2006/05/09 08:52:24, 3] smbd/process.c:(1194) > Transaction 89 of length 124 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=120 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53633 > smt_wct=15 > smb_vwv[ 0]= 52 (0x34) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 52 (0x34) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=55 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 4E 00 65 00 77 ........ .\.N.e.w > [010] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [020] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [030] 00 78 00 74 00 00 00 .x.t... >[2006/05/09 08:52:24, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:24, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2861) > call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004 >[2006/05/09 08:52:24, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:24, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:24, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = -1) level=1004 call=5 total_data=0 >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:24, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:24, 10] smbd/trans2.c:(3108) > call_trans2qfilepathinfo: SMB_FILE_BASIC_INFORMATION >[2006/05/09 08:52:24, 5] smbd/trans2.c:(3118) > SMB_QFBI - create: Tue May 9 08:49:16 2006 > access: Tue May 9 08:49:16 2006 > write: Tue May 9 08:49:16 2006 > change: Tue May 9 08:49:16 2006 > mode: 20 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010 >[2006/05/09 08:52:24, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40 >[2006/05/09 08:52:24, 5] lib/util.c:(454) >[2006/05/09 08:52:24, 5] lib/util.c:(457) > size=100 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53633 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=45 >[2006/05/09 08:52:24, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [010] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [020] 5A 17 73 C6 01 20 00 00 00 00 00 00 00 Z.s.. .. ..... >[2006/05/09 08:52:24, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:24, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:25, 10] lib/util_sock.c:(618) > got smb length of 126 >[2006/05/09 08:52:25, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x7e >[2006/05/09 08:52:25, 3] smbd/process.c:(1194) > Transaction 90 of length 130 >[2006/05/09 08:52:25, 5] lib/util.c:(454) >[2006/05/09 08:52:25, 5] lib/util.c:(457) > size=126 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53697 > smt_wct=15 > smb_vwv[ 0]= 58 (0x3A) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 10 (0xA) > smb_vwv[ 3]=16384 (0x4000) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 58 (0x3A) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 1 (0x1) > smb_bcc=61 >[2006/05/09 08:52:25, 10] lib/util.c:(2058) > [000] 00 00 00 16 00 56 05 07 00 04 01 00 00 00 00 5C .....V.. .......\ > [010] 00 4E 00 65 00 77 00 20 00 54 00 65 00 78 00 74 .N.e.w. .T.e.x.t > [020] 00 20 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E . .D.o.c .u.m.e.n > [030] 00 74 00 2E 00 74 00 78 00 74 00 00 00 .t...t.x .t... >[2006/05/09 08:52:25, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:25, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:25, 3] smbd/trans2.c:(1629) > call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=1, close_if_end = 2 requires_resume_key = 4 level = 0x104, max_data_bytes = 16384 >[2006/05/09 08:52:25, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:25, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:25, 5] smbd/trans2.c:(1688) > dir=./, mask = New Text Document.txt >[2006/05/09 08:52:25, 5] smbd/dir.c:(391) > dptr_create dir=./ >[2006/05/09 08:52:25, 3] smbd/dir.c:(510) > creating new dirptr 256 for path ./, expect_close = 1 >[2006/05/09 08:52:25, 4] smbd/trans2.c:(1745) > dptr_num is 256, wcard = New Text Document.txt, attr = 22 >[2006/05/09 08:52:25, 8] smbd/trans2.c:(1750) > dirpath=<./> dontdescend=<> >[2006/05/09 08:52:25, 8] smbd/trans2.c:(1078) > get_lanman2_dir_entry:readdir on dirptr 0x1400ed200 now at offset -1 >[2006/05/09 08:52:25, 8] smbd/dosmode.c:(300) > dos_mode: ./New Text Document.txt >[2006/05/09 08:52:25, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:25, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:25, 5] smbd/trans2.c:(1169) > get_lanman2_dir_entry found ./New Text Document.txt fname=New Text Document.txt >[2006/05/09 08:52:25, 10] smbd/trans2.c:(1310) > get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO >[2006/05/09 08:52:25, 10] smbd/mangle_hash2.c:(616) > name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1) >[2006/05/09 08:52:25, 5] smbd/trans2.c:(1798) > call_trans2findfirst - (2) closing dptr_num 256 >[2006/05/09 08:52:25, 4] smbd/dir.c:(238) > closing dptr key 256 >[2006/05/09 08:52:25, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 10, data_sent_thistime = 136, useable_space = 131010 >[2006/05/09 08:52:25, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 10, data_to_send = 136, paramsize = 10, datasize = 136 >[2006/05/09 08:52:25, 5] lib/util.c:(454) >[2006/05/09 08:52:25, 5] lib/util.c:(457) > size=204 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53697 > smt_wct=10 > smb_vwv[ 0]= 10 (0xA) > smb_vwv[ 1]= 136 (0x88) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 10 (0xA) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 136 (0x88) > smb_vwv[ 7]= 68 (0x44) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=149 >[2006/05/09 08:52:25, 10] lib/util.c:(2058) > [000] 00 FD FF 01 00 01 00 00 00 00 00 00 00 88 00 00 ........ ........ > [010] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [020] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [030] 5A 17 73 C6 01 00 00 00 00 00 00 00 00 00 00 00 Z.s..... ........ > [040] 00 00 00 00 00 20 00 00 00 2A 00 00 00 00 00 00 ..... .. .*...... > [050] 00 18 00 4E 00 35 00 32 00 48 00 5A 00 32 00 7E ...N.5.2 .H.Z.2.~ > [060] 00 54 00 2E 00 54 00 58 00 54 00 4E 00 65 00 77 .T...T.X .T.N.e.w > [070] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [080] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [090] 00 78 00 74 00 .x.t. >[2006/05/09 08:52:25, 4] smbd/trans2.c:(1832) > SMBtrans2 mask=New Text Document.txt directory=./ dirtype=22 numentries=1 >[2006/05/09 08:52:25, 10] smbd/mangle_hash2.c:(616) > name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1) >[2006/05/09 08:52:25, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:25, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:25, 10] lib/util_sock.c:(618) > got smb length of 126 >[2006/05/09 08:52:25, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x7e >[2006/05/09 08:52:25, 3] smbd/process.c:(1194) > Transaction 91 of length 130 >[2006/05/09 08:52:25, 5] lib/util.c:(454) >[2006/05/09 08:52:25, 5] lib/util.c:(457) > size=126 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53761 > smt_wct=15 > smb_vwv[ 0]= 58 (0x3A) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 10 (0xA) > smb_vwv[ 3]=16384 (0x4000) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 58 (0x3A) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 1 (0x1) > smb_bcc=61 >[2006/05/09 08:52:25, 10] lib/util.c:(2058) > [000] 00 00 00 16 00 56 05 07 00 04 01 00 00 00 00 5C .....V.. .......\ > [010] 00 4E 00 65 00 77 00 20 00 54 00 65 00 78 00 74 .N.e.w. .T.e.x.t > [020] 00 20 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E . .D.o.c .u.m.e.n > [030] 00 74 00 2E 00 74 00 78 00 74 00 00 00 .t...t.x .t... >[2006/05/09 08:52:25, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:25, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:25, 3] smbd/trans2.c:(1629) > call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=1, close_if_end = 2 requires_resume_key = 4 level = 0x104, max_data_bytes = 16384 >[2006/05/09 08:52:25, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:25, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:25, 5] smbd/trans2.c:(1688) > dir=./, mask = New Text Document.txt >[2006/05/09 08:52:25, 5] smbd/dir.c:(391) > dptr_create dir=./ >[2006/05/09 08:52:25, 3] smbd/dir.c:(510) > creating new dirptr 256 for path ./, expect_close = 1 >[2006/05/09 08:52:25, 4] smbd/trans2.c:(1745) > dptr_num is 256, wcard = New Text Document.txt, attr = 22 >[2006/05/09 08:52:25, 8] smbd/trans2.c:(1750) > dirpath=<./> dontdescend=<> >[2006/05/09 08:52:25, 8] smbd/trans2.c:(1078) > get_lanman2_dir_entry:readdir on dirptr 0x14010d420 now at offset -1 >[2006/05/09 08:52:25, 8] smbd/dosmode.c:(300) > dos_mode: ./New Text Document.txt >[2006/05/09 08:52:25, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:25, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:25, 5] smbd/trans2.c:(1169) > get_lanman2_dir_entry found ./New Text Document.txt fname=New Text Document.txt >[2006/05/09 08:52:25, 10] smbd/trans2.c:(1310) > get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO >[2006/05/09 08:52:25, 10] smbd/mangle_hash2.c:(616) > name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1) >[2006/05/09 08:52:25, 5] smbd/trans2.c:(1798) > call_trans2findfirst - (2) closing dptr_num 256 >[2006/05/09 08:52:25, 4] smbd/dir.c:(238) > closing dptr key 256 >[2006/05/09 08:52:25, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 10, data_sent_thistime = 136, useable_space = 131010 >[2006/05/09 08:52:25, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 10, data_to_send = 136, paramsize = 10, datasize = 136 >[2006/05/09 08:52:25, 5] lib/util.c:(454) >[2006/05/09 08:52:25, 5] lib/util.c:(457) > size=204 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53761 > smt_wct=10 > smb_vwv[ 0]= 10 (0xA) > smb_vwv[ 1]= 136 (0x88) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 10 (0xA) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 136 (0x88) > smb_vwv[ 7]= 68 (0x44) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=149 >[2006/05/09 08:52:25, 10] lib/util.c:(2058) > [000] 00 FD FF 01 00 01 00 00 00 00 00 00 00 88 00 00 ........ ........ > [010] 00 00 00 00 00 00 12 1E 5A 17 73 C6 01 00 12 1E ........ Z.s..... > [020] 5A 17 73 C6 01 00 12 1E 5A 17 73 C6 01 00 12 1E Z.s..... Z.s..... > [030] 5A 17 73 C6 01 00 00 00 00 00 00 00 00 00 00 00 Z.s..... ........ > [040] 00 00 00 00 00 20 00 00 00 2A 00 00 00 00 00 00 ..... .. .*...... > [050] 00 18 00 4E 00 35 00 32 00 48 00 5A 00 32 00 7E ...N.5.2 .H.Z.2.~ > [060] 00 54 00 2E 00 54 00 58 00 54 00 4E 00 65 00 77 .T...T.X .T.N.e.w > [070] 00 20 00 54 00 65 00 78 00 74 00 20 00 44 00 6F . .T.e.x .t. .D.o > [080] 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 74 .c.u.m.e .n.t...t > [090] 00 78 00 74 00 .x.t. >[2006/05/09 08:52:25, 4] smbd/trans2.c:(1832) > SMBtrans2 mask=New Text Document.txt directory=./ dirtype=22 numentries=1 >[2006/05/09 08:52:25, 10] smbd/mangle_hash2.c:(616) > name_map: New Text Document.txt -> 124541D5 -> N52HZ2~T.TXT (cache=1) >[2006/05/09 08:52:25, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:25, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:26, 10] lib/util_sock.c:(618) > got smb length of 130 >[2006/05/09 08:52:26, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x82 >[2006/05/09 08:52:26, 3] smbd/process.c:(1194) > Transaction 92 of length 134 >[2006/05/09 08:52:26, 5] lib/util.c:(454) >[2006/05/09 08:52:26, 5] lib/util.c:(457) > size=130 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53825 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=11264 (0x2C00) > smb_vwv[ 3]= 4096 (0x1000) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=32768 (0x8000) > smb_vwv[ 8]= 256 (0x100) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 1792 (0x700) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]= 8192 (0x2000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_bcc=47 >[2006/05/09 08:52:26, 10] lib/util.c:(2058) > [000] 00 5C 00 4E 00 65 00 77 00 20 00 54 00 65 00 78 .\.N.e.w . .T.e.x > [010] 00 74 00 20 00 44 00 6F 00 63 00 75 00 6D 00 65 .t. .D.o .c.u.m.e > [020] 00 6E 00 74 00 2E 00 74 00 78 00 74 00 00 00 .n.t...t .x.t... >[2006/05/09 08:52:26, 3] smbd/process.c:(993) > switch message SMBntcreateX (pid 404565) conn 0x140168050 >[2006/05/09 08:52:26, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:26, 10] smbd/nttrans.c:(497) > reply_ntcreateX: flags = 0x10, access_mask = 0x10080 file_attributes = 0x0, share_access = 0x7, create_disposition = 0x1 create_options = 0x200040 root_dir_fid = 0x0 >[2006/05/09 08:52:26, 5] smbd/filename.c:(108) > unix_convert called on file "New Text Document.txt" >[2006/05/09 08:52:26, 10] smbd/statcache.c:(248) > stat_cache_lookup: lookup succeeded for name [NEW TEXT DOCUMENT.TXT] -> [New Text Document.txt] >[2006/05/09 08:52:26, 10] smbd/reply.c:(1862) > can_delete: New Text Document.txt, dirtype = 0 >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:26, 3] smbd/dosmode.c:(121) > unix_mode(New Text Document.txt) returning 0740 >[2006/05/09 08:52:26, 10] smbd/open.c:(1085) > open_file_ntcreate: fname=New Text Document.txt, dos_attrs=0x0 access_mask=0x10080 share_access=0x7 create_disposition = 0x1 create_options=0x200040 unix mode=0740 oplock_request=0 >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:26, 10] smbd/open.c:(1258) > open_file_ntcreate: fname=New Text Document.txt, after mapping access_mask=0x10080 >[2006/05/09 08:52:26, 5] smbd/files.c:(127) > allocated file structure 468, fnum = 4564 (2 used) >[2006/05/09 08:52:26, 4] smbd/open.c:(1488) > calling open_file with flags=0x0 flags2=0x0 mode=0740 >[2006/05/09 08:52:26, 2] smbd/open.c:(347) > pavan opened file New Text Document.txt read=No write=No (numopen=2) >[2006/05/09 08:52:26, 10] locking/locking.c:(538) > unparse_share_modes: del: 0, num: 1 >[2006/05/09 08:52:26, 10] locking/locking.c:(416) > print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259 >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:26, 5] smbd/nttrans.c:(910) > reply_ntcreate_and_X: fnum = 4564, open name = New Text Document.txt >[2006/05/09 08:52:26, 5] lib/util.c:(454) >[2006/05/09 08:52:26, 5] lib/util.c:(457) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53825 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=54272 (0xD400) > smb_vwv[ 3]= 273 (0x111) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 7698 (0x1E12) > smb_vwv[ 7]= 5978 (0x175A) > smb_vwv[ 8]=50803 (0xC673) > smb_vwv[ 9]= 1 (0x1) > smb_vwv[10]= 7698 (0x1E12) > smb_vwv[11]= 5978 (0x175A) > smb_vwv[12]=50803 (0xC673) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 7698 (0x1E12) > smb_vwv[15]= 5978 (0x175A) > smb_vwv[16]=50803 (0xC673) > smb_vwv[17]= 1 (0x1) > smb_vwv[18]= 7698 (0x1E12) > smb_vwv[19]= 5978 (0x175A) > smb_vwv[20]=50803 (0xC673) > smb_vwv[21]= 8193 (0x2001) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 0 (0x0) > smb_vwv[32]= 1792 (0x700) > smb_vwv[33]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:26, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:26, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:26, 10] lib/util_sock.c:(618) > got smb length of 72 >[2006/05/09 08:52:26, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x48 >[2006/05/09 08:52:26, 3] smbd/process.c:(1194) > Transaction 93 of length 76 >[2006/05/09 08:52:26, 5] lib/util.c:(454) >[2006/05/09 08:52:26, 5] lib/util.c:(457) > size=72 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53889 > smt_wct=15 > smb_vwv[ 0]= 4 (0x4) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 8 (0x8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 4 (0x4) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 7 (0x7) > smb_bcc=7 >[2006/05/09 08:52:26, 10] lib/util.c:(2058) > [000] 00 00 00 D4 11 EE 03 ....... >[2006/05/09 08:52:26, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:26, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:26, 3] smbd/trans2.c:(2799) > call_trans2qfilepathinfo: TRANSACT2_QFILEINFO: level = 1006 >[2006/05/09 08:52:26, 10] locking/locking.c:(440) > parse_share_modes: delete_on_close: 0, num_share_modes: 1 >[2006/05/09 08:52:26, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259 >[2006/05/09 08:52:26, 3] smbd/trans2.c:(2912) > call_trans2qfilepathinfo New Text Document.txt (fnum = 4564) level=1006 call=7 total_data=0 >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:26, 10] smbd/trans2.c:(3228) > call_trans2qfilepathinfo: SMB_FILE_INTERNAL_INFORMATION >[2006/05/09 08:52:26, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 8, useable_space = 131010 >[2006/05/09 08:52:26, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 8, paramsize = 2, datasize = 8 >[2006/05/09 08:52:26, 5] lib/util.c:(454) >[2006/05/09 08:52:26, 5] lib/util.c:(457) > size=68 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53889 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 8 (0x8) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 8 (0x8) > smb_vwv[ 7]= 60 (0x3C) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=13 >[2006/05/09 08:52:26, 10] lib/util.c:(2058) > [000] 00 00 00 00 00 83 BC 00 00 8D 80 FE B9 ........ ..... >[2006/05/09 08:52:26, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:26, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:26, 10] lib/util_sock.c:(618) > got smb length of 77 >[2006/05/09 08:52:26, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x4d >[2006/05/09 08:52:26, 3] smbd/process.c:(1194) > Transaction 94 of length 81 >[2006/05/09 08:52:26, 5] lib/util.c:(454) >[2006/05/09 08:52:26, 5] lib/util.c:(457) > size=77 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53953 > smt_wct=15 > smb_vwv[ 0]= 6 (0x6) > smb_vwv[ 1]= 1 (0x1) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 6 (0x6) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 1 (0x1) > smb_vwv[12]= 76 (0x4C) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 8 (0x8) > smb_bcc=12 >[2006/05/09 08:52:26, 10] lib/util.c:(2058) > [000] 00 00 00 D4 11 F5 03 00 00 00 00 01 ........ .... >[2006/05/09 08:52:26, 3] smbd/process.c:(993) > switch message SMBtrans2 (pid 404565) conn 0x140168050 >[2006/05/09 08:52:26, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:26, 3] smbd/trans2.c:(3701) > call_trans2setfilepathinfo(8) New Text Document.txt (fnum 4564) info_level=1013 totdata=1 >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(300) > dos_mode: New Text Document.txt >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(167) > dos_mode_from_sbuf returning a >[2006/05/09 08:52:26, 8] smbd/dosmode.c:(334) > dos_mode returning a >[2006/05/09 08:52:26, 10] locking/locking.c:(971) > set_delete_on_close: Adding delete on close flag for fnum = 4564, file New Text Document.txt >[2006/05/09 08:52:26, 10] locking/locking.c:(440) > parse_share_modes: delete_on_close: 0, num_share_modes: 1 >[2006/05/09 08:52:26, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259 >[2006/05/09 08:52:26, 10] locking/locking.c:(538) > unparse_share_modes: del: 1, num: 1 >[2006/05/09 08:52:26, 10] locking/locking.c:(416) > print_share_mode_table: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259 >[2006/05/09 08:52:26, 9] smbd/trans2.c:(684) > t2_rep: params_sent_thistime = 2, data_sent_thistime = 0, useable_space = 131012 >[2006/05/09 08:52:26, 9] smbd/trans2.c:(686) > t2_rep: params_to_send = 2, data_to_send = 0, paramsize = 2, datasize = 0 >[2006/05/09 08:52:26, 5] lib/util.c:(454) >[2006/05/09 08:52:26, 5] lib/util.c:(457) > size=58 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51265 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=53953 > smt_wct=10 > smb_vwv[ 0]= 2 (0x2) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 2 (0x2) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=3 >[2006/05/09 08:52:26, 10] lib/util.c:(2058) > [000] 00 00 00 ... >[2006/05/09 08:52:26, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:26, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:26, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:26, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:26, 3] smbd/process.c:(1194) > Transaction 95 of length 45 >[2006/05/09 08:52:26, 5] lib/util.c:(454) >[2006/05/09 08:52:26, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=54017 > smt_wct=3 > smb_vwv[ 0]= 4564 (0x11D4) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:26, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x140168050 >[2006/05/09 08:52:26, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:26, 3] smbd/reply.c:(3269) > close fd=-1 fnum=4564 (numopen=2) >[2006/05/09 08:52:26, 10] locking/locking.c:(440) > parse_share_modes: delete_on_close: 1, num_share_modes: 1 >[2006/05/09 08:52:26, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x200040, access_mask = 0x10080, mid = 0x0, type= 0x10, file_id = 6, dev = 0xb9fe808d, inode = 48259 >[2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(255) > push_sec_ctx(205, 15) : sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:26, 3] smbd/uid.c:(392) > push_conn_ctx(101) : conn_ctx_stack_ndx = 0 >[2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/05/09 08:52:26, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:26, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(385) > pop_sec_ctx (205, 15) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:26, 5] smbd/close.c:(238) > close_file: file New Text Document.txt. Delete on close was set - deleting file. >[2006/05/09 08:52:26, 4] smbd/uid.c:(222) > change_to_user: Skipping user change - already user >[2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:26, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:26, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:26, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:26, 10] smbd/notify.c:(163) > process_pending_change_notify_queue: dir . changed ! >[2006/05/09 08:52:26, 3] smbd/error.c:(142) > error packet at smbd/notify.c(55) cmd=160 (SMBnttrans) NT code 0x0000010c >[2006/05/09 08:52:26, 5] lib/util.c:(454) >[2006/05/09 08:52:26, 5] lib/util.c:(457) > size=71 > smb_com=0xa0 > smb_rcls=12 > smb_reh=1 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=51904 > smt_wct=18 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:26, 10] locking/posix.c:(1249) > posix_locking_close_file: file New Text Document.txt has no outstanding locks. >[2006/05/09 08:52:26, 2] smbd/close.c:(305) > pavan closed file New Text Document.txt (numopen=1) >[2006/05/09 08:52:26, 5] smbd/files.c:(449) > freed files structure 4564 (1 used) >[2006/05/09 08:52:26, 5] lib/util.c:(454) >[2006/05/09 08:52:26, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=54017 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:26, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:26, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:26, 10] lib/util_sock.c:(618) > got smb length of 84 >[2006/05/09 08:52:26, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x54 >[2006/05/09 08:52:26, 3] smbd/process.c:(1194) > Transaction 96 of length 88 >[2006/05/09 08:52:26, 5] lib/util.c:(454) >[2006/05/09 08:52:26, 5] lib/util.c:(457) > size=84 > smb_com=0xa0 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=54080 > smt_wct=23 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 8192 (0x2000) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]=21504 (0x5400) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 1024 (0x400) > smb_vwv[18]= 4 (0x4) > smb_vwv[19]= 3 (0x3) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]= 4559 (0x11CF) > smb_vwv[22]= 1 (0x1) > smb_bcc=3 >[2006/05/09 08:52:26, 10] lib/util.c:(2058) > [000] 00 00 00 ... >[2006/05/09 08:52:26, 3] smbd/process.c:(993) > switch message SMBnttrans (pid 404565) conn 0x140168050 >[2006/05/09 08:52:26, 3] smbd/sec_ctx.c:(287) > setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:26, 5] auth/auth_util.c:(437) > NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 > contains 5 SIDs > SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 > SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:52:26, 5] auth/auth_util.c:(454) > UNIX token of user 205 > Primary group is 15 and contains 1 supplementary groups > Group[ 0]: 15 >[2006/05/09 08:52:26, 5] smbd/uid.c:(308) > change_to_user uid=(0,205) gid=(0,15) >[2006/05/09 08:52:26, 10] smbd/nttrans.c:(2806) > reply_nttrans: setup_count = 8 >[2006/05/09 08:52:26, 10] lib/util.c:(2058) > [000] 03 00 00 00 CF 11 01 00 ........ >[2006/05/09 08:52:26, 3] smbd/nttrans.c:(1853) > call_nt_transact_notify_change >[2006/05/09 08:52:26, 3] smbd/nttrans.c:(1867) > call_nt_transact_notify_change: notify change called on directory name = . >[2006/05/09 08:52:26, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:26, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:33, 10] lib/util_sock.c:(618) > got smb length of 39 >[2006/05/09 08:52:33, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x27 >[2006/05/09 08:52:33, 3] smbd/process.c:(1194) > Transaction 97 of length 43 >[2006/05/09 08:52:33, 5] lib/util.c:(454) >[2006/05/09 08:52:33, 5] lib/util.c:(457) > size=39 > smb_com=0x74 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=103 > smb_mid=54145 > smt_wct=2 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:33, 3] smbd/process.c:(993) > switch message SMBulogoffX (pid 404565) conn 0x0 >[2006/05/09 08:52:33, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:33, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:33, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:33, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:33, 5] auth/auth_util.c:(1511) > attempting to free (and zero) a server_info structure >[2006/05/09 08:52:33, 3] smbd/reply.c:(1606) > ulogoffX vuid=103 >[2006/05/09 08:52:33, 5] lib/util.c:(454) >[2006/05/09 08:52:33, 5] lib/util.c:(457) > size=39 > smb_com=0x74 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=65279 > smb_uid=103 > smb_mid=54145 > smt_wct=2 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:33, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:33, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:33, 10] lib/util_sock.c:(618) > got smb length of 35 >[2006/05/09 08:52:33, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x23 >[2006/05/09 08:52:33, 3] smbd/process.c:(1194) > Transaction 98 of length 39 >[2006/05/09 08:52:33, 5] lib/util.c:(454) >[2006/05/09 08:52:33, 5] lib/util.c:(457) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=3 > smb_pid=65279 > smb_uid=103 > smb_mid=54209 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:33, 3] smbd/process.c:(993) > switch message SMBtdis (pid 404565) conn 0x14016e050 >[2006/05/09 08:52:33, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:33, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:33, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:33, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:33, 4] smbd/vfs.c:(738) > vfs_ChDir to /tmp >[2006/05/09 08:52:33, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:33, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:33, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:33, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:33, 3] smbd/service.c:(882) > nt218201 (15.76.218.201) closed connection to service IPC$ >[2006/05/09 08:52:33, 3] smbd/connection.c:(69) > Yielding connection to IPC$ >[2006/05/09 08:52:33, 4] smbd/vfs.c:(738) > vfs_ChDir to / >[2006/05/09 08:52:33, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:33, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:33, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:33, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:33, 5] lib/util.c:(454) >[2006/05/09 08:52:33, 5] lib/util.c:(457) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=3 > smb_pid=65279 > smb_uid=103 > smb_mid=54209 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:33, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:33, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:37, 10] lib/util_sock.c:(618) > got smb length of 36 >[2006/05/09 08:52:37, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x24 >[2006/05/09 08:52:37, 3] smbd/process.c:(1194) > Transaction 99 of length 40 >[2006/05/09 08:52:37, 5] lib/util.c:(454) >[2006/05/09 08:52:37, 5] lib/util.c:(457) > size=36 > smb_com=0xa4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=54080 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:37, 3] smbd/process.c:(993) > switch message SMBntcancel (pid 404565) conn 0x140168050 >[2006/05/09 08:52:37, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:37, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:37, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:37, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:37, 3] smbd/error.c:(142) > error packet at smbd/notify.c(55) cmd=160 (SMBnttrans) NT_STATUS_CANCELLED >[2006/05/09 08:52:37, 5] lib/util.c:(454) >[2006/05/09 08:52:37, 5] lib/util.c:(457) > size=71 > smb_com=0xa0 > smb_rcls=32 > smb_reh=1 > smb_err=49152 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=2236 > smb_uid=101 > smb_mid=54080 > smt_wct=18 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_bcc=0 >[2006/05/09 08:52:37, 3] smbd/nttrans.c:(1564) > reply_ntcancel: cancel called on mid = 54080. >[2006/05/09 08:52:37, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:37, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:37, 10] lib/util_sock.c:(618) > got smb length of 41 >[2006/05/09 08:52:37, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x29 >[2006/05/09 08:52:37, 3] smbd/process.c:(1194) > Transaction 100 of length 45 >[2006/05/09 08:52:37, 5] lib/util.c:(454) >[2006/05/09 08:52:37, 5] lib/util.c:(457) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=54272 > smt_wct=3 > smb_vwv[ 0]= 4559 (0x11CF) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/05/09 08:52:37, 3] smbd/process.c:(993) > switch message SMBclose (pid 404565) conn 0x140168050 >[2006/05/09 08:52:37, 3] smbd/sec_ctx.c:(287) > setting sec ctx (205, 15) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:37, 5] auth/auth_util.c:(437) > NT user token of user S-1-5-21-4112424572-1378032116-4237619202-1410 > contains 5 SIDs > SID[ 0]: S-1-5-21-4112424572-1378032116-4237619202-1410 > SID[ 1]: S-1-5-21-4112424572-1378032116-4237619202-1031 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/05/09 08:52:37, 5] auth/auth_util.c:(454) > UNIX token of user 205 > Primary group is 15 and contains 1 supplementary groups > Group[ 0]: 15 >[2006/05/09 08:52:37, 5] smbd/uid.c:(308) > change_to_user uid=(0,205) gid=(0,15) >[2006/05/09 08:52:37, 4] smbd/vfs.c:(738) > vfs_ChDir to /usr/users/pavan >[2006/05/09 08:52:37, 3] smbd/reply.c:(3257) > close directory fnum=4559 >[2006/05/09 08:52:37, 10] locking/locking.c:(440) > parse_share_modes: delete_on_close: 0, num_share_modes: 2 >[2006/05/09 08:52:37, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[0]: pid = 404565, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 1, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:37, 10] locking/locking.c:(487) > parse_share_modes: share_mode_entry[1]: UNUSED pid = 404565, share_access = 0x3, private_options = 0x200000, access_mask = 0x100080, mid = 0x0, type= 0x40, file_id = 5, dev = 0xb9fe808d, inode = 48169 >[2006/05/09 08:52:37, 5] smbd/files.c:(449) > freed files structure 4559 (0 used) >[2006/05/09 08:52:37, 5] lib/util.c:(454) >[2006/05/09 08:52:37, 5] lib/util.c:(457) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=54272 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:37, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:37, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:52:49, 10] lib/util_sock.c:(618) > got smb length of 35 >[2006/05/09 08:52:49, 6] smbd/process.c:(1193) > got message type 0x0 of len 0x23 >[2006/05/09 08:52:49, 3] smbd/process.c:(1194) > Transaction 101 of length 39 >[2006/05/09 08:52:49, 5] lib/util.c:(454) >[2006/05/09 08:52:49, 5] lib/util.c:(457) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=54336 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:49, 3] smbd/process.c:(993) > switch message SMBtdis (pid 404565) conn 0x140168050 >[2006/05/09 08:52:49, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:49, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:49, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:49, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:49, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:49, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:49, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:49, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:49, 1] smbd/service.c:(882) > nt218201 (15.76.218.201) closed connection to service pavan >[2006/05/09 08:52:49, 3] smbd/connection.c:(69) > Yielding connection to pavan >[2006/05/09 08:52:49, 4] smbd/vfs.c:(738) > vfs_ChDir to / >[2006/05/09 08:52:49, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:52:49, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:52:49, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:52:49, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:52:49, 5] lib/util.c:(454) >[2006/05/09 08:52:49, 5] lib/util.c:(457) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=54336 > smt_wct=0 > smb_bcc=0 >[2006/05/09 08:52:49, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:52:49, 10] smbd/process.c:(299) > run_events: No events >[2006/05/09 08:53:49, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:53:49, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:53:49, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:53:49, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:53:49, 10] smbd/process.c:(1372) > change_notify_timeout: 60 >[2006/05/09 08:54:49, 3] smbd/sec_ctx.c:(287) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/05/09 08:54:49, 5] auth/auth_util.c:(433) > NT user token: (NULL) >[2006/05/09 08:54:49, 5] auth/auth_util.c:(454) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/05/09 08:54:49, 5] smbd/uid.c:(323) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/05/09 08:54:49, 3] smbd/process.c:(1428) > Printcap cache time expired. >[2006/05/09 08:54:49, 3] printing/pcap.c:(117) > reloading printcap cache >[2006/05/09 08:54:49, 3] printing/pcap.c:(223) > reload status: ok >[2006/05/09 08:54:49, 3] printing/pcap.c:(117) > reloading printcap cache >[2006/05/09 08:54:49, 3] printing/pcap.c:(223) > reload status: ok >[2006/05/09 08:54:49, 10] smbd/process.c:(1372) > change_notify_timeout: 60
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 3767
: 1895