[2008/11/12 17:20:02, 3] lib/debug.c:debug_message(509) INFO: Remote set of debug to `10' (pid 13977 from pid 13997) [2008/11/12 17:20:02, 5] lib/debug.c:debug_dump_status(407) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2008/11/12 17:20:02, 3] lib/debug.c:debug_message(509) INFO: Remote set of debug to `10' (pid 13980 from pid 13997) [2008/11/12 17:20:02, 5] lib/debug.c:debug_dump_status(407) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2008/11/12 17:20:02, 3] lib/debug.c:debug_message(509) INFO: Remote set of debug to `10' (pid 13995 from pid 13997) [2008/11/12 17:20:02, 5] lib/debug.c:debug_dump_status(407) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2008/11/12 17:20:02, 10] smbd/process.c:async_processing(649) async_processing: Doing async processing. [2008/11/12 17:20:05, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 104 [2008/11/12 17:20:05, 6] smbd/process.c:process_smb(1546) got message type 0x0 of len 0x68 [2008/11/12 17:20:05, 3] smbd/process.c:process_smb(1549) Transaction 34 of length 108 (0 toread) [2008/11/12 17:20:05, 5] lib/util.c:show_msg(642) [2008/11/12 17:20:05, 5] lib/util.c:show_msg(652) size=104 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=4276 smb_uid=100 smb_mid=1152 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 4608 (0x1200) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=21 [2008/11/12 17:20:05, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 45 00 56 00 45 00 4E 00 54 00 4C 00 4F .\.E.V.E .N.T.L.O [010] 00 47 00 00 00 .G... [2008/11/12 17:20:05, 3] smbd/process.c:switch_message(1361) switch message SMBntcreateX (pid 13995) conn 0x80594f08 [2008/11/12 17:20:05, 4] smbd/uid.c:change_to_user(182) change_to_user: Skipping user change - already user [2008/11/12 17:20:05, 10] smbd/nttrans.c:reply_ntcreate_and_X(488) reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0, fname = EVENTLOG [2008/11/12 17:20:05, 4] smbd/nttrans.c:nt_open_pipe(295) nt_open_pipe: Opening pipe \EVENTLOG. [2008/11/12 17:20:05, 3] smbd/nttrans.c:nt_open_pipe(320) nt_open_pipe: Known pipe EVENTLOG opening. [2008/11/12 17:20:05, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(165) Open pipe requested EVENTLOG (pipes_open=1) [2008/11/12 17:20:05, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(195) open_rpc_pipe_p: name svcctl pnum=7738 [2008/11/12 17:20:05, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(275) Create pipe requested EVENTLOG [2008/11/12 17:20:05, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) init_pipe_handles: created handle list for pipe EVENTLOG [2008/11/12 17:20:05, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) init_pipe_handles: pipe_handles ref count = 1 for pipe EVENTLOG [2008/11/12 17:20:05, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(356) Created internal pipe EVENTLOG (pipes_open=1) [2008/11/12 17:20:05, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(253) Opened pipe EVENTLOG with handle 7739 (pipes_open=2) [2008/11/12 17:20:05, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(259) open pipes: name EVENTLOG pnum=7739 [2008/11/12 17:20:05, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(259) open pipes: name svcctl pnum=7738 [2008/11/12 17:20:05, 10] lib/dbwrap_tdb.c:db_tdb_fetch_locked(100) Locking key 4556454E544C4F472F31 [2008/11/12 17:20:05, 10] lib/dbwrap_tdb.c:db_tdb_fetch_locked(129) Allocated locked data 0x0x80608a60 [2008/11/12 17:20:05, 10] lib/dbwrap_tdb.c:db_tdb_record_destr(42) Unlocking key 4556454E544C4F472F31 [2008/11/12 17:20:05, 5] smbd/nttrans.c:do_ntcreate_pipe_open(408) do_ntcreate_pipe_open: open pipe = \EVENTLOG [2008/11/12 17:20:05, 5] lib/util.c:show_msg(642) [2008/11/12 17:20:05, 5] lib/util.c:show_msg(652) size=135 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=4276 smb_uid=100 smb_mid=1152 smt_wct=42 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=14592 (0x3900) smb_vwv[ 3]= 375 (0x177) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_vwv[34]= 0 (0x0) smb_vwv[35]= 0 (0x0) smb_vwv[36]= 0 (0x0) smb_vwv[37]= 0 (0x0) smb_vwv[38]= 0 (0x0) smb_vwv[39]= 0 (0x0) smb_vwv[40]= 0 (0x0) smb_vwv[41]= 0 (0x0) smb_bcc=0 [2008/11/12 17:20:05, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 136 [2008/11/12 17:20:05, 6] smbd/process.c:process_smb(1546) got message type 0x0 of len 0x88 [2008/11/12 17:20:05, 3] smbd/process.c:process_smb(1549) Transaction 35 of length 140 (0 toread) [2008/11/12 17:20:05, 5] lib/util.c:show_msg(642) [2008/11/12 17:20:05, 5] lib/util.c:show_msg(652) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=1216 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30521 (0x7739) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2008/11/12 17:20:05, 10] lib/util.c:dump_data(2223) [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 î....... .H...... [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 .¸.¸.... ........ [020] 00 DC 3F 27 82 2A E3 C3 18 3F 78 82 79 29 DC 23 .Ü?'.*ãà .?x.y)Ü# [030] EA 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ê.....]. .ë.É..è. [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2008/11/12 17:20:05, 3] smbd/process.c:switch_message(1361) switch message SMBwriteX (pid 13995) conn 0x80594f08 [2008/11/12 17:20:05, 4] smbd/uid.c:change_to_user(182) change_to_user: Skipping user change - already user [2008/11/12 17:20:05, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1258) search for pipe pnum=7739 [2008/11/12 17:20:05, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1262) pipe name EVENTLOG pnum=7739 (pipes_open=2) [2008/11/12 17:20:05, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1262) pipe name svcctl pnum=7738 (pipes_open=2) [2008/11/12 17:20:05, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(927) write_to_pipe: 7739 name: EVENTLOG open: Yes len: 72 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(949) write_to_pipe: data_left = 72 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(842) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(385) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(953) write_to_pipe: data_used = 16 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(949) write_to_pipe: data_left = 56 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(842) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0b [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0048 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000001 [2008/11/12 17:20:05, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(472) unmarshall_rpc_header: using little-endian RPC [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(501) unmarshall_rpc_header: type = 11, flags = 3 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(953) write_to_pipe: data_used = 0 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(949) write_to_pipe: data_left = 56 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(842) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(709) process_complete_pdu: processing packet type 11 [2008/11/12 17:20:05, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1553) api_pipe_bind_req: decode request. 1553 [2008/11/12 17:20:05, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1564) api_pipe_bind_req: \PIPE\eventlog -> \PIPE\eventlog [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr_rb [2008/11/12 17:20:05, 6] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr_bba [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0000 max_tsize: 10b8 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0002 max_rsize: 10b8 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0004 assoc_gid: 00000000 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0008 num_contexts: 01 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000c context_id : 0000 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 000e num_transfer_syntaxes: 01 [2008/11/12 17:20:05, 6] rpc_parse/parse_prs.c:prs_debug(88) 00000f smb_io_rpc_iface [2008/11/12 17:20:05, 7] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_uuid uuid [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 data : 82273fdc [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 data : e32a [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0016 data : 18c3 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0018 data : 3f 78 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 001a data : 82 79 29 dc 23 ea [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0020 version: 00000000 [2008/11/12 17:20:05, 6] rpc_parse/parse_prs.c:prs_debug(88) 000024 smb_io_rpc_iface [2008/11/12 17:20:05, 7] rpc_parse/parse_prs.c:prs_debug(88) 000024 smb_io_uuid uuid [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0024 data : 8a885d04 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0028 data : 1ceb [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002a data : 11c9 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 002c data : 9f e8 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 002e data : 08 00 2b 10 48 60 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0034 version: 00000002 [2008/11/12 17:20:05, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1608) api_pipe_bind_req: make response. 1608 [2008/11/12 17:20:05, 3] rpc_server/srv_pipe.c:check_bind_req(991) check_bind_req for \PIPE\EVENTLOG checking \PIPE\lsarpc checking \PIPE\lsarpc checking \PIPE\samr checking \PIPE\NETLOGON checking \PIPE\srvsvc checking \PIPE\wkssvc checking \PIPE\winreg checking \PIPE\spoolss checking \PIPE\netdfs checking \PIPE\rpcecho checking \PIPE\initshutdown checking \PIPE\svcctl checking \PIPE\eventlog [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr_ba [2008/11/12 17:20:05, 6] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr_bba [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0000 max_tsize: 10b8 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0002 max_rsize: 10b8 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0004 assoc_gid: 000053f0 [2008/11/12 17:20:05, 6] rpc_parse/parse_prs.c:prs_debug(88) 000008 smb_io_rpc_addr_str [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 len: 000f [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 000a str: \PIPE\eventlog. [2008/11/12 17:20:05, 6] rpc_parse/parse_prs.c:prs_debug(88) 000019 smb_io_rpc_results [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 001c num_results: 01 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0020 result : 0000 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0022 reason : 0000 [2008/11/12 17:20:05, 6] rpc_parse/parse_prs.c:prs_debug(88) 000024 smb_io_rpc_iface [2008/11/12 17:20:05, 7] rpc_parse/parse_prs.c:prs_debug(88) 000024 smb_io_uuid uuid [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0024 data : 8a885d04 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0028 data : 1ceb [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002a data : 11c9 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 002c data : 9f e8 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 002e data : 08 00 2b 10 48 60 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0034 version: 00000002 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0048 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000001 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(953) write_to_pipe: data_used = 56 [2008/11/12 17:20:05, 3] smbd/pipes.c:reply_pipe_write_and_X(251) writeX-IPC pnum=7739 nwritten=72 [2008/11/12 17:20:05, 5] lib/util.c:show_msg(642) [2008/11/12 17:20:05, 5] lib/util.c:show_msg(652) size=47 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=1216 smt_wct=6 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 72 (0x48) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_bcc=0 [2008/11/12 17:20:05, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 59 [2008/11/12 17:20:05, 6] smbd/process.c:process_smb(1546) got message type 0x0 of len 0x3b [2008/11/12 17:20:05, 3] smbd/process.c:process_smb(1549) Transaction 36 of length 63 (0 toread) [2008/11/12 17:20:05, 5] lib/util.c:show_msg(642) [2008/11/12 17:20:05, 5] lib/util.c:show_msg(652) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=1280 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=30521 (0x7739) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2008/11/12 17:20:05, 3] smbd/process.c:switch_message(1361) switch message SMBreadX (pid 13995) conn 0x80594f08 [2008/11/12 17:20:05, 4] smbd/uid.c:change_to_user(182) change_to_user: Skipping user change - already user [2008/11/12 17:20:05, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1258) search for pipe pnum=7739 [2008/11/12 17:20:05, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1262) pipe name EVENTLOG pnum=7739 (pipes_open=2) [2008/11/12 17:20:05, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1262) pipe name svcctl pnum=7738 (pipes_open=2) [2008/11/12 17:20:05, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(985) read_from_pipe: 7739 name: EVENTLOG len: 1024 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1045) read_from_pipe: EVENTLOG: current_pdu_len = 72, current_pdu_sent = 0 returning 72 bytes. [2008/11/12 17:20:05, 3] smbd/pipes.c:reply_pipe_read_and_X(301) readX-IPC pnum=7739 min=1024 max=1024 nread=72 [2008/11/12 17:20:05, 5] lib/util.c:show_msg(642) [2008/11/12 17:20:05, 5] lib/util.c:show_msg(652) size=131 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=1280 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 72 (0x48) smb_vwv[ 6]= 59 (0x3B) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=72 [2008/11/12 17:20:05, 10] lib/util.c:dump_data(2223) [000] 05 00 0C 03 10 00 00 00 48 00 00 00 01 00 00 00 ........ H....... [010] B8 10 B8 10 F0 53 00 00 0F 00 5C 50 49 50 45 5C ¸.¸.ðS.. ..\PIPE\ [020] 65 76 65 6E 74 6C 6F 67 00 00 00 00 01 00 00 00 eventlog ........ [030] 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 .....].. ë.É..è.. [040] 2B 10 48 60 02 00 00 00 +.H`.... [2008/11/12 17:20:05, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 164 [2008/11/12 17:20:05, 6] smbd/process.c:process_smb(1546) got message type 0x0 of len 0xa4 [2008/11/12 17:20:05, 3] smbd/process.c:process_smb(1549) Transaction 37 of length 168 (0 toread) [2008/11/12 17:20:05, 5] lib/util.c:show_msg(642) [2008/11/12 17:20:05, 5] lib/util.c:show_msg(652) size=164 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=4276 smb_uid=100 smb_mid=1344 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 80 (0x50) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 80 (0x50) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=30521 (0x7739) smb_bcc=97 [2008/11/12 17:20:05, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [010] 00 05 00 00 03 10 00 00 00 50 00 00 00 01 00 00 ........ .P...... [020] 00 38 00 00 00 00 00 07 00 00 00 02 00 31 00 01 .8...... .....1.. [030] 00 0A 00 0C 00 04 00 02 00 06 00 00 00 00 00 00 ........ ........ [040] 00 05 00 00 00 53 00 61 00 6D 00 62 00 61 00 08 .....S.a .m.b.a.. [050] 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ [060] 00 . [2008/11/12 17:20:05, 3] smbd/process.c:switch_message(1361) switch message SMBtrans (pid 13995) conn 0x80594f08 [2008/11/12 17:20:05, 4] smbd/uid.c:change_to_user(182) change_to_user: Skipping user change - already user [2008/11/12 17:20:05, 3] smbd/ipc.c:handle_trans(436) trans <\PIPE\> data=80 params=0 setup=2 [2008/11/12 17:20:05, 5] smbd/ipc.c:handle_trans(469) calling named_pipe [2008/11/12 17:20:05, 3] smbd/ipc.c:named_pipe(387) named pipe command on <> name [2008/11/12 17:20:05, 5] smbd/ipc.c:api_fd_reply(307) api_fd_reply [2008/11/12 17:20:05, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1258) search for pipe pnum=7739 [2008/11/12 17:20:05, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1262) pipe name EVENTLOG pnum=7739 (pipes_open=2) [2008/11/12 17:20:05, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1262) pipe name svcctl pnum=7738 (pipes_open=2) [2008/11/12 17:20:05, 3] smbd/ipc.c:api_fd_reply(345) Got API command 0x26 on pipe "EVENTLOG" (pnum 7739) [2008/11/12 17:20:05, 10] smbd/ipc.c:api_fd_reply(350) api_fd_reply: p:0x805e9440 max_trans_reply: 1024 [2008/11/12 17:20:05, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(927) write_to_pipe: 7739 name: EVENTLOG open: Yes len: 80 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(949) write_to_pipe: data_left = 80 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(842) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 80 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(385) fill_rpc_header: data_to_copy = 80, len_needed_to_complete_hdr = 16, receive_len = 0 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(953) write_to_pipe: data_used = 16 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(949) write_to_pipe: data_left = 64 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(842) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 64 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0050 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000001 [2008/11/12 17:20:05, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(472) unmarshall_rpc_header: using little-endian RPC [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(501) unmarshall_rpc_header: type = 0, flags = 3 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(953) write_to_pipe: data_used = 0 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(949) write_to_pipe: data_left = 64 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(842) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 64, incoming data = 64 [2008/11/12 17:20:05, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(709) process_complete_pdu: processing packet type 0 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr_req req [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0000 alloc_hint: 00000038 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0004 context_id: 0000 [2008/11/12 17:20:05, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0006 opnum : 0007 [2008/11/12 17:20:05, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(519) free_pipe_context: destroying talloc pool of size 73 [2008/11/12 17:20:05, 5] rpc_server/srv_pipe.c:api_pipe_request(2262) Requested \PIPE\EVENTLOG [2008/11/12 17:20:05, 4] rpc_server/srv_pipe.c:api_rpcTNP(2297) api_rpcTNP: EVENTLOG op 0x7 - api_rpcTNP: rpc command: EVENTLOG_OPENEVENTLOG [2008/11/12 17:20:05, 6] rpc_server/srv_pipe.c:api_rpcTNP(2323) api_rpc_cmds[0].fn == 0x801d3012 eventlog_OpenEventLogW: struct eventlog_OpenEventLogW in: struct eventlog_OpenEventLogW unknown0 : * unknown0: struct eventlog_OpenUnknown0 unknown0 : 0x0031 (49) unknown1 : 0x0001 (1) logname : * logname: struct lsa_String length : 0x000a (10) size : 0x000a (10) string : * string : 'Samba' servername : * servername: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : NULL unknown2 : 0x00000001 (1) unknown3 : 0x00000001 (1) [2008/11/12 17:20:05, 10] rpc_server/srv_eventlog_nt.c:_eventlog_OpenEventLogW(631) _eventlog_open_eventlog: Server [], Log [Samba] [2008/11/12 17:20:05, 3] smbd/sec_ctx.c:push_sec_ctx(224) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2008/11/12 17:20:05, 3] smbd/uid.c:push_conn_ctx(357) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2008/11/12 17:20:05, 3] smbd/sec_ctx.c:set_sec_ctx(324) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2008/11/12 17:20:05, 5] auth/token_util.c:debug_nt_user_token(464) NT user token: (NULL) [2008/11/12 17:20:05, 5] auth/token_util.c:debug_unix_user_token(490) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2008/11/12 17:20:05, 7] rpc_server/srv_eventlog_lib.c:elog_open_tdb(358) elog_open_tdb: Opening /usr/local/samba/var/locks/eventlog/samba.tdb...(force_clear == False) [2008/11/12 17:20:05, 3] smbd/sec_ctx.c:pop_sec_ctx(432) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2008/11/12 17:20:05, 10] smbd/service.c:set_conn_connectpath(157) [2008/11/12 17:20:05, 0] lib/substitute.c:alloc_sub_basic(556) alloc_sub_basic: NULL source string! This should not happen set_conn_connectpath: service (null), connectpath = / [2008/11/12 17:20:05, 3] smbd/vfs.c:vfs_init_default(96) Initialising default vfs hooks [2008/11/12 17:20:05, 3] smbd/vfs.c:vfs_init_custom(130) Initialising custom vfs hooks from [/[Default VFS]/] [2008/11/12 17:20:05, 10] smbd/vfs.c:vfs_find_backend_entry(48) vfs_find_backend_entry called for /[Default VFS]/ Successfully loaded vfs module [/[Default VFS]/] with the new modules system [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #0 (type 0, layer 0) Making operation type 0 opaque [module /[Default VFS]/] Accepting operation type 0 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #1 (type 1, layer 0) Making operation type 1 opaque [module /[Default VFS]/] Accepting operation type 1 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #2 (type 2, layer 0) Making operation type 2 opaque [module /[Default VFS]/] Accepting operation type 2 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #3 (type 3, layer 0) Making operation type 3 opaque [module /[Default VFS]/] Accepting operation type 3 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #4 (type 4, layer 0) Making operation type 4 opaque [module /[Default VFS]/] Accepting operation type 4 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #5 (type 5, layer 0) Making operation type 5 opaque [module /[Default VFS]/] Accepting operation type 5 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #6 (type 6, layer 0) Making operation type 6 opaque [module /[Default VFS]/] Accepting operation type 6 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #7 (type 7, layer 0) Making operation type 7 opaque [module /[Default VFS]/] Accepting operation type 7 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #8 (type 8, layer 0) Making operation type 8 opaque [module /[Default VFS]/] Accepting operation type 8 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #9 (type 9, layer 0) Making operation type 9 opaque [module /[Default VFS]/] Accepting operation type 9 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #10 (type 10, layer 0) Making operation type 10 opaque [module /[Default VFS]/] Accepting operation type 10 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #11 (type 11, layer 0) Making operation type 11 opaque [module /[Default VFS]/] Accepting operation type 11 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #12 (type 12, layer 0) Making operation type 12 opaque [module /[Default VFS]/] Accepting operation type 12 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #13 (type 13, layer 0) Making operation type 13 opaque [module /[Default VFS]/] Accepting operation type 13 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #14 (type 14, layer 0) Making operation type 14 opaque [module /[Default VFS]/] Accepting operation type 14 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #15 (type 15, layer 0) Making operation type 15 opaque [module /[Default VFS]/] Accepting operation type 15 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #16 (type 16, layer 0) Making operation type 16 opaque [module /[Default VFS]/] Accepting operation type 16 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #17 (type 17, layer 0) Making operation type 17 opaque [module /[Default VFS]/] Accepting operation type 17 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #18 (type 18, layer 0) Making operation type 18 opaque [module /[Default VFS]/] Accepting operation type 18 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #19 (type 19, layer 0) Making operation type 19 opaque [module /[Default VFS]/] Accepting operation type 19 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #20 (type 20, layer 0) Making operation type 20 opaque [module /[Default VFS]/] Accepting operation type 20 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #21 (type 21, layer 0) Making operation type 21 opaque [module /[Default VFS]/] Accepting operation type 21 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #22 (type 22, layer 0) Making operation type 22 opaque [module /[Default VFS]/] Accepting operation type 22 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #23 (type 23, layer 0) Making operation type 23 opaque [module /[Default VFS]/] Accepting operation type 23 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #24 (type 24, layer 0) Making operation type 24 opaque [module /[Default VFS]/] Accepting operation type 24 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #25 (type 25, layer 0) Making operation type 25 opaque [module /[Default VFS]/] Accepting operation type 25 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #26 (type 26, layer 0) Making operation type 26 opaque [module /[Default VFS]/] Accepting operation type 26 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #27 (type 27, layer 0) Making operation type 27 opaque [module /[Default VFS]/] Accepting operation type 27 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #28 (type 28, layer 0) Making operation type 28 opaque [module /[Default VFS]/] Accepting operation type 28 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #29 (type 29, layer 0) Making operation type 29 opaque [module /[Default VFS]/] Accepting operation type 29 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #30 (type 30, layer 0) Making operation type 30 opaque [module /[Default VFS]/] Accepting operation type 30 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #31 (type 31, layer 0) Making operation type 31 opaque [module /[Default VFS]/] Accepting operation type 31 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #32 (type 32, layer 0) Making operation type 32 opaque [module /[Default VFS]/] Accepting operation type 32 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #33 (type 33, layer 0) Making operation type 33 opaque [module /[Default VFS]/] Accepting operation type 33 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #34 (type 34, layer 0) Making operation type 34 opaque [module /[Default VFS]/] Accepting operation type 34 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #35 (type 35, layer 0) Making operation type 35 opaque [module /[Default VFS]/] Accepting operation type 35 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #36 (type 36, layer 0) Making operation type 36 opaque [module /[Default VFS]/] Accepting operation type 36 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #37 (type 37, layer 0) Making operation type 37 opaque [module /[Default VFS]/] Accepting operation type 37 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #38 (type 38, layer 0) Making operation type 38 opaque [module /[Default VFS]/] Accepting operation type 38 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #39 (type 39, layer 0) Making operation type 39 opaque [module /[Default VFS]/] Accepting operation type 39 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #40 (type 40, layer 0) Making operation type 40 opaque [module /[Default VFS]/] Accepting operation type 40 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #41 (type 41, layer 0) Making operation type 41 opaque [module /[Default VFS]/] Accepting operation type 41 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #42 (type 42, layer 0) Making operation type 42 opaque [module /[Default VFS]/] Accepting operation type 42 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #43 (type 43, layer 0) Making operation type 43 opaque [module /[Default VFS]/] Accepting operation type 43 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #44 (type 44, layer 0) Making operation type 44 opaque [module /[Default VFS]/] Accepting operation type 44 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #45 (type 45, layer 0) Making operation type 45 opaque [module /[Default VFS]/] Accepting operation type 45 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #46 (type 46, layer 0) Making operation type 46 opaque [module /[Default VFS]/] Accepting operation type 46 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #47 (type 47, layer 0) Making operation type 47 opaque [module /[Default VFS]/] Accepting operation type 47 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #48 (type 48, layer 0) Making operation type 48 opaque [module /[Default VFS]/] Accepting operation type 48 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #49 (type 49, layer 0) Making operation type 49 opaque [module /[Default VFS]/] Accepting operation type 49 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #50 (type 50, layer 0) Making operation type 50 opaque [module /[Default VFS]/] Accepting operation type 50 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #51 (type 51, layer 0) Making operation type 51 opaque [module /[Default VFS]/] Accepting operation type 51 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #52 (type 52, layer 0) Making operation type 52 opaque [module /[Default VFS]/] Accepting operation type 52 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #53 (type 53, layer 0) Making operation type 53 opaque [module /[Default VFS]/] Accepting operation type 53 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #54 (type 54, layer 0) Making operation type 54 opaque [module /[Default VFS]/] Accepting operation type 54 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #55 (type 55, layer 0) Making operation type 55 opaque [module /[Default VFS]/] Accepting operation type 55 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #56 (type 56, layer 0) Making operation type 56 opaque [module /[Default VFS]/] Accepting operation type 56 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #57 (type 57, layer 0) Making operation type 57 opaque [module /[Default VFS]/] Accepting operation type 57 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #58 (type 58, layer 0) Making operation type 58 opaque [module /[Default VFS]/] Accepting operation type 58 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #59 (type 59, layer 0) Making operation type 59 opaque [module /[Default VFS]/] Accepting operation type 59 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #60 (type 60, layer 0) Making operation type 60 opaque [module /[Default VFS]/] Accepting operation type 60 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #61 (type 61, layer 0) Making operation type 61 opaque [module /[Default VFS]/] Accepting operation type 61 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #62 (type 62, layer 0) Making operation type 62 opaque [module /[Default VFS]/] Accepting operation type 62 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #63 (type 63, layer 0) Making operation type 63 opaque [module /[Default VFS]/] Accepting operation type 63 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #64 (type 64, layer 0) Making operation type 64 opaque [module /[Default VFS]/] Accepting operation type 64 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #65 (type 65, layer 0) Making operation type 65 opaque [module /[Default VFS]/] Accepting operation type 65 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #66 (type 66, layer 0) Making operation type 66 opaque [module /[Default VFS]/] Accepting operation type 66 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #67 (type 67, layer 0) Making operation type 67 opaque [module /[Default VFS]/] Accepting operation type 67 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #68 (type 68, layer 0) Making operation type 68 opaque [module /[Default VFS]/] Accepting operation type 68 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #69 (type 69, layer 0) Making operation type 69 opaque [module /[Default VFS]/] Accepting operation type 69 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #70 (type 70, layer 0) Making operation type 70 opaque [module /[Default VFS]/] Accepting operation type 70 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #71 (type 71, layer 0) Making operation type 71 opaque [module /[Default VFS]/] Accepting operation type 71 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #72 (type 72, layer 0) Making operation type 72 opaque [module /[Default VFS]/] Accepting operation type 72 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #73 (type 73, layer 0) Making operation type 73 opaque [module /[Default VFS]/] Accepting operation type 73 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #74 (type 74, layer 0) Making operation type 74 opaque [module /[Default VFS]/] Accepting operation type 74 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #75 (type 75, layer 0) Making operation type 75 opaque [module /[Default VFS]/] Accepting operation type 75 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #76 (type 76, layer 0) Making operation type 76 opaque [module /[Default VFS]/] Accepting operation type 76 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #77 (type 77, layer 0) Making operation type 77 opaque [module /[Default VFS]/] Accepting operation type 77 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #78 (type 78, layer 0) Making operation type 78 opaque [module /[Default VFS]/] Accepting operation type 78 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #79 (type 79, layer 0) Making operation type 79 opaque [module /[Default VFS]/] Accepting operation type 79 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #80 (type 80, layer 0) Making operation type 80 opaque [module /[Default VFS]/] Accepting operation type 80 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #81 (type 81, layer 0) Making operation type 81 opaque [module /[Default VFS]/] Accepting operation type 81 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #82 (type 82, layer 0) Making operation type 82 opaque [module /[Default VFS]/] Accepting operation type 82 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #83 (type 83, layer 0) Making operation type 83 opaque [module /[Default VFS]/] Accepting operation type 83 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #84 (type 84, layer 0) Making operation type 84 opaque [module /[Default VFS]/] Accepting operation type 84 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #85 (type 85, layer 0) Making operation type 85 opaque [module /[Default VFS]/] Accepting operation type 85 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #86 (type 86, layer 0) Making operation type 86 opaque [module /[Default VFS]/] Accepting operation type 86 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #87 (type 87, layer 0) Making operation type 87 opaque [module /[Default VFS]/] Accepting operation type 87 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #88 (type 88, layer 0) Making operation type 88 opaque [module /[Default VFS]/] Accepting operation type 88 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #89 (type 89, layer 0) Making operation type 89 opaque [module /[Default VFS]/] Accepting operation type 89 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #90 (type 90, layer 0) Making operation type 90 opaque [module /[Default VFS]/] Accepting operation type 90 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #91 (type 91, layer 0) Making operation type 91 opaque [module /[Default VFS]/] Accepting operation type 91 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #92 (type 92, layer 0) Making operation type 92 opaque [module /[Default VFS]/] Accepting operation type 92 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #93 (type 93, layer 0) Making operation type 93 opaque [module /[Default VFS]/] Accepting operation type 93 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #94 (type 94, layer 0) Making operation type 94 opaque [module /[Default VFS]/] Accepting operation type 94 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #95 (type 95, layer 0) Making operation type 95 opaque [module /[Default VFS]/] Accepting operation type 95 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #96 (type 96, layer 0) Making operation type 96 opaque [module /[Default VFS]/] Accepting operation type 96 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #97 (type 97, layer 0) Making operation type 97 opaque [module /[Default VFS]/] Accepting operation type 97 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #98 (type 98, layer 0) Making operation type 98 opaque [module /[Default VFS]/] Accepting operation type 98 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #99 (type 99, layer 0) Making operation type 99 opaque [module /[Default VFS]/] Accepting operation type 99 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #100 (type 100, layer 0) Making operation type 100 opaque [module /[Default VFS]/] Accepting operation type 100 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #101 (type 101, layer 0) Making operation type 101 opaque [module /[Default VFS]/] Accepting operation type 101 from module /[Default VFS]/ [2008/11/12 17:20:05, 5] smbd/vfs.c:vfs_init_custom(193) Checking operation #102 (type 102, layer 0) Making operation type 102 opaque [module /[Default VFS]/] Accepting operation type 102 from module /[Default VFS]/ [2008/11/12 17:20:05, 10] smbd/posix_acls.c:posix_fget_nt_acl(3093) posix_fget_nt_acl: called for file /usr/local/samba/var/locks/eventlog/samba.tdb [2008/11/12 17:20:05, 10] smbd/posix_acls.c:posix_get_nt_acl(3125) posix_get_nt_acl: called for file /usr/local/samba/var/locks/eventlog/samba.tdb [2008/11/12 17:20:05, 3] smbd/sec_ctx.c:push_sec_ctx(224) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2008/11/12 17:20:05, 3] smbd/uid.c:push_conn_ctx(357) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2008/11/12 17:20:05, 3] smbd/sec_ctx.c:set_sec_ctx(324) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2008/11/12 17:20:05, 5] auth/token_util.c:debug_nt_user_token(464) NT user token: (NULL) [2008/11/12 17:20:05, 5] auth/token_util.c:debug_unix_user_token(490) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2008/11/12 17:20:05, 3] smbd/sec_ctx.c:pop_sec_ctx(432) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2008/11/12 17:20:05, 10] passdb/lookup_sid.c:legacy_gid_to_sid(1170) LEGACY: gid 50 -> sid S-1-22-2-50 [2008/11/12 17:20:05, 10] smbd/posix_acls.c:canonicalise_acl(2319) canonicalise_acl: Access ace entries before arrange : [2008/11/12 17:20:05, 10] smbd/posix_acls.c:canonicalise_acl(2332) canon_ace index 0. Type = allow SID = S-1-1-0 other SMB_ACL_OTHER perms --- [2008/11/12 17:20:05, 10] smbd/posix_acls.c:canonicalise_acl(2332) canon_ace index 1. Type = allow SID = S-1-22-2-50 gid 50 (staff) SMB_ACL_GROUP_OBJ perms r-- [2008/11/12 17:20:05, 10] smbd/posix_acls.c:canonicalise_acl(2332) canon_ace index 2. Type = allow SID = S-1-5-21-2798818921-3070334068-1585961218-1000 uid 0 (root) SMB_ACL_USER_OBJ perms rw- [2008/11/12 17:20:05, 10] smbd/posix_acls.c:print_canon_ace_list(660) print_canon_ace_list: canonicalise_acl: ace entries after arrange canon_ace index 0. Type = allow SID = S-1-5-21-2798818921-3070334068-1585961218-1000 uid 0 (root) SMB_ACL_USER_OBJ perms rw- canon_ace index 1. Type = allow SID = S-1-22-2-50 gid 50 (staff) SMB_ACL_GROUP_OBJ perms r-- canon_ace index 2. Type = allow SID = S-1-1-0 other SMB_ACL_OTHER perms --- [2008/11/12 17:20:05, 10] smbd/posix_acls.c:map_canon_ace_perms(936) map_canon_ace_perms: Mapped (UNIX) 180 to (NT) 12019f [2008/11/12 17:20:05, 10] smbd/posix_acls.c:map_canon_ace_perms(936) map_canon_ace_perms: Mapped (UNIX) 100 to (NT) 120089 [2008/11/12 17:20:05, 10] smbd/posix_acls.c:map_canon_ace_perms(936) map_canon_ace_perms: Mapped (UNIX) 0 to (NT) 0 [2008/11/12 17:20:05, 5] rpc_server/srv_eventlog_nt.c:elog_check_access(94) elog_check_access: using root's token [2008/11/12 17:20:05, 10] lib/util_seaccess.c:se_access_check(232) se_access_check: requested access 0x02000000, for NT token with 5 entries and first sid S-1-5-21-2798818921-3070334068-1585961218-1000. [2008/11/12 17:20:05, 3] lib/util_seaccess.c:se_access_check(249) [2008/11/12 17:20:05, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-2798818921-3070334068-1585961218-1000 se_access_check: also S-1-5-32-544 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 [2008/11/12 17:20:05, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(148) Opened policy hnd[1] [000] 00 00 00 00 07 00 00 00 00 00 00 00 1A 49 B5 91 ........ .....Iµ. [010] AB 36 00 00 «6.. [2008/11/12 17:20:05, 8] rpc_server/srv_eventlog_nt.c:get_num_records_hook(159) Oldest Record 1; Next Record 1 [2008/11/12 17:20:05, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(168) Found policy hnd[0] [000] 00 00 00 00 07 00 00 00 00 00 00 00 1A 49 B5 91 ........ .....Iµ. [010] AB 36 00 00 «6.. [2008/11/12 17:20:05, 10] rpc_server/srv_eventlog_nt.c:_eventlog_OpenEventLogW(646) [2008/11/12 17:20:05, 1] rpc_server/srv_eventlog_lib.c:elog_tdb_size(127) eventlog size: [20] for [5] records _eventlog_open_eventlog: Size [20] [2008/11/12 17:20:05, 4] rpc_server/srv_eventlog_nt.c:sync_eventlog_params(433) sync_eventlog_params with Samba [2008/11/12 17:20:05, 7] registry/reg_api.c:regkey_open_onelevel(132) regkey_open_onelevel: name = [HKLM] [2008/11/12 17:20:05, 3] smbd/sec_ctx.c:push_sec_ctx(224) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2008/11/12 17:20:05, 3] smbd/uid.c:push_conn_ctx(357) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2008/11/12 17:20:05, 3] smbd/sec_ctx.c:set_sec_ctx(324) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2008/11/12 17:20:05, 5] auth/token_util.c:debug_nt_user_token(464) NT user token: (NULL) [2008/11/12 17:20:05, 5] auth/token_util.c:debug_unix_user_token(490) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2008/11/12 17:20:05, 3] smbd/sec_ctx.c:pop_sec_ctx(432) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_open(409) regdb_open: refcount reset (1) [2008/11/12 17:20:05, 10] registry/reg_cachehook.c:reghook_cache_find(125) reghook_cache_find: Searching for keyname [/HKLM] [2008/11/12 17:20:05, 10] lib/adt_tree.c:pathtree_find(352) pathtree_find: Enter [/HKLM] [2008/11/12 17:20:05, 10] lib/adt_tree.c:pathtree_find(425) pathtree_find: Exit [2008/11/12 17:20:05, 10] registry/reg_cachehook.c:reghook_cache_find(130) reghook_cache_find: found ops 0x80590920 for key [/HKLM] [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_get_secdesc(963) regdb_get_secdesc: Getting secdesc of key [HKLM] [2008/11/12 17:20:05, 10] lib/util_seaccess.c:se_access_check(232) se_access_check: requested access 0x00000008, for NT token with 5 entries and first sid S-1-5-21-2798818921-3070334068-1585961218-1000. [2008/11/12 17:20:05, 3] lib/util_seaccess.c:se_access_check(249) [2008/11/12 17:20:05, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-2798818921-3070334068-1585961218-1000 se_access_check: also S-1-5-32-544 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = 8 [2008/11/12 17:20:05, 5] lib/util_seaccess.c:se_access_check(310) se_access_check: access (8) granted. [2008/11/12 17:20:05, 7] registry/reg_api.c:regkey_open_onelevel(132) regkey_open_onelevel: name = [SYSTEM] [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_open(391) regdb_open: incrementing refcount (1) [2008/11/12 17:20:05, 10] registry/reg_cachehook.c:reghook_cache_find(125) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM] [2008/11/12 17:20:05, 10] lib/adt_tree.c:pathtree_find(352) pathtree_find: Enter [/HKLM/SYSTEM] [2008/11/12 17:20:05, 10] lib/adt_tree.c:pathtree_find(425) pathtree_find: Exit [2008/11/12 17:20:05, 10] registry/reg_cachehook.c:reghook_cache_find(130) reghook_cache_find: found ops 0x80590920 for key [/HKLM/SYSTEM] [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_get_secdesc(963) regdb_get_secdesc: Getting secdesc of key [HKLM\SYSTEM] [2008/11/12 17:20:05, 10] lib/util_seaccess.c:se_access_check(232) se_access_check: requested access 0x00000008, for NT token with 5 entries and first sid S-1-5-21-2798818921-3070334068-1585961218-1000. [2008/11/12 17:20:05, 3] lib/util_seaccess.c:se_access_check(249) [2008/11/12 17:20:05, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-2798818921-3070334068-1585961218-1000 se_access_check: also S-1-5-32-544 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = 8 [2008/11/12 17:20:05, 5] lib/util_seaccess.c:se_access_check(310) se_access_check: access (8) granted. [2008/11/12 17:20:05, 7] registry/reg_api.c:regkey_open_onelevel(132) regkey_open_onelevel: name = [CurrentControlSet] [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_open(391) regdb_open: incrementing refcount (2) [2008/11/12 17:20:05, 10] registry/reg_cachehook.c:reghook_cache_find(125) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet] [2008/11/12 17:20:05, 10] lib/adt_tree.c:pathtree_find(352) pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet] [2008/11/12 17:20:05, 10] lib/adt_tree.c:pathtree_find(425) pathtree_find: Exit [2008/11/12 17:20:05, 10] registry/reg_cachehook.c:reghook_cache_find(130) reghook_cache_find: found ops 0x80590920 for key [/HKLM/SYSTEM/CurrentControlSet] [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_get_secdesc(963) regdb_get_secdesc: Getting secdesc of key [HKLM\SYSTEM\CurrentControlSet] [2008/11/12 17:20:05, 10] lib/util_seaccess.c:se_access_check(232) se_access_check: requested access 0x00000008, for NT token with 5 entries and first sid S-1-5-21-2798818921-3070334068-1585961218-1000. [2008/11/12 17:20:05, 3] lib/util_seaccess.c:se_access_check(249) [2008/11/12 17:20:05, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-2798818921-3070334068-1585961218-1000 se_access_check: also S-1-5-32-544 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = 8 [2008/11/12 17:20:05, 5] lib/util_seaccess.c:se_access_check(310) se_access_check: access (8) granted. [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_close(425) regdb_close: decrementing refcount (2) [2008/11/12 17:20:05, 7] registry/reg_api.c:regkey_open_onelevel(132) regkey_open_onelevel: name = [Services] [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_open(391) regdb_open: incrementing refcount (2) [2008/11/12 17:20:05, 10] registry/reg_cachehook.c:reghook_cache_find(125) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services] [2008/11/12 17:20:05, 10] lib/adt_tree.c:pathtree_find(352) pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services] [2008/11/12 17:20:05, 10] lib/adt_tree.c:pathtree_find(425) pathtree_find: Exit [2008/11/12 17:20:05, 10] registry/reg_cachehook.c:reghook_cache_find(130) reghook_cache_find: found ops 0x80590920 for key [/HKLM/SYSTEM/CurrentControlSet/Services] [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_get_secdesc(963) regdb_get_secdesc: Getting secdesc of key [HKLM\SYSTEM\CurrentControlSet\Services] [2008/11/12 17:20:05, 10] lib/util_seaccess.c:se_access_check(232) se_access_check: requested access 0x00000008, for NT token with 5 entries and first sid S-1-5-21-2798818921-3070334068-1585961218-1000. [2008/11/12 17:20:05, 3] lib/util_seaccess.c:se_access_check(249) [2008/11/12 17:20:05, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-2798818921-3070334068-1585961218-1000 se_access_check: also S-1-5-32-544 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = 8 [2008/11/12 17:20:05, 5] lib/util_seaccess.c:se_access_check(310) se_access_check: access (8) granted. [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_close(425) regdb_close: decrementing refcount (2) [2008/11/12 17:20:05, 7] registry/reg_api.c:regkey_open_onelevel(132) regkey_open_onelevel: name = [Eventlog/Samba] [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_open(391) regdb_open: incrementing refcount (2) [2008/11/12 17:20:05, 10] registry/reg_cachehook.c:reghook_cache_find(125) reghook_cache_find: Searching for keyname [/HKLM/SYSTEM/CurrentControlSet/Services/Eventlog/Samba] [2008/11/12 17:20:05, 10] lib/adt_tree.c:pathtree_find(352) pathtree_find: Enter [/HKLM/SYSTEM/CurrentControlSet/Services/Eventlog/Samba] [2008/11/12 17:20:05, 10] lib/adt_tree.c:pathtree_find(425) pathtree_find: Exit [2008/11/12 17:20:05, 10] registry/reg_cachehook.c:reghook_cache_find(130) reghook_cache_find: found ops 0x80590920 for key [/HKLM/SYSTEM/CurrentControlSet/Services/Eventlog/Samba] [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_get_secdesc(963) regdb_get_secdesc: Getting secdesc of key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog/Samba] [2008/11/12 17:20:05, 10] lib/util_seaccess.c:se_access_check(232) se_access_check: requested access 0x00020019, for NT token with 5 entries and first sid S-1-5-21-2798818921-3070334068-1585961218-1000. [2008/11/12 17:20:05, 3] lib/util_seaccess.c:se_access_check(249) [2008/11/12 17:20:05, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-2798818921-3070334068-1585961218-1000 se_access_check: also S-1-5-32-544 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20019, current desired = 19 [2008/11/12 17:20:05, 5] lib/util_seaccess.c:se_access_check(310) se_access_check: access (20019) granted. [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_close(425) regdb_close: decrementing refcount (2) [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_close(425) regdb_close: decrementing refcount (1) [2008/11/12 17:20:05, 10] registry/reg_dispatcher.c:fetch_reg_values(131) fetch_reg_values called for key 'HKLM\SYSTEM\CurrentControlSet\Services\Eventlog/Samba' (ops 0x80590920) [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_fetch_values(868) regdb_fetch_values: Looking for value of key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog/Samba] [2008/11/12 17:20:05, 8] registry/reg_backend_db.c:regdb_unpack_values(815) specific: [MaxSize], len: 4 [2008/11/12 17:20:05, 8] registry/reg_backend_db.c:regdb_unpack_values(815) specific: [Retention], len: 4 [2008/11/12 17:20:05, 8] registry/reg_backend_db.c:regdb_unpack_values(815) specific: [PrimaryModule], len: 12 [2008/11/12 17:20:05, 8] registry/reg_backend_db.c:regdb_unpack_values(815) specific: [Sources], len: 12 [2008/11/12 17:20:05, 8] registry/reg_backend_db.c:regdb_unpack_values(815) specific: [File], len: 78 [2008/11/12 17:20:05, 10] registry/reg_backend_db.c:regdb_close(425) regdb_close: decrementing refcount (0) [2008/11/12 17:20:05, 1] rpc_server/srv_eventlog_lib.c:elog_tdb_size(127) eventlog size: [20] for [5] records [2008/11/12 17:20:05, 3] rpc_server/srv_eventlog_lib.c:prune_eventlog(257) Calculated size [20] MaxSize [524288] [2008/11/12 17:20:05, 3] rpc_server/srv_eventlog_lib.c:make_way_for_eventlogs(177) MaxSize [524288] Retention [604800] Current Time [1226478005] exp_time [1225873205] [2008/11/12 17:20:05, 3] rpc_server/srv_eventlog_lib.c:make_way_for_eventlogs(180) Start Record [1] End Record [1] [2008/11/12 17:20:05, 3] rpc_server/srv_eventlog_lib.c:make_way_for_eventlogs(224) nbytes [0] needed [0] start_record is [1], should be set to [1] eventlog_OpenEventLogW: struct eventlog_OpenEventLogW out: struct eventlog_OpenEventLogW handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000007-0000-0000-1a49-b591ab360000 result : NT_STATUS_OK [2008/11/12 17:20:05, 0] lib/fault.c:fault_report(40) =============================================================== [2008/11/12 17:20:05, 0] lib/fault.c:fault_report(41) INTERNAL ERROR: Signal 6 in pid 13995 (3.2.4) Please read the Trouble-Shooting section of the Samba3-HOWTO [2008/11/12 17:20:05, 0] lib/fault.c:fault_report(43) From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf [2008/11/12 17:20:05, 0] lib/fault.c:fault_report(44) =============================================================== [2008/11/12 17:20:05, 0] lib/util.c:smb_panic(1663) PANIC (pid 13995): internal error [2008/11/12 17:20:05, 0] lib/util.c:log_stack_trace(1767) BACKTRACE: 25 stack frames: #0 /usr/local/samba/sbin/smbd(log_stack_trace+0x2d) [0x8027a5ec] #1 /usr/local/samba/sbin/smbd(smb_panic+0x80) [0x8027a728] #2 /usr/local/samba/sbin/smbd [0x802651fa] #3 [0xb7eeb420] #4 /lib/tls/i686/cmov/libc.so.6(abort+0x109) [0xb7c4ffb9] #5 /usr/local/samba/lib/libtalloc.so.1(talloc_is_parent+0) [0xb7d6f556] #6 /usr/local/samba/lib/libtalloc.so.1(_talloc_zero+0x4e) [0xb7d703a7] #7 /usr/local/samba/sbin/smbd(ndr_push_init_ctx+0x34) [0x80292ff2] #8 /usr/local/samba/sbin/smbd [0x801d914e] #9 /usr/local/samba/sbin/smbd [0x801d2fa6] #10 /usr/local/samba/sbin/smbd [0x801d3025] #11 /usr/local/samba/sbin/smbd(api_rpcTNP+0x308) [0x801fccfa] #12 /usr/local/samba/sbin/smbd(api_pipe_request+0x245) [0x801fd359] #13 /usr/local/samba/sbin/smbd [0x801f5ef7] #14 /usr/local/samba/sbin/smbd [0x801f6720] #15 /usr/local/samba/sbin/smbd(write_to_pipe+0x15d) [0x801f4230] #16 /usr/local/samba/sbin/smbd [0x8007f74e] #17 /usr/local/samba/sbin/smbd [0x8007fe91] #18 /usr/local/samba/sbin/smbd(reply_trans+0x6ed) [0x80080a24] #19 /usr/local/samba/sbin/smbd [0x800db46a] #20 /usr/local/samba/sbin/smbd [0x800dcd68] #21 /usr/local/samba/sbin/smbd(smbd_process+0xd2d) [0x800ddb42] #22 /usr/local/samba/sbin/smbd(main+0x2122) [0x804c0b62] #23 /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xc8) [0xb7c3aea8] #24 /usr/local/samba/sbin/smbd [0x80061961] [2008/11/12 17:20:05, 0] lib/fault.c:dump_core(201) dumping core in /usr/local/samba/var/cores/smbd [2008/11/12 17:20:05, 10] lib/messages_local.c:messaging_tdb_store(215) messaging_tdb_store: array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000311 (785) dest: struct server_id id : 0x00003699 (13977) src: struct server_id id : 0x00003699 (13977) buf : DATA_BLOB length=0 [2008/11/12 17:20:05, 10] lib/messages_local.c:messaging_tdb_store(215) messaging_tdb_store: array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000305 (773) dest: struct server_id id : 0x0000369c (13980) src: struct server_id id : 0x00003699 (13977) buf : DATA_BLOB length=0 [2008/11/12 17:20:05, 10] lib/messages_local.c:messaging_tdb_fetch(174) messaging_tdb_fetch: result: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000311 (785) dest: struct server_id id : 0x00003699 (13977) src: struct server_id id : 0x00003699 (13977) buf : DATA_BLOB length=0 [2008/11/12 17:20:05, 10] lib/messages_local.c:messaging_tdb_store(215) messaging_tdb_store: array: struct messaging_array num_messages : 0x00000002 (2) messages: ARRAY(2) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000311 (785) dest: struct server_id id : 0x00003699 (13977) src: struct server_id id : 0x00003699 (13977) buf : DATA_BLOB length=0 messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000305 (773) dest: struct server_id id : 0x00003699 (13977) src: struct server_id id : 0x00003699 (13977) buf : DATA_BLOB length=0 [2008/11/12 17:20:05, 10] lib/messages_local.c:messaging_tdb_store(215) messaging_tdb_store: array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000305 (773) dest: struct server_id id : 0x0000369b (13979) src: struct server_id id : 0x00003699 (13977) buf : DATA_BLOB length=0 [2008/11/12 17:20:05, 10] lib/messages_local.c:messaging_tdb_store(215) messaging_tdb_store: array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000305 (773) dest: struct server_id id : 0x000036ab (13995) src: struct server_id id : 0x00003699 (13977) buf : DATA_BLOB length=0 [2008/11/12 17:20:05, 2] lib/messages_local.c:message_notify(270) message to process 13995 failed - No such process [2008/11/12 17:20:05, 2] lib/messages_local.c:messaging_tdb_send(358) pid 13995 doesn't exist - deleting messages record [2008/11/12 17:20:05, 2] lib/messages.c:traverse_fn(127) pid 13995 doesn't exist - deleting connections -1 [] [2008/11/12 17:20:05, 10] lib/messages_local.c:message_dispatch(419) message_dispatch: received_signal = 1 [2008/11/12 17:20:05, 10] lib/messages_local.c:messaging_tdb_fetch(174) messaging_tdb_fetch: result: struct messaging_array num_messages : 0x00000002 (2) messages: ARRAY(2) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000311 (785) dest: struct server_id id : 0x00003699 (13977) src: struct server_id id : 0x00003699 (13977) buf : DATA_BLOB length=0 messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000305 (773) dest: struct server_id id : 0x00003699 (13977) src: struct server_id id : 0x00003699 (13977) buf : DATA_BLOB length=0 [2008/11/12 17:20:05, 10] printing/printing.c:start_background_queue(1443) start_background_queue: background LPQ thread got a message [2008/11/12 17:20:05, 10] lib/messages_local.c:message_dispatch(419) message_dispatch: received_signal = 1 [2008/11/12 17:20:05, 10] lib/messages_local.c:messaging_tdb_fetch(174) messaging_tdb_fetch: result: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000305 (773) dest: struct server_id id : 0x0000369c (13980) src: struct server_id id : 0x00003699 (13977) buf : DATA_BLOB length=0 [2008/11/12 17:20:09, 10] printing/printing.c:start_background_queue(1443) start_background_queue: background LPQ thread got a message [2008/11/12 17:20:09, 10] lib/messages_local.c:message_dispatch(419) message_dispatch: received_signal = 1 [2008/11/12 17:20:09, 10] lib/messages_local.c:messaging_tdb_fetch(174) messaging_tdb_fetch: result: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000001 (1) dest: struct server_id id : 0x0000369c (13980) src: struct server_id id : 0x000036ae (13998) buf : DATA_BLOB length=2 [2008/11/12 17:20:09, 10] lib/util.c:dump_data(2223) [000] 33 00 3. [2008/11/12 17:20:09, 3] lib/debug.c:debug_message(509) INFO: Remote set of debug to `3' (pid 13980 from pid 13998) [2008/11/12 17:20:09, 10] lib/messages_local.c:message_dispatch(419) message_dispatch: received_signal = 1 [2008/11/12 17:20:09, 10] lib/messages_local.c:messaging_tdb_fetch(174) messaging_tdb_fetch: result: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000001 (1) dest: struct server_id id : 0x00003699 (13977) src: struct server_id id : 0x000036ae (13998) buf : DATA_BLOB length=2 [2008/11/12 17:20:09, 10] lib/util.c:dump_data(2223) [000] 33 00 3. [2008/11/12 17:20:09, 3] lib/debug.c:debug_message(509) INFO: Remote set of debug to `3' (pid 13977 from pid 13998) [2008/11/12 17:20:42, 3] smbd/sec_ctx.c:set_sec_ctx(324) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2008/11/12 17:20:42, 3] smbd/connection.c:yield_connection(31) Yielding connection to [2008/11/12 17:20:42, 3] smbd/server.c:exit_server_common(945) Server exit (normal exit) [2008/11/12 17:20:42, 3] smbd/sec_ctx.c:set_sec_ctx(324) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2008/11/12 17:20:42, 3] smbd/connection.c:yield_connection(31) Yielding connection to [2008/11/12 17:20:42, 3] smbd/connection.c:yield_connection(42) deleting connection record returned NT_STATUS_NOT_FOUND [2008/11/12 17:20:42, 3] smbd/server.c:exit_server_common(945) Server exit (normal exit)