***************** In smb.conf winbindd max clients parameter is set to lower level to simulate the issue. "winbind max clients = 6" ************ -----------> lsof of parent winbindd during the issue. Even though max clients is set to 5, open fds keep increasing. bash-3.00# /usr/sbin/lsof -p 23181 | grep privi | wc 16 128 1760 ----------->strace after the winbindd has crossed beyond max client connection. bash-3.00# strace -p 23181 Process 23181 attached - interrupt to quit select(25, [8 15 16 17 24], [], NULL, {229, 690000} ) = 1 (in [16], left {220, 774000}) gettimeofday({1347530153, 351827}, NULL) = 0 write(1, "winbindd: Exceeding 6 client con"..., 68) = 68 write(1, "winbindd: Exceeding 6 client con"..., 67) = 67 accept(16, {sa_family=AF_FILE, path=""}, [2]) = 22 write(1, "accepted socket 22\n", 19) = 19 time(NULL) = 1347530153 gettimeofday({1347530153, 352139}, NULL) = 0 gettimeofday({1347530153, 352163}, NULL) = 0 select(25, [8 15 16 17 22 24], [], NULL, {220, 776689}) = 1 (in [22], left {220, 776689}) gettimeofday({1347530153, 352236}, NULL) = 0 recv(22, "0\10\0\0", 4, 0) = 4 gettimeofday({1347530153, 352303}, NULL) = 0 gettimeofday({1347530153, 352327}, NULL) = 0 select(25, [8 15 16 17 22 24], [], NULL, {220, 776525}) = 1 (in [22], left {220, 776525}) gettimeofday({1347530153, 352392}, NULL) = 0 recv(22, "\r\0\0\0\0\0\0\0Ab\0\0\0\0\0\0\2 \0\0\0\0\0\0\0\0\0\0\0"..., 2092, 0) = 2092 write(1, "process_request: request fn PAM_"..., 37) = 37 write(1, "[25153]: pam auth MATRIX\\devtest"..., 34) = 34 write(1, "is_myname(\"MATRIX\") returns 0\n", 30) = 30 gettimeofday({1347530153, 352636}, NULL) = 0 gettimeofday({1347530153, 352660}, NULL) = 0 select(25, [8 15 16 17 24], [], NULL, {220, 776192}) = ? ERESTARTNOHAND (To be restarted) --- SIGWINCH (Window changed) @ 0 (0) --- select(25, [8 15 16 17 24], [], NULL, {203, 321000}) = 1 (in [16], left {203, 298000}) gettimeofday({1347530170, 847716}, NULL) = 0 write(1, "winbindd: Exceeding 6 client con"..., 68) = 68 write(1, "winbindd: Exceeding 6 client con"..., 67) = 67 accept(16, {sa_family=AF_FILE, path="\uffff\uffff\uffff\uffffj\uffff\uffff\uffff\uffff\uffff"}, [2]) = 37 write(1, "accepted socket 37\n", 19) = 19 time(NULL) = 1347530170 gettimeofday({1347530170, 847971}, NULL) = 0 gettimeofday({1347530170, 847995}, NULL) = 0 select(38, [8 15 16 17 24 37], [], NULL, {203, 280857}) = 1 (in [37], left {203, 280857}) gettimeofday({1347530170, 848067}, NULL) = 0 recv(37, "0\10\0\0", 4, 0) = 4 gettimeofday({1347530170, 848130}, NULL) = 0 gettimeofday({1347530170, 848154}, NULL) = 0 select(38, [8 15 16 17 24 37], [], NULL, {203, 280698}) = 1 (in [37], left {203, 280698}) gettimeofday({1347530170, 848221}, NULL) = 0 recv(37, "\r\0\0\0\0\0\0\0Ab\0\0\0\0\0\0\2 \0\0\0\0\0\0\0\0\0\0\0"..., 2092, 0) = 2092 write(1, "process_request: request fn PAM_"..., 37) = 37 write(1, "[25153]: pam auth MATRIX\\devtest"..., 34) = 34 write(1, "is_myname(\"MATRIX\") returns 0\n", 30) = 30 gettimeofday({1347530170, 848440}, NULL) = 0 gettimeofday({1347530170, 848464}, NULL) = 0 select(25, [8 15 16 17 24], [], NULL, {203, 280388} -------------> Even though client closes fd, it is not seen at winbindd. I see that in the debug log client closes the connection and exits.