Bug 13094 - Samba / Winbind AD Client high cpu load
Samba / Winbind AD Client high cpu load
Status: NEW
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Winbind
4.6.2
x64 Linux
: P5 major
: ---
Assigned To: Samba QA Contact
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-10-22 13:09 UTC by Marco Cusano
Modified: 2017-10-22 13:09 UTC (History)
0 users

See Also:


Attachments
all relevant configuration files and logs with debug level 6 (529.57 KB, application/x-zip-compressed)
2017-10-22 13:09 UTC, Marco Cusano
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Marco Cusano 2017-10-22 13:09:36 UTC
Created attachment 13712 [details]
all relevant configuration files and logs with debug level 6

Hi, we use Samba + Winbind integrated in our Windows Server AD domain on a number of servers. We have one which, due to the application that it is supporting, receives a higher number of requests (in bursts), and the amount of cpu load is extremely high. The share is on a VM with fairly high spec (16 xeon vcpus, 16g of ram), and ssd storage. 

When the clients make requests, the smbd load per process goes to around 10/20% of a single cpu each, using up all cpu resources and freezing the vm / share. This is followed by 10/20 seconds of a single threaded winbindd instance taking up 100% of a single cpu, still leaving the share inaccessible.

If I disable ADS auth and revert to security = user, mapping all our domain users to guest, and allowing guest access to that share, the same amount of requests is handled by the machine with near 0 cpu load.

I am filing this as a potential bug as I find it hardly believable that the overhead of Kerberos/winbind authentication is in the order of hundreds of times. Also how come winbind is single threaded, can that be changed?

please find attached all relevant configuration files and logs with debug level 6

Thanks