This is a symptom on the same system I reported bug #13098 for, I'm not sure if they're related though, so I filed them separately. At certain points, the following message is spammed constantly (and by that I mean 300 to 500 lines per second) in the logs: error unpacking Spotlight RPC blob sl_unpack_tag: count limit 5981 sl_unpack: sl_unpack_loop failed error unpacking Spotlight RPC blob sl_unpack_tag: count limit 5981 sl_unpack: sl_unpack_loop failed error unpacking Spotlight RPC blob sl_unpack_tag: count limit 5981 sl_unpack: sl_unpack_loop failed error unpacking Spotlight RPC blob sl_unpack_tag: count limit 5981 sl_unpack: sl_unpack_loop failed error unpacking Spotlight RPC blob sl_unpack_tag: count limit 5981 sl_unpack: sl_unpack_loop failed error unpacking Spotlight RPC blob sl_unpack_tag: count limit 5981 sl_unpack: sl_unpack_loop failed error unpacking Spotlight RPC blob It seems this is related with a client that's connected since in the evening, after the users shutdown their systems, these logs messages stop until somewhere in the morning.
Probably unrelated, so we'll need a network trace to diagnose further.
Is there a specific port/filter I can apply for a tcpdump? TCP/UDP 139 and 445 enough? This is going to be a massive amount of data, since I haven't been able to reproduce this problem locally, and would have to do this on the production share (which is being heavily used). I'll try to isolate this client, but I'll have to get back to you about this, since I'll be on holiday the next week.
<https://wiki.samba.org/index.php/Capture_Packets#Tracing_SMB_traffic_of_a_specific_client>