Bug 13103 - Spotlight search serverside error message spam
Spotlight search serverside error message spam
Status: ASSIGNED
Product: Samba 4.1 and newer
Classification: Unclassified
Component: DCE-RPCs and pipes
4.7.0
x64 Linux
: P5 normal
: ---
Assigned To: Ralph Böhme
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-10-26 12:44 UTC by Bart Meuris
Modified: 2017-10-27 09:55 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Bart Meuris 2017-10-26 12:44:46 UTC
This is a symptom on the same system I reported bug #13098 for, I'm not sure if they're related though, so I filed them separately.

At certain points, the following message is spammed constantly (and by that I mean 300 to 500 lines per second) in the logs:

error unpacking Spotlight RPC blob
sl_unpack_tag: count limit 5981
sl_unpack: sl_unpack_loop failed
error unpacking Spotlight RPC blob
sl_unpack_tag: count limit 5981
sl_unpack: sl_unpack_loop failed
error unpacking Spotlight RPC blob
sl_unpack_tag: count limit 5981
sl_unpack: sl_unpack_loop failed
error unpacking Spotlight RPC blob
sl_unpack_tag: count limit 5981
sl_unpack: sl_unpack_loop failed
error unpacking Spotlight RPC blob
sl_unpack_tag: count limit 5981
sl_unpack: sl_unpack_loop failed
error unpacking Spotlight RPC blob
sl_unpack_tag: count limit 5981
sl_unpack: sl_unpack_loop failed
error unpacking Spotlight RPC blob

It seems this is related with a client that's connected since in the evening, after the users shutdown their systems, these logs messages stop until somewhere in the morning.
Comment 1 Ralph Böhme 2017-10-26 17:52:58 UTC
Probably unrelated, so we'll need a network trace to diagnose further.
Comment 2 Bart Meuris 2017-10-27 09:47:32 UTC
Is there a specific port/filter I can apply for a tcpdump? TCP/UDP 139 and 445 enough? This is going to be a massive amount of data, since I haven't been able to reproduce this problem locally, and would have to do this on the production share (which is being heavily used).

I'll try to isolate this client, but I'll have to get back to you about this, since I'll be on holiday the next week.