Created attachment 18807 [details]
pidstat winbind processes since 2026-01-20

we are running a bunch samba servers on sles15sp7 as office spoolservers for different location.

there three servers with approx 200 printerqueues and more then 300 windows 11 clients.

after some day (2-3) the server get instable and the cpu-load is high.
Printing stopps, so we have to restart winbind and smbd. 

After this everything is running again for two days.
We already installed a cronjob to restart daily.

Now my findings:

I run a 'pidstat -r 60 | grep "rpc\|winbi\|bgqd\|VSZ" >pidstat_winbind.out'
to monitor the memory usage.

priu0002:~ # grep "121990" pidstat_winbind.20260120 | head -1 ; grep "121990"  pidstat_winbind.20260120 | tail -1
17:36:22        0    121990      7.96      0.00  137680   45456   0.39  rpcd_spoolss
19:55:22        0    121990      4.18      0.00  681536  585568   4.97  rpcd_spoolss

In this moment the first line show the process rpcd_spoolss 121990 started on 2026-01-20 at 17:35.

the second line is the same process from today 2026-01-22 at 19:55.

the memory consumtion grows from 0.39% to 4.97% of the hole memory.
the server is a virtual machine with 12GB-Ram and 6 CPUs


I also did a smbcontrol 121990 pool-usage on 2026-01-20T1737 and on 2026-01-22T1944

smbcontrol 121990 pool-usage >rpcd_spoolss_pool-usage_121990_$(date +"%Y-%m-%dT%H%M").out

the output file grows from:
ls -lh rpcd_spoolss_pool-usage_121990_2026-01-20T1737.out rpcd_spoolss_pool-usage_121990_2026-01-22T1944.out
-rw-r--r-- 1 root root 586K Jan 20 17:37 rpcd_spoolss_pool-usage_121990_2026-01-20T1737.out
-rw-r--r-- 1 root root  43M Jan 22 19:44 rpcd_spoolss_pool-usage_121990_2026-01-22T1944.out

the smb.conf look like:
----
# Global parameters
[global]
        client signing = required
        kerberos method = secrets and keytab
        log file = /var/log/samba/log.%M
        passdb backend = tdbsam:/var/lib/samba/private/passdb.tdb
        realm = BROSE.NET
        restrict anonymous = 2
        security = ADS
        server string = %h Samba %v
        smb1 unix extensions = No
        socket options = TCP_NODELAY SO_KEEPALIVE TCP_KEEPIDLE=10 TCP_KEEPCNT=3 TCP_KEEPINTVL=3
        template shell = /bin/bash
        winbind expand groups = 2
        winbind max clients = 400
        winbind max domain connections = 5
        winbind refresh tickets = Yes
        winbind separator = +
        winbind use default domain = Yes
        workgroup = BROSE
        idmap config brose : range = 2000000-500000000
        idmap config brose : backend = rid
        idmap config * : range = 500000001-500009999
        rpcd_spoolss:num_workers = 6
        rpcd_spoolss:idle_seconds = 300
        idmap config * : backend = tdb
        include = /etc/samba/smb.shares.conf
        read only = No


[printers]
        browseable = No
        comment = All Printers
        create mask = 0600
        path = /var/tmp
        printable = Yes


[print$]
        comment = Printer Drivers
        create mask = 0664
        directory mask = 0775
        force group = ntadmin
        force user = root
        path = /var/lib/samba/drivers
        write list = @BROSE+pri_cups_printer_admin @ntadmin root


[pdf]
        comment = generated PDF-Files
        path = /srv/smb/pdf
        write list = @BROSE+pri_cups_printer_admin


[_pdf]
        comment = Acrobat Distiller 3011.104
        cups options = raw
        include = /etc/samba/smb.local.conf
        path = /var/tmp
        printable = Yes
priu0002:~ # testparm -s > testparm.out
Load smb config files from /etc/samba/smb.conf
Loaded services file OK.
Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback)

'winbind separator = +' might cause problems with group membership.

SUGGESTION: You may want to use 'sync machine password to keytab' parameter instead of 'kerberos method'.

Server role: ROLE_DOMAIN_MEMBER

priu0002:~ # vi testparm.out
priu0002:~ # vi testparm.out
priu0002:~ # cat testparm.out
# Global parameters
[global]
        client signing = required
        kerberos method = secrets and keytab
        log file = /var/log/samba/log.%M
        passdb backend = tdbsam:/var/lib/samba/private/passdb.tdb
        realm = EXAMPLE.NET
        restrict anonymous = 2
        security = ADS
        server string = %h Samba %v
        smb1 unix extensions = No
        socket options = TCP_NODELAY SO_KEEPALIVE TCP_KEEPIDLE=10 TCP_KEEPCNT=3 TCP_KEEPINTVL=3
        template shell = /bin/bash
        winbind expand groups = 2
        winbind max clients = 400
        winbind max domain connections = 5
        winbind refresh tickets = Yes
        winbind separator = +
        winbind use default domain = Yes
        workgroup = EXAMPLE
        idmap config example : range = 2000000-500000000
        idmap config example : backend = rid
        idmap config * : range = 500000001-500009999
        rpcd_spoolss:num_workers = 6
        rpcd_spoolss:idle_seconds = 300
        idmap config * : backend = tdb
        include = /etc/samba/smb.shares.conf
        read only = No


[printers]
        browseable = No
        comment = All Printers
        create mask = 0600
        path = /var/tmp
        printable = Yes


[print$]
        comment = Printer Drivers
        create mask = 0664
        directory mask = 0775
        force group = ntadmin
        force user = root
        path = /var/lib/samba/drivers
        write list = @EXAMPLE+pri_cups_printer_admin @ntadmin root


[pdf]
        comment = generated PDF-Files
        path = /srv/smb/pdf
        write list = @EXAMPLE+pri_cups_printer_admin


[_pdf]
        comment = Acrobat Distiller 3011.104
        cups options = raw
        include = /etc/samba/smb.local.conf
        path = /var/tmp
        printable = Yes
----

please fix this or help me do digging deaper.

regards
Franz