We manage several samba server pools, each on it's own network and authenticating against different AD domains. These sites use winbind for AD integration, and have been experiencing the following intermittent error on some of the servers. (The problem does not happen on all servers, but when it affects one, it usually re-appears weeks/months later on the same server.) I have not been able to locate a bug report pertaining to this:

First, the log.winbindd snippet from one of the affected sites:

[2008/11/21 06:55:57, 0] rpc_client/cli_pipe.c:rpc_api_pipe(790)
  rpc_api_pipe: Remote machine DOMAIN_CONTROLLER pipe \NETLOGON fnum 0x4002returned critical error. Error was Call timed out: server did not respond after 10000 milliseconds
[2008/11/21 06:55:57, 0] libsmb/clientgen.c:cli_rpc_pipe_close(375)
  cli_rpc_pipe_close: cli_close failed on pipe \samr, fnum 0x4003 to machine DOMAIN_CONTROLLER.  Error was Call timed out: server did not respond after 10000 milliseconds
[2008/11/21 06:55:57, 0] libsmb/clientgen.c:cli_rpc_pipe_close(375)
  cli_rpc_pipe_close: cli_close failed on pipe \lsarpc, fnum 0x4000 to machine DOMAIN_CONTROLLER.  Error was Call timed out: server did not respond after 10000 milliseconds
[2008/11/21 06:55:57, 0] libsmb/clientgen.c:cli_rpc_pipe_close(375)
  cli_rpc_pipe_close: cli_close failed on pipe \NETLOGON, fnum 0x4002 to machine DOMAIN_CONTROLLER.  Error was Call timed out: server did not respond after 10000 milliseconds
[2008/11/21 06:59:05, 0] rpc_client/cli_pipe.c:rpc_api_pipe(790)
  rpc_api_pipe: Remote machine DOMAIN_CONTROLLER pipe \lsarpc fnum 0x8008returned critical error. Error was Call timed out: server did not respond after 10000 milliseconds
[2008/11/21 06:59:05, 1] nsswitch/winbindd_group.c:winbindd_getgrnam(255)
  group SOME_GROUP in domain SOME_DOMAIN does not exist
[2008/11/21 06:59:05, 1] nsswitch/winbindd_group.c:winbindd_getgrnam(255)
  group SOME_GROUP in domain SOME_DOMAIN does not exist
[2008/11/21 06:59:05, 0] libsmb/clientgen.c:cli_rpc_pipe_close(375)
  cli_rpc_pipe_close: cli_close failed on pipe \lsarpc, fnum 0x8008 to machine DOMAIN_CONTROLLER.  Error was Call timed out: server did not respond after 10000 milliseconds
[2008/11/21 06:59:36, 1] nsswitch/winbindd_group.c:winbindd_getgrnam(255)
  group SOME_GROUP in domain SOME_DOMAIN does not exist
<... this last log entry is repeated several times...>


When the problem presents itself, we consistently find these log entries 2-5 days prior to the client access problems. Most commonly, the problem presents itself to the client as an inability to resolve the hostname of the samba server. (There may have been an incident where the AD username/group was not resolvable anymore, but this detail may have been due to faulty investigation.)

There is one further curiosity: on some of the affected servers, the SOME_GROUP is actually the name of the local samba access group (i.e. a local linux group,) and does not exist in the AD domain. On most, it is the AD domain group which is storing to the samba server.

A restart of winbind always clears the problem up.

We are running SLES 10, with the included samba build of Version 3.0.24-2.23-1296-SUSE-CODE10