Bug 7398 - full_audit problem with large files
full_audit problem with large files
Status: RESOLVED FIXED
Product: Samba 3.5
Classification: Unclassified
Component: VFS Modules
unspecified
Other Linux
: P3 normal
: ---
Assigned To: Karolin Seeger
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-04-28 06:27 UTC by Irina Matyukevich
Modified: 2010-05-02 02:30 UTC (History)
0 users

See Also:


Attachments
smb.conf (1.75 KB, application/octet-stream)
2010-04-28 06:33 UTC, Irina Matyukevich
no flags Details
logfile (260.64 KB, application/octet-stream)
2010-04-28 07:09 UTC, Irina Matyukevich
no flags Details
tcpdump: full_audit is on, rename unsuccessful (15.80 KB, application/octet-stream)
2010-04-28 08:05 UTC, Irina Matyukevich
no flags Details
tcpdump: full_audit is off, rename successful (9.13 KB, application/octet-stream)
2010-04-28 08:06 UTC, Irina Matyukevich
no flags Details
tcpdump: full_audit is off, rename successful (24.78 KB, application/octet-stream)
2010-04-29 00:43 UTC, Irina Matyukevich
no flags Details
tcpdump: full_audit is on, rename unsuccessful (17.33 KB, application/octet-stream)
2010-04-29 00:44 UTC, Irina Matyukevich
no flags Details
minimal smb.conf (267 bytes, application/octet-stream)
2010-04-29 02:23 UTC, Irina Matyukevich
no flags Details
Patch for 3.5 (829 bytes, patch)
2010-04-29 13:10 UTC, Volker Lendecke
jra: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Irina Matyukevich 2010-04-28 06:27:34 UTC
When full_audit is used, client can't copy, move, rename or delete large files from samba share. 
The problem does exist in samba versions 3.5.0rc3-55rc3.fc14 and 3.5.2-59.fc13. 
The problem doesn't exist in samba version 3.4.7-58.fc12.
Our samba server is Linux Fedora 12.

Shortly, experiments we did are:

  PART 1: Use smb.conf with full_audit
  1) Try to rename file (size 200Mb). Ok, file renamed.
  2) Try to rename file (size 2,9Gb). No, file not renamed. Client got message: "Cannot rename filename: The specified server cannot perform the requested operation." Also file cannot be moved, copied etc.

  PART 2: Switch off full_audit
  1) Try to rename file (size 200Mb). Ok, file renamed.
  2) Try to rename file (size 2,9Gb). Ok, file renamed.

  PART 3: What samba clients?
  We found that this problem exists when someone connected to samba share from: Windows XP, Windows 7, Windows Vista, Windows 2000 server. 
  Problem does not exist when when someone connected to samba share from Windows 2003 server or from linux Fedora 12 smbclient.
Comment 1 Irina Matyukevich 2010-04-28 06:33:30 UTC
Created attachment 5664 [details]
smb.conf

To switch off full_audit we just commented strings 68-73.
Comment 2 Volker Lendecke 2010-04-28 06:44:00 UTC
Can you please upload a debug level 10 log of smbd during the failure to rename that big file?

Thanks,

Volker
Comment 3 Irina Matyukevich 2010-04-28 07:09:32 UTC
Created attachment 5665 [details]
logfile

User entered into samba share and tried to rename file. He got error message, and immediately I copied logfile to another folder. Our current samba version is 3.5.2-59.fc13.
Comment 4 Volker Lendecke 2010-04-28 07:19:50 UTC
That's strange. I don't even see an attempt to rename that file. Would it also be possible to not have the logfile in the same directory as the the file that your user is about to rename? This clutters the logfile considerably.

Would it be possible that you create network traces of both the successfull and unsuccessful attempts to rename that file (i.e. with and without full_audit)? Information on how to create useful network traces can be found under

http://wiki.samba.org/index.php/Capture_Packets

Thanks,

Volker
Comment 5 Irina Matyukevich 2010-04-28 07:35:37 UTC
As I hope, in our system all samba logs are living in the /var/log/samba directory, not in samba shares, so log's place can not be the reason of corruption.
I did not attach audit logfile, because it contains only connect-disconnect messages. If you need it, please, write. As for network traces, I never did it before, but I'll try to do my best..
Comment 6 Irina Matyukevich 2010-04-28 08:05:37 UTC
Created attachment 5666 [details]
tcpdump: full_audit is on, rename unsuccessful

The command I used for tcpdump is: tcpdump -p -s 0 -w /home/samba_log/tcpdump.txt port 445 or port 139.
Comment 7 Irina Matyukevich 2010-04-28 08:06:00 UTC
Created attachment 5667 [details]
tcpdump: full_audit is off, rename successful
Comment 8 Irina Matyukevich 2010-04-28 08:09:55 UTC
To be on the safe side: dumps were made with log level = 0 in smb.conf file.
Comment 9 Volker Lendecke 2010-04-28 11:25:56 UTC
Can you please upload the network trace of the successful rename from the beginning of the TCP connection, like you did for the failed attempt?

Thanks,

Volker
Comment 10 Irina Matyukevich 2010-04-29 00:43:41 UTC
Created attachment 5668 [details]
tcpdump: full_audit is off, rename successful

Unfortunately, I don't know what I did wrong the first time. I thought two tcpdumps were made the same way. Today we work with another samba user, so there are two new dumps: successful and unsuccessful. User's actions are: 
1) connect to share
2) rename/try to rename file (if rename is unsuccessful - click on windows message)
3) disconnect
Comment 11 Irina Matyukevich 2010-04-29 00:44:09 UTC
Created attachment 5669 [details]
tcpdump: full_audit is on, rename unsuccessful
Comment 12 Irina Matyukevich 2010-04-29 02:23:05 UTC
Created attachment 5670 [details]
minimal smb.conf

In order to exclude side effects of complicated configuration I reproduced this issue on samba with simpler configuration. No things like domain controllers and so on, just samba server. Config file is attached.
Comment 13 Volker Lendecke 2010-04-29 13:10:28 UTC
Created attachment 5672 [details]
Patch for 3.5

99% this is another incarnation of bug 7326. Sorry for not also fixing it in 3.5 immediately. The attached patch should fix it.

Thanks for the logs,

Volker
Comment 14 Jeremy Allison 2010-04-29 17:27:56 UTC
Comment on attachment 5672 [details]
Patch for 3.5

Looks good to me.
Comment 15 Jeremy Allison 2010-04-29 17:28:45 UTC
Re-assigning to Karolin for inclusion in the next 3.5.x.
Comment 16 Irina Matyukevich 2010-04-30 03:18:04 UTC
We tested this patch and problem is solved. Thank you!
Comment 17 Karolin Seeger 2010-05-02 02:30:17 UTC
Pushed to v3-5-test.
Closing out bug report.

Thanks!