Created attachment 7887 [details] Level 10 debug log that contains the error I switched my s3 domain to s4 beta8 and in 3 days I got about 6500 of the following error messages flooding my logfile: [2012/09/09 12:41:58, 1] ../librpc/ndr/ndr.c:412(ndr_pull_error) ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148) I attach a level 10 debug log containing this error.
Marc, do you have any idea what client are doing when they trigger this? Is the Terminating connection - 'NT_STATUS_BUFFER_TOO_SMALL' typically following?
(In reply to comment #1) > Marc, do you have any idea what client are doing when they trigger this? No. But I t have this in my testing environment, too (1 s4 + 1 s3 member + 1 xp client). And this is completely separated from the live network. So I don't think it's just one special machine. > Is the Terminating connection - 'NT_STATUS_BUFFER_TOO_SMALL' typically > following? No. It's just this one entry that is repeating and repeating: [2012/10/22 16:00:05, 1] ../librpc/ndr/ndr.c:412(ndr_pull_error) ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148) [2012/10/22 16:00:50, 1] ../librpc/ndr/ndr.c:412(ndr_pull_error) ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148) [2012/10/22 16:01:35, 1] ../librpc/ndr/ndr.c:412(ndr_pull_error) ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148) [2012/10/22 16:02:20, 1] ../librpc/ndr/ndr.c:412(ndr_pull_error) ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148) [2012/10/22 16:03:05, 1] ../librpc/ndr/ndr.c:412(ndr_pull_error) ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148) [2012/10/22 16:03:50, 1] ../librpc/ndr/ndr.c:412(ndr_pull_error) ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148) [2012/10/22 16:04:35, 1] ../librpc/ndr/ndr.c:412(ndr_pull_error) ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148) [2012/10/22 16:05:20, 1] ../librpc/ndr/ndr.c:412(ndr_pull_error) ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148) I fgrep all samba logs on the s4 server for NT_STATUS_BUFFER_TOO_SMALL, but don't find this string (log level = 1).
Marc I don't see this as a blocker for 4.0, is the logging happening at log level 0 ? Did you see any unexpected behavior because of this bug ?
I don't think this is a blocker. It's just filling the logs, what shouldn't be a big problem if "max log size" is set. Only maybe something important get pushed out of the logs then. I haven't seen any problems here. But maybe I don't know were to look for an issue :-) I have log level = 1 normally. I haven't tried with 0 yet.
The issue is still there (currently running 4.0.2). And in my live environment my %m.log meanwile contains 149.468 of this entries (logfile grows since 2012/12/05). Flooding the log with this messages could be a problem, because the %m.log file isn't rotated (see bug #9673). So this log can grow very big because of this message.
Is this message anything I have to worry about? I guess it's nothing really important, as we have this since we switched to Samba 4 while it still was in beta stage and it is still there in 4.1.3. Maybe the log level of this message can be increased?! This would be very helpfull, as we currently log only at level 1 and this messages flood our logs on our DCs (~200.000 occourances in 1 month per DC).
The error still occurs in 4.1.7. Setting product / version of this bug report to 4.1.7 Just as a note: On my first DC, I have this message ~ 230.000 times since january. On my second one just 4 times. Both are in the same subnet, no sites. The only difference is that the first one contains all 5 FSMO roles. I don't know if this matters