Bug 9155 - ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148)
Summary: ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148)
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Other (show other bugs)
Version: 4.1.7
Hardware: x64 Linux
: P5 normal (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-09-12 19:42 UTC by Marc Muehlfeld
Modified: 2014-05-14 07:37 UTC (History)
1 user (show)

See Also:


Attachments
Level 10 debug log that contains the error (248.22 KB, application/x-bzip2)
2012-09-12 19:42 UTC, Marc Muehlfeld
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Marc Muehlfeld 2012-09-12 19:42:58 UTC
Created attachment 7887 [details]
Level 10 debug log that contains the error

I switched my s3 domain to s4 beta8 and in 3 days I got about 6500 of the following error messages flooding my logfile:

[2012/09/09 12:41:58,  1] ../librpc/ndr/ndr.c:412(ndr_pull_error)
  ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148)

I attach a level 10 debug log containing this error.
Comment 1 Stefan Metzmacher 2012-10-22 14:01:18 UTC
Marc, do you have any idea what client are doing when they trigger this?

Is the Terminating connection - 'NT_STATUS_BUFFER_TOO_SMALL' typically following?
Comment 2 Marc Muehlfeld 2012-10-22 14:10:59 UTC
(In reply to comment #1)
> Marc, do you have any idea what client are doing when they trigger this?

No. But I t have this in my testing environment, too (1 s4 + 1 s3 member + 1 xp client). And this is completely separated from the live network. So I don't think it's just one special machine.



> Is the Terminating connection - 'NT_STATUS_BUFFER_TOO_SMALL' typically
> following?

No. It's just this one entry that is repeating and repeating:
[2012/10/22 16:00:05,  1] ../librpc/ndr/ndr.c:412(ndr_pull_error)
  ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148)
[2012/10/22 16:00:50,  1] ../librpc/ndr/ndr.c:412(ndr_pull_error)
  ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148)
[2012/10/22 16:01:35,  1] ../librpc/ndr/ndr.c:412(ndr_pull_error)
  ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148)
[2012/10/22 16:02:20,  1] ../librpc/ndr/ndr.c:412(ndr_pull_error)
  ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148)
[2012/10/22 16:03:05,  1] ../librpc/ndr/ndr.c:412(ndr_pull_error)
  ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148)
[2012/10/22 16:03:50,  1] ../librpc/ndr/ndr.c:412(ndr_pull_error)
  ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148)
[2012/10/22 16:04:35,  1] ../librpc/ndr/ndr.c:412(ndr_pull_error)
  ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148)
[2012/10/22 16:05:20,  1] ../librpc/ndr/ndr.c:412(ndr_pull_error)
  ndr_pull_error(11): Pull bytes 4 (../librpc/ndr/ndr_basic.c:148)


I fgrep all samba logs on the s4 server for NT_STATUS_BUFFER_TOO_SMALL, but don't find this string (log level = 1).
Comment 3 Matthieu Patou 2012-11-06 08:50:08 UTC
Marc I don't see this as a blocker for 4.0, is the logging happening at log level 0 ?

Did you see any unexpected behavior because of this bug ?
Comment 4 Marc Muehlfeld 2012-11-06 08:59:06 UTC
I don't think this is a blocker. It's just filling the logs, what shouldn't be a big problem if "max log size" is set. Only maybe something important get pushed out of the logs then.

I haven't seen any problems here. But maybe I don't know were to look for an issue :-)

I have log level = 1 normally. I haven't tried with 0 yet.
Comment 5 Marc Muehlfeld 2013-02-22 16:42:33 UTC
The issue is still there (currently running 4.0.2). And in my live environment my %m.log meanwile contains 149.468 of this entries (logfile grows since 2012/12/05).

Flooding the log with this messages could be a problem, because the %m.log file isn't rotated (see bug #9673). So this log can grow very big because of this message.
Comment 6 Marc Muehlfeld 2013-12-13 19:46:39 UTC
Is this message anything I have to worry about? I guess it's nothing really important, as we have this since we switched to Samba 4 while it still was in beta stage and it is still there in 4.1.3.

Maybe the log level of this message can be increased?! This would be very helpfull, as we currently log only at level 1 and this messages flood our logs on our DCs (~200.000 occourances in 1 month per DC).
Comment 7 Marc Muehlfeld 2014-05-14 07:37:48 UTC
The error still occurs in 4.1.7.
Setting product / version of this bug report to 4.1.7


Just as a note:
On my first DC, I have this message ~ 230.000 times since january. On my second one just 4 times. Both are in the same subnet, no sites. The only difference is that the first one contains all 5 FSMO roles. I don't know if this matters