Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[sholland]

I am surprised at the number of smbds on there - the only thing that ought to have been transferring files was one program on one machine.

Whyintheheck was one smbd eating the whole CPU? And more importantly, how can I prevent it?

[TheWitness]

By default, there are two smbd's running as the root process.  Then, for every connection to the file system (someone doing something), there will be another smpd "forked" running as the connected user.  If you want to see who is connected, you can run the following command (I hope anyway).

netstat

That will show all the IP address of people connected to the box.

TheWitness

[gunrunnerjohn]

Actually, I have four of them running with no access currently going on.

Code: [Select]

Mem: 59868K used, 1944K free, 0K shrd, 14800K buff, 29008K cached
CPU:   0% usr   0% sys   0% nice  99% idle   0% io   0% irq   0% softirq
Load average: 0.00 0.00 0.02
  PID  PPID USER     STAT   VSZ %MEM %CPU COMMAND
 3083  3082 root     R     1360   2%   0% top
 1607     1 root     S     6656  11%   0% /web/webs
 2309  2302 root     S     5140   8%   0% /usr/sbin/samba/smbd -D
 2302     1 root     S     4836   8%   0% /usr/sbin/samba/smbd -D
 2308  2302 root     S     4836   8%   0% /usr/sbin/samba/smbd -D
 2306     1 root     S     2968   5%   0% /usr/sbin/samba/nmbd -D
 1788     1 root     S     2964   5%   0% pure-ftpd (SERVER)
 1753     1 root     S     1600   3%   0% crond
    1     0 root     S     1596   3%   0% init

[TheWitness]

everything is idle at the moment.  So, no one is accessing anything.  You are going to see them running.  Again, if you run netstat or netstat -a you will see active and idled connections.  When the last connection is fully down, I imagine one or more "smbd" will exit.

TheWitness

[JoeSchmuck]

While this info looks interesting, the only thing I can take from this is what programs were running and eating up CPU time.  Is there any way to tell the actual user (computer) performing the file transfer?  Maybe there is one of the three causing an issue with some kind of scanning of the NAS?

[gunrunnerjohn]

Well, there are a couple of machines sleeping that keep their My Documents folders over there, that's probably a couple of them.

[TheWitness]

There is a "feature", if you want to call it that, in Windows, where Explorer will scan all files in a directory for their file type and attempt to show an appropriate "preview" of the file.  This was a "nasty" feature, especially for a large organization with thousands of users hitting the shares a the same time.  I don't know how to turn down the "preview" mode.  You might want to investigate that.  It's been too long for me now.  I know that it can be adjusted from the registery, but I don't know about explorer.

TheWitness