Re: Samba hogs syslogd and fails

On 2024-09-16 16:17, Andrea Venturoli wrote:
> Hello.
> 
> I've got some trouble with Samba (if interested, see [1] for details).
> 
> One of the aspect is that, with vfs_full_audit, it seems to log so much 
> that syslogd cannot keep up (or at least it's what I think is 
> happening).
> 
> Samba opens /var/run/log and start sending *a lot* of data, eventually 
> getting errno=55/ENOBUFS/No buffer space available.
> The machine isn't exactly "slow" (RAIDZ1 on SSD enterprise), although 
> it's also performing other tasks.
> 
> Apart from correcting Samba, is there something that can be done on the 
> OS side?
> Syslogd tweaking? Better buffering? Blocking the socket instead of 
> returnin ENOBUFS, etc...?
> 
>  bye & Thanks
> 	av.
> 
> [1] https://bugzilla.samba.org/show_bug.cgi?id=15711

As no one else who knows better has answered...

mbufs are using by the networking stack, and pipes are implemented as 
sockets these days - i.e. syslogd is talking through them (I assume).

You can increase the number of mbufs with sysctl 
kern.ipc.nmbclusters=###### where each cluster holds 2048 mbufs IIRC.

I don't see why you're running out unless there's a leak, however, so 
this will most likely delay rather than solve the problem.

You can find out the current mbuf usage and failed allocation count 
using netstat -m.

If you didn't know this already, I hope it helps.

Regards, Frank.
-- 
------
25-Sept-24 My apologies to everyone who I appear to have ignored for the 
last few years. A procmail script was misfiling some replies to 
Questions to the wrong folder.