Syslog gets messed up with messages "Invalid SMB packet: first request: 0x000B smb2_server.c:610"

[atto58]

Hi,
my system is busy with writing messages to the syslog like:

Dec 18 17:02:15 uhs smbd[1902]: [2023/12/18 17:02:15.349986,  0] ../../source3/smbd/smb2_server.c:610(smbd_smb2_request_create)
Dec 18 17:02:15 uhs smbd[1902]:   Invalid SMB packet: first request: 0x000B

This happens roughly every 4 milliseconds. 

I disconnected all SMB clients, then also disabled all SMB shares on the device, i.e. set them to hidden and rebooted - no change.

Now finally, I have removed almost all of the plugins, I have stopped the array and rebooted again WITHOUT bringing the array into service - no sucess.

The messages are still written to the syslog.

This is the position in syslog were smbd is started:
ec 18 17:26:36 uhs acpid: waiting for events: event logging is off
Dec 18 17:26:36 uhs crond[1206]: /usr/sbin/crond 4.5 dillon's cron daemon, started with loglevel notice
Dec 18 17:26:37 uhs smbd[1244]: [2023/12/18 17:26:37.072027,  0] ../../source3/smbd/server.c:1741(main)
Dec 18 17:26:37 uhs smbd[1244]:   smbd version 4.17.12 started.
Dec 18 17:26:37 uhs smbd[1244]:   Copyright Andrew Tridgell and the Samba Team 1992-2022
Dec 18 17:26:37 uhs sshd[1259]: Connection from 192.168.2.162 port 40760 on 192.168.2.2 port 22 rdomain ""
Dec 18 17:26:37 uhs wsdd2[1260]: starting.
Dec 18 17:26:37 uhs winbindd[1261]: [2023/12/18 17:26:37.326833,  0] ../../source3/winbindd/winbindd.c:1440(main)
Dec 18 17:26:37 uhs winbindd[1261]:   winbindd version 4.17.12 started.
Dec 18 17:26:37 uhs winbindd[1261]:   Copyright Andrew Tridgell and the Samba Team 1992-2022
Dec 18 17:26:37 uhs winbindd[1264]: [2023/12/18 17:26:37.349674,  0] ../../source3/winbindd/winbindd_cache.c:3117(initialize_winbindd_cache)
Dec 18 17:26:37 uhs winbindd[1264]:   initialize_winbindd_cache: clearing cache and re-creating with version number 2
Dec 18 17:26:37 uhs smbd[1287]: [2023/12/18 17:26:37.507465,  0] ../../source3/smbd/smb2_server.c:610(smbd_smb2_request_create)
Dec 18 17:26:37 uhs smbd[1287]:   Invalid SMB packet: first request: 0x000B
Dec 18 17:26:37 uhs smbd[1288]: [2023/12/18 17:26:37.524651,  0] ../../source3/smbd/smb2_server.c:610(smbd_smb2_request_create)
Dec 18 17:26:37 uhs smbd[1288]:   Invalid SMB packet: first request: 0x000B

Any idea would be great. The system is not usable now due to the high load the logs are creating.

Best,
Reiner

[dlandon]

Post diagnostics.

[atto58]

Please find the diagnostics attached here.uhs-diagnostics-20231221-1842.zipuhs-diagnostics-20231221-1842.zip
 

Fyi, in order not to permanently have the logs filled by 100% I installed a user script like

 

#!/bin/bash
cd /var/log
cp syslog syslog.old
truncate -s 0 syslog

 

Nevertheless the CPU load is always close to 100%.

[dlandon]

I have a few suggestions:

• Turn off MacOS compatibility.
• Configure your network, don't use defaults.  Settings->Network Settings.
• Set your Workgroup to the default "WORKGROUP".
• Don't set the Unriad server as the Master Browser.

[atto58]

So, the issue has vanished as Xmas present without any idea from my side  why it actually did. Anyway on Xmas Eve the issue disappeared and the logs stay free from smbd issues.

What have I done so far?

Following the latest comment

• I turned off MacOS compatibiliy
• I tried to change network settings removing defaults, but had issues with docker, so re-installed the original content (maybe I did not get the point)
• I reset my workgroup to WORKGROUP
• I actually do not know the settings to suppress the Unraid server from becoming the Master browser

In addition I rebooted the machine, but even with the array not being started, I still saw the syslog being filled with smbd logs. I brought the array and the VMs into service then. As the system was at least somehow working and I was busy with some other things, nothing was changed on the system after that. But, almost exactly 3 days later the log burst has vanished. 

[atto58]

This morning I did a reboot of the server for another issue. Now the log entries from smbd as mentioned above re-appeared.

I am wondering, if they vanish again after three days. Quite annoying that the system is again on 100% load permanently.

[atto58]

The issue keeps annoying me as the CPU load is permanently close to 100%.
Any ideas?