I have some Ubuntu Servers running Samba with Winbind. Everything is fine, but Macs will randomly disconnect overnight, or at some irregular interval.
On the servers, Samba logs this as two events:
2: closed connection to service data
By matching timestamps on the Macs I can see they log the drops as:
kcm DEPRECATED USE in libdispatch client: Setting timer interval to 0 requests a 1ns timer, did you mean FOREVER (a one-shot timer)?; set a breakpoint on _dispatch_bug_deprecated to debug
By analyzing timestamps I have determined that this is the only event logged on the Mac clients' side. Here is an example client that has a shell script writing to a text file on a share every ten seconds:
You can see the connection was alive at
08:59:46 in the text file on the left, and in
/var/log/system.log there's only a single relevant message.
I asked on the Samba list serve about it and have been told the Macs are simply closing the connections.
Wireshark analysis shows some additional information:
As if to confound, there's an
NT Status: STATUS_SUCCESS messages in there (see annotation).
Here is what Microsoft says about the error:
If the Status field in the SMB2 header is STATUS_NETWORK_SESSION_EXPIRED, the client MUST attempt to reauthenticate the session that is identified by the SessionId in the SMB2 header, as specified in section 126.96.36.199.3. If the reauthentication attempt succeeds, the client MUST retry the request that failed with STATUS_NETWORK_SESSION_EXPIRED. If the reauthentication attempt fails, the client MUST fail the operation and terminate the session, as specified in section 188.8.131.52.
Is there a script I can run to just renew the session in a cron job?
Other types clients will keep the connections open forever, so it does indeed seem like only Macs are doing this. The OS versions vary from OS X 10.12 to macOS Catalina, using various flavors of SMB2 to SMB3.
Any idea how I can begin to understand why the macs are doing this, or any tips on getting them to keep the connections alive?
The Mac clients are running jobs that rely on a persistent connection.
Highly relevant to know, but originally left out as I was looking for a workaround:
I have about a dozen of these servers (mostly Ubuntu 18.04; Samba 4.7.6) running fine for the past several years. Three of them had automatic updates installed, and these three have the issue of the Macs disconnecting. I'm holding back letting the other servers restart for the updates, and the Macs will not drop connections to the non-updated servers.
As a test I setup a server to 16.04 to see if and older version of Ubuntu Server would pose the same issue. Surprisingly it has the same problem using a different version of Samba (4.3.11). I will have to do the test again, without letting 16.04 install the latest security updates, in order to confirm my suspicions that those are the cause of the problem.
Though I suspect something in Ubuntu's core changed, I am asking here since only Macs are affected.
On a number of Macs with OSes from 10.12 to Catalina I have tried testing them with their default settings, and all possible combinations of changes to
protocol_vers_map=[see manpage for nsmb.conf (linked below)]
On the server I've tried following the advice of another sysadmin on the #macosx freenode channel, kode54, who shared how they eventually got a stable connection.
The advice didn't help–well I haven't fully tried it as it requires installing a version of Samba from a PPA for a version of Samba maintained by the Linux for Schools Project–but informed me of
vfs_fruit and the fact that there is a developmental effort of extending Samba through an extra package for, in part, dealing with Macs. It also led me to find a page on Samba's wiki discussing difficulties with Macs and server-side workarounds: Configure Samba to Work Better with Mac OS X
It's difficult for me to try installing suggested Samba PPA because these servers are fileservers in part only, and are generally always being used for compute jobs that can take days to run (neuroimaging processing). They were built for compute jobs, and do storage almost as a side-effect of the dual-socket, high-memory density, server options also happening to be the servers with the large number of drive bays (16+).
I'm hoping to try other options before becoming fully negatively disruptive.
Since none of the server-side options are helping–I've been trying the flags in various combinations no to avail–I am hoping that the Apple community will have some workaround for me.
Any way of keeping a persistent connection, despite where the issue may originate, would be incredibly valuable.