Core is Hammering a Windows File Server

[rdmustang]

I added a Windows file server to the core and it's indexing the files.  The problem is that I added the file server over a month ago and it's hammering the file server constantly (~13 authentications per second, 24/7).  It's so bad that when I stream video from the file server the application I'm using stops playing.  The only resolution is to disable the account I provided the Core for authentication to the file server.

This is my ~5th time installing LMCE over the past year.  Previous installs didn't do this and I believe were set up exactly the same (I've been writing down my own steps when setting everything up).

The Core is correctly indexing the files.  The file server is 7TB and is pretty full which is why I've waited so long to report the issue. 

Did I do something wrong this time?  Any help is greatly appreciated!

[colinjones]

hmm that doesn't sound right! Certainly the core (and MDs) will connect periodically either to confirm the share is still online or for UpdateMedia to resync. Then you will see in your Security log a bunch of events - there are several different events logged relating to each individual authentication, so don't double count them.

This will likely happen every 5 seconds or so. However, UpdateMedia should only be triggered 2 mins after the previous one completed. In other words it sleeps for 2 mins before starting again. But that shouldn't really be generating authentication attempts (except when it first starts and connects)... instead you should see a session appear in Computer Management -> Shared Folders -> sessions...

I have seen UpdateMedia get into a spin and pretty much scan continuously 24/7 but as I say, that shouldn't be generating authentication attemps... one point is, have you set a username/password in the LMCE definition for that share? Perhaps you should do that and give that username full access to the share.

[rdmustang]

I have a username/password set and it's working because the media lists are being updated.  The account had read-only priviledges.  I changed it to full privs and I'm still seeing a constant hammering. 

You were right about double-counting authentication attempts.  There are about 5-6 per second (Event ID 680).

[colinjones]

There should be a burst of several security events all related to the same authentication (depending on the logging level you are at), then a pause for about 5 seconds, before it happens again - this once per MD you have. This in itself isn't a problem as long as it is just authenticating and not doing disk activity. You should "tail" the UpdateMedia log to confirm that it is going to sleep for 2 mins at the end of each scan.

[rdmustang]

UpdateMedia.log hasn't been written to since 13 Feb

# pwd
/var/log/pluto

# ls UpdateMedia.log* -la
-rw-r--r-- 1 root root         0 2009-02-19 07:35 UpdateMedia.log
-rw-r--r-- 1 root root         0 2009-02-18 07:35 UpdateMedia.log.1
-rw-r--r-- 1 root root        20 2009-02-17 07:35 UpdateMedia.log.2.gz
-rw-r--r-- 1 root root        20 2009-02-16 07:35 UpdateMedia.log.3.gz
-rw-r--r-- 1 root root        20 2009-02-15 07:36 UpdateMedia.log.4.gz
-rw-r--r-- 1 root root        20 2009-02-14 07:35 UpdateMedia.log.5.gz
-rw-r--r-- 1 root root 141102292 2009-02-13 21:21 UpdateMedia.log.6.gz
-rw-r--r-- 1 root root        20 2009-02-12 07:35 UpdateMedia.log.7.gz

I checked today and the logon attempts are down to 1-2 per second.

Is something messed up?

[colinjones]

UpdateMedia.log hasn't been written to since 13 Feb

# pwd
/var/log/pluto

# ls UpdateMedia.log* -la
-rw-r--r-- 1 root root         0 2009-02-19 07:35 UpdateMedia.log
-rw-r--r-- 1 root root         0 2009-02-18 07:35 UpdateMedia.log.1
-rw-r--r-- 1 root root        20 2009-02-17 07:35 UpdateMedia.log.2.gz
-rw-r--r-- 1 root root        20 2009-02-16 07:35 UpdateMedia.log.3.gz
-rw-r--r-- 1 root root        20 2009-02-15 07:36 UpdateMedia.log.4.gz
-rw-r--r-- 1 root root        20 2009-02-14 07:35 UpdateMedia.log.5.gz
-rw-r--r-- 1 root root 141102292 2009-02-13 21:21 UpdateMedia.log.6.gz
-rw-r--r-- 1 root root        20 2009-02-12 07:35 UpdateMedia.log.7.gz

I checked today and the logon attempts are down to 1-2 per second.

Is something messed up?

Yes, something is definitely wrong. In the admin console under media file sync there is a tick box for the Update Media Daemon. Ensure this is ticked. If so, tail the log file, then untick it and retick it - check the log to ensure it starts logging something again. Also, from the same location navigate into one of your media folders, then hit the resync button and see what it is logging...